How TrustOnCloud Maps to the CIS Google Cloud Platform Foundations Benchmark v4.0.0
We aligned our controls with the CIS GCP Foundations Benchmark so you can satisfy auditor requirements while going beyond checklist compliance.
Introduction to CIS Benchmarks
The Center for Internet Security (CIS) publishes security benchmarks that outline foundational best practices for securing systems and cloud environments. These benchmarks are widely adopted as a starting point for organizations securing workloads in Google Cloud. They focus on basic configurations and technical settings. This helps establish a baseline but is often opinionated and not tailored for complex, real-world environments.
Auditors, security leaders, and compliance teams often reference CIS benchmarks to ensure critical controls are in place.
Why Map CIS to TrustOnCloud?
TrustOnCloud goes beyond prescriptive configuration checks. Our controls are built to address actual threats, not just configuration drift. Still, many customers are asked to demonstrate alignment with CIS benchmarks. That's where this mapping comes in.
By aligning TrustOnCloud controls with the CIS Google Cloud Platform Foundations Benchmark, we help customers:
- Satisfy baseline requirements for auditors
- Identify which TrustOnCloud controls correspond to each CIS recommendation
- Understand where we provide more flexible or risk-driven alternatives
CIS-to-TrustOnCloud Mapping
This section shows a sample of the control-level alignment for the CIS Google Cloud Platform Foundations Benchmark v4.0.0.
| CIS ID | TrustOnCloud Control ID | Comments |
|---|---|---|
1.1 | Iam.C3 assured by Iam.C4 under Iam.CO2 | |
1.2 | Iam.C95 assured by Iam.C96 under Iam.CO10 | |
1.3 | Iam.C26 under Iam.CO10 | |
1.4 | Iam.C5 assured by Iam.C6 under Iam.CO3 | |
1.5 | Iam.C1 assured by Iam.C2 under Iam.CO1 | This CIS control ensures service accounts do not have Admin privileges. Control Iam.C1 specifies to ensure there are no basic roles used for all identities (e.g., service accounts or users). |
1.6 | Iam.C78 assured by Iam.C79 under Iam.CO3 | |
1.7 | Iam.C5 assured by Iam.C6 under Iam.CO3 | |
1.8 | Iam.C80 assured by Iam.C81 under Iam.CO3 | |
1.9 | Iam.C13 assured by Iam.C14 under Iam.CO5 | This CIS control ensures Cloud KMS crypto keys are not anonymously or publicly accessible. Control Iam.C13 specifies to ensure all service's IAM bindings are defined and reviewed as part of your IAM Operating Model. |
1.10 | Cloudkms.C4 assured by Cloudkms.C5 under Cloudkms.CO3 | This CIS control ensures Cloud KMS encryption keys are rotated within a period of 90 days. Control Cloudkms.C4 specifies that rotation of keys is performed per the organization's security requirements, which may be more frequent than 90 days. |
Conclusion
The CIS Google Cloud Platform Foundations Benchmark is a helpful baseline, but it doesn't reflect the complexity of real-world threat models. TrustOnCloud helps you go further by tailoring controls to your risk appetite, workloads, and business needs.
If you're already a customer, we hope this mapping will be helpful. If not, book a 20-minute call and we'll explain how our controls align and how we help you go beyond checklist compliance. You may also be interested in exploring our Control Catalog.
