Common controls for generative AI use cases

This document describes the common controls that create a baseline security environment for generative AI workloads in Google Cloud. These controls help ensure consistent and secure use of the Google Cloud environment. We recommend that you apply them to your environment before deploying production services.

These controls are meant to provide you with a starting point only. You can adapt and add organizational-specific controls as required by your organization's security policies. In addition, consider additional controls based on the specific workloads and sensitive data that you have on Google Cloud.

Required common controls

The following controls are strongly recommended for your Google Cloud environment.

Restrict TLS versions supported by Google APIs

Google control ID	COM-CO-1.1
Category	Required
Description	Google Cloud supports multiple TLS protocol versions. To meet compliance requirements, you might want to deny handshake requests from clients that use older TLS versions. To configure this control, use the Restrict TLS Versions (`gcp.restrictTLSVersion`) organization policy constraint. You can apply this constraint to organizations, folders, or projects in the resource hierarchy. The Restrict TLS Versions constraint uses a deny list, which denies explicit values and allows all others. An error occurs if you try to use an allow list. Due to the behavior of organization policy hierarchy evaluation, the TLS version restriction applies to the specified resource node and all of its folders and projects (children). For example, if you deny TLS version 1.0 for an organization, it is also denied for all children that descend from that organization. You can override the inherited TLS version restriction by updating the organization policy on a child resource. For example, if your organization policy denies TLS 1.0 at the organization level, you can remove the restriction for a child folder by setting a separate organization policy on that folder. If the folder has any children, the folder's policy will also be applied on each child resource due to policy inheritance. To further restrict the TLS version to TLS 1.3 only, you can set this policy to also restrict TLS version 1.2. You must implement this control on applications that you host inside of Google Cloud. For example, at the organization level, set: `["TLS_VERSION_1","TLS_VERSION_1.1","TLS_VERSION_1.2"]`
Applicable products	All; managed by Organization Policy Service
Path	`gcp.restrictTLSVersion`
Operator	`==`
Value	`TLS_VERSION_1` `TLS_VERSION_1.1`
Type	String
Compliance Manager control ID	`RESTRICT_LEGACY_TLS_VERSIONS`
Related NIST-800-53 controls	SC-8 SC-13
Related CRI profile controls	PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Restrict TLS versions

Encrypt data at rest in Google Cloud

Google control ID	COM-CO-2.1
Category	Required (default)
Description	All data in Google Cloud is encrypted at rest by default using NIST-approved algorithms.
Applicable products	Google Cloud default
Related NIST-800-53 controls	SC-28
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2
Related information	Default encryption at rest

Use NIST-approved algorithms for encryption and decryption

Google control ID	COM-CO-2.4
Category	Required
Description	Ensure that Cloud Key Management Service (Cloud KMS) only uses NIST-approved algorithms to store sensitive keys in the environment. This control ensures secure key usage by only NIST-approved algorithms and security. The `CryptoKeyVersionAlgorithm` field is a provided allowlist. Remove algorithms that don't comply with your organization's policies.
Applicable products	Cloud KMS
Path	`cloudkms.projects.locations.keyRings.cryptoKeys/versionTemplate.algorithm`
Operator	`in`
Value	`RSA_SIGN_PSS_2048_SHA256` `RSA_SIGN_PSS_3072_SHA256` `RSA_SIGN_PSS_4096_SHA256` `RSA_DECRYPT_OAEP_2048_SHA256` `RSA_DECRYPT_OAEP_4096_SHA256` `RSA_DECRYPT_OAEP_2048_SHA1` `RSA_DECRYPT_OAEP_4096_SHA1`
Type	String
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Key purposes and algorithms Create a key

Set the purpose for Cloud KMS keys

Google control ID	COM-CO-2.5
Category	Required
Description	Set the purpose for Cloud KMS keys to `ENCRYPT_DECRYPT` so that keys are only used to encrypt and decrypt data. This control blocks other functions, such as signing, and ensures that keys are only used for their intended purpose. If you use keys for other functions, validate those use cases and consider creating additional keys.
Applicable products	Cloud KMS
Path	`cloudkms.projects.locations.keyRings.cryptoKeys/purpose`
Operator	`==`
Value	`ENCRYPT_DECRYPT`
Type	String
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Key purposes and algorithms Create a key

Ensure that CMEK settings are appropriate for secure BigQuery data warehouses

Google control ID	COM-CO-2.6
Category	Required
Description	The protection level indicates how cryptographic operations are performed. After you create a customer-managed encryption key (CMEK), you can't change the protection level. Supported protection levels are the following: SOFTWARE: Cryptographic operations are performed in software. HSM: Cryptographic operations are performed in a hardware security module (HSM). EXTERNAL: Cryptographic operations are performed using a key that is stored in an external key manager that is connected to Google Cloud over the internet. Limited to symmetric encryption and asymmetric signing. EXTERNAL_VPC: Cryptographic operations are performed using a key that is stored in an external key manager that is connected to Google Cloud over a Virtual Private Cloud (VPC) network. Limited to symmetric encryption and asymmetric signing.
Applicable products	Cloud KMS BigQuery
Path	`cloudkms.projects.locations.keyRings.cryptoKeys/primary.protectionLevel`
Operator	`in`
Value	`[]`
Type	String
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Cloud KMS protection levels External key manager Import data into a secured BigQuery data warehouse

Rotate encryption key every 90 days

Google control ID	COM-CO-2.7
Category	Required
Description	Ensure that the rotation period of your Cloud KMS keys are set to 90 days. A general best practice is to rotate your security keys on a regular interval. This control enforces key rotation for keys that are created with HSM services. When you create this rotation period, also create appropriate policies and procedures to securely handle the creation, deletion, and modification of keying material so that you can help protect your information and ensure availability. Ensure that this period adheres to your corporate policies for key rotation.
Applicable products	Cloud KMS
Path	`cloudkms.projects.locations.keyRings.cryptoKeys/rotationPeriod`
Operator	`<=`
Value	`90`
Type	int32
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Key rotation

Define authorized principals

Google control ID	COM-CO-4.1
Category	Required
Description	Use the Domain restricted sharing (`iam.allowedPolicyMemberDomains`) organization policy constraint to define one or more Cloud Identity or Google Workspace customer IDs whose principals can be added to Identity and Access Management (IAM) policies.
Applicable products	Organization Policy Service IAM
Path	`constraints/iam.allowedPolicyMemberDomains`
Operator	`Is`
Value	`CUSTOMER_ID,ORG_ID`
Type	List
Related NIST-800-53 controls	AC-3 AC-17 AC-20
Related CRI profile controls	PR.AC-3.1 PR.AC-3.2 PR.AC-4.1 PR.AC-4.2 PR.AC-4.3 PR.AC-6.1 PR.PT-3.1 PR.PT-4.1
Related information	Restricting identities by domain

Use audit logs

Google control ID	COM-CO-7.3
Category	Required
Description	Google Cloud services write audit log entries to answer who did what, where, and when with Google Cloud resources. Enable audit logging at the organization level. You can configure logging using the pipeline that you use to set up the Google Cloud organization.
Applicable products	Cloud Audit Logs
Related NIST-800-53 controls	AU-2 AU-3 AU-8 AU-9
Related CRI profile controls	DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4
Related information	Cloud Audit Logs overview

Enable VPC Flow Logs

Google control ID	COM-CO-7.4
Category	Required
Description	VPC Flow Logs record a sample of network flows that are sent from and received by VM instances, including those used as Google Kubernetes Engine (GKE) nodes. The sample is typically 50% or less of the VPC network flows. When you enable VPC Flow Logs, you enable logging for all VMs in a subnet. However, you can reduce the amount of information written to logging. Enable VPC Flow Logs for each VPC subnet. You can configure logging using a pipeline that you use to create a project.
Applicable products	Virtual Private Cloud
Related NIST-800-53 controls	AU-2 AU-3 AU-8 AU-9
Related CRI profile controls	DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4
Related information	Log sampling and aggregation

Enable Firewall Rules Logging

Google control ID	COM-CO-7.5
Category	Required
Description	Firewall Rules Logging creates a record each time that a firewall rule allows or denies traffic. Enable logging for each firewall rule. You can configure logging using a pipeline that you use to create a firewall.
Applicable products	Virtual Private Cloud
Related NIST-800-53 controls	AU-2 AU-3 AU-8 AU-9
Related CRI profile controls	DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4
Related information	Use Firewall Rules Logging

Recommended cloud controls

We recommend that you apply the following common controls to your Google Cloud environment, regardless of your specific use case.

Restrict customer-managed encryption keys location

Google control ID	COM-CO-2.2
Category	Recommended
Description	Use the Restrict which projects may supply KMS CryptoKeys for CMEK (`gcp.restrictCmekCryptoKeyProjects`) organization policy constraint to define which projects can store customer-managed encryption keys (CMEKs). This constraint lets you to centralize the governance and management of encryption keys. When a selected key doesn't meet this constraint, resource creation fails. To modify this constraint, administrators need the Organization Policy Administrator (`roles/orgpolicy.policyAdmin`) IAM role. If you want to add a second layer of protection, such as bring your own key, change this constraint to represent the key names of the CMEK that is enabled. Product specifics: In Vertex AI, you store your keys in the KEY PROJECTS project.
Applicable products	Cloud KMS Organization Policy
Path	`constraints/gcp.restrictCmekCryptoKeyProjects`
Operator	`notexists`
Value	`KEY PROJECTS`
Type	String
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Require CMEK protection

Use CMEKs for Google Cloud services

Google control ID	COM-CO-2.3
Category	Recommended
Description	If you require more control over key operations than what Google-owned and Google-managed encryption keys allow, you can use customer-managed encryption keys (CMEKs). These keys are created and managed using Cloud KMS. Store the keys as software keys, in an HSM cluster, or in an external key management system. Cloud KMS encryption and decryption rates are subject to quotas. Cloud Storage specifics In Cloud Storage, use CMEKs on individual objects, or configure your Cloud Storage buckets to use a CMEK by default on all new objects added to a bucket. When using a CMEK, an object is encrypted with the key by Cloud Storage at the time it's stored in a bucket, and the object is automatically decrypted by Cloud Storage when the object is served to requesters. The following restrictions apply when using CMEKs with Cloud Storage: You can't encrypt an object with a CMEK by updating the object's metadata. Include the key as part of a rewrite of the object instead. Your Cloud Storage uses the objects update command to set encryption keys on objects, but the command rewrites the object as part of the request. You must create the Cloud KMS key ring in the same location as the data you intend to encrypt. For example, if your bucket is located in `us-east1`, any key ring used for encrypting objects in that bucket must also be created in `us-east1`. For most dual-regions, you must create the Cloud KMS key ring in the associated multi-region. For example, if your bucket is located in the pair `us-east1`, `us-west1`, any key ring used for encrypting objects in that bucket must be created in the US multi-region. For the `asia1`, `eur4`, and `nam4` predefined dual-regions, you must create the key ring in the same predefined dual-region. The CRC32C checksum and MD5 hash of objects encrypted with CMEKs aren't returned when listing objects with the JSON API. Using tools like Cloud Storage to perform additional metadata `GET` requests on each encryption object to retrieve the CRC32C and MD5 information can make listing substantially shorter. Cloud Storage can't use the decryption portion of asymmetric keys stored in Cloud KMS to automatically decrypt relevant objects in the same manner that CMEKs do.
Applicable products	Cloud KMS Organization Policy Cloud Storage
Path	`constraints/gcp.restrictNonCmekServices`
Operator	`==`
Value	`bigquery.googleapis.com` `storage.googleapis.com` `aiplatform.googleapis.com`
Type	String
Related NIST-800-53 controls	SC-12 SC-13
Related CRI profile controls	PR.DS-1.1 PR.DS-1.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1
Related information	Cloud KMS locations Cloud KMS quotas Customer-managed encryption keys

Enable Sensitive Data Protection for data inspection

Google control ID	COM-CO-5.1
Category	Recommended
Description	Google Cloud recommends using Sensitive Data Protection. The infoTypes or job templates that you select depend on your particular systems.
Applicable products	Sensitive Data Protection
Related NIST-800-53 controls	SI-4 IA-7 SC-7 SC-8
Related CRI profile controls	PR.AC-1.1 PR.AC-1.2 PR.AC-1.3 PR.DS-5.1 PR.DS-8.1 ID.RA-1.1 DE.CM-1.1 DE.CM-1.2 DE.CM-1.3 DE.CM-1.4 DE.CM-5.1 DE.CM-6.1 DE.CM-6.2 DE.CM-6.3 DE.CM-7.1 DE.CM-7.2 DE.CM-7.3 DE.CM-7.4 DE.DP-2.1 DE.DP-3.1 DE.DP-4.1 DE.DP-4.2 DE.DP-5.1 DE.AE-2.1 DE.AE-3.1 DE.AE-3.2 DE.AE-4.1
Related information	Templates InfoTypes and infoType detectors

Recommended controls based on generative AI use case

If you handle sensitive data or sensitive generative AI workloads, we recommend that you implement the following controls in your applicable generative AI use cases.

Enable Data Access audit logs

Google control ID	COM-CO-7.2
Category	Recommended for certain use cases
Description	To track who accessed data in your Google Cloud environment, enable Data Access audit logs. These logs record API calls that read, create, or modify user data, as well as API calls that read resource configurations. We highly recommend enabling Data Access audit logs for generative AI models and sensitive data to ensure you can audit who has read the information. To use Data Access audit logs, you must set up your own custom detection logic for specific activities, like super admin logins. Data Access audit logs volume can be large. Enabling Data Access logs might result in your Google Cloud project being charged for the additional logs usage.
Applicable products	Cloud Audit Logs
Related NIST-800-53 controls	AU-2 AU-3 AU-8 AU-9
Related CRI profile controls	DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4
Related information	Enable Data Access audit logs

Recommended controls for your workload folders

We recommend that you implement the following security controls in folders that contain generative AI workloads.

Enable the service scope restriction in Access Context Manager access policies

Google control ID	COM-CO-8.1
Category	Recommended for generative AI on use cases
Description	For every service perimeter, confirm in the Google Cloud console that the perimeter type is set to regular.
Applicable products	Access Context Manager VPC Service Controls
Path	`accesscontextmanager.accessPolicies.servicePerimeters/perimeterType`
Operator	`==`
Value	`PERIMETER_TYPE_REGULAR`
Type	String
Related NIST-800-53 controls	SC-7 SC-8
Related CRI profile controls	PR.AC-5.1 PR.AC-5.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1 PR.PT-4.1 DE.CM-1.1 DE.CM-1.2 DE.CM-1.3 DE.CM-1.4
Related information	Access Context Manager overview

Restrict APIs within VPC Service Controls service perimeters

Google control ID	COM-CO-8.2
Category	Recommended for generative AI on use cases
Description	For every service perimeter, use Access Context Manager to confirm that the perimeter is protecting the API.
Applicable products	VPC Service Controls Access Context Manager
Path	`accesscontextmanager.accessPolicies.servicePerimeters/status.restrictedServices`
Operator	`Anyof`
Value	`aiplatform.googleapis.com` `artifactregistry.googleapis.com` `bigquery.googleapis.com` `cloudasset.googleapis.com` `cloudbuild.googleapis.com` `cloudfunctions.googleapis.com` `cloudresourcemanager.googleapis.com` `containeranalysis.googleapis.com` `discoveryengine.googleapis.com` `dns.googleapis.com` `notebooks.googleapis.com` `ondemandscanning.googleapis.com` `orgpolicy.googleapis.com` `pubsub.googleapis.com` `secretmanager.googleapis.com` `storage.googleapis.com` `visionai.googleapis.com`
Type	String
Related NIST-800-53 controls	SC-7 SC-8
Related CRI profile controls	PR.AC-5.1 PR.AC-5.2 PR.DS-2.1 PR.DS-2.2 PR.DS-5.1 PR.PT-4.1 DE.CM-1.1 DE.CM-1.2 DE.CM-1.3 DE.CM-1.4
Related information	gcloud access-context-manager perimeters update

Optional common controls

You can optionally implement the following common controls based on your organization's requirements.

Enable Access Transparency logs

Google control ID	COM-CO-7.7
Category	Optional
Description	Access Transparency provides logs that capture the actions that Google personnel take when accessing your content. You can enable Access Transparency at the organization level.
Applicable products	Access Transparency
Related NIST-800-53 controls	AU-2 AU-3 AU-8 AU-9
Related CRI profile controls	DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4
Related information	Enabling Access Transparency

What's next

Review Vertex AI controls.
See more Google Cloud security best practices and guidelines for generative AI workloads.