[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis page describes the data and infrastructure security that apply to\nSecurity Command Center.\n\nData processing\n\nWhen you enroll in Security Command Center, Google Cloud processes information\nrelated to the Google Cloud services you use, including the following:\n\n- The configuration and metadata associated with your Google Cloud resources\n- The configuration and metadata for your Identity and Access Management (IAM) policies and users\n- Google Cloud-level API access patterns and usage\n- Cloud Logging contents for your Google Cloud organization\n- Security Command Center metadata, including service settings and security findings\n\nSecurity Command Center processes data related to your cloud logs and assets that you\nconfigure to be scanned or monitored, including telemetry and other data\ntherein, to provide findings and improve the service. As such, the scanning and\nmonitoring reports are processed as Service Data by Google pursuant to the terms\nof the [Google Cloud Privacy Notice](/terms/cloud-privacy-notice).\n\nIn order to protect your assets against new and evolving threats,\nSecurity Command Center analyzes data related to misconfigured assets, indicators of\ncompromise in logs, and attack vectors. This activity may include processing\nto improve service models, recommendations for hardening customer environments,\nthe effectiveness and quality of services, and user experience. If you prefer to\nuse the service without your data being processed for purposes of improving the\nservice, you can contact [Google Cloud Support](/support) to opt out.\nCertain features that depend on security telemetry might not be available to you\nif you opt out. Examples of these are customized detections tailored to your\nenvironment, and service improvements that incorporate your service\nconfigurations.\n\nData is encrypted at rest and in transit between internal systems. Additionally,\nSecurity Command Center's data access controls are\n[compliant](/security/compliance/hipaa-compliance) with the Health Insurance\nPortability and Accountability Act (HIPAA) and other Google Cloud\n[compliance offerings](/security/compliance/offerings).\n\nLimiting sensitive data\n\nAdministrators and other privileged users in your organization must exercise\nappropriate care when adding data to Security Command Center.\n\nSecurity Command Center lets privileged users add descriptive information to\nGoogle Cloud resources and the findings generated by scans. In some cases,\nusers may unknowingly relay sensitive data when using the product, for example,\nadding customer names or account numbers to findings. To protect your data, we\nrecommended that you avoid adding sensitive information when naming or\nannotating assets.\n\nAs an additional safeguard, Security Command Center can be integrated with\n[Sensitive Data Protection](/sensitive-data-protection/docs/sending-results-to-scc). Sensitive Data Protection discovers,\nclassifies, and masks sensitive data and personal information, such as credit\ncard numbers, Social Security numbers, and Google Cloud credentials.\n\nDepending on the quantity of information, Sensitive Data Protection costs can be\nsignificant. Follow best practices for [keeping Sensitive Data Protection costs under\ncontrol](/sensitive-data-protection/docs/best-practices-costs).\n\nFor guidance on setting up Security Command Center, including managing resources, see\n[Optimizing Security Command Center](/security-command-center/docs/optimize-security-command-center).\n\nData retention for findings\n\n\nData that Security Command Center processes is captured and stored in *findings* that\nidentify threats, vulnerabilities, and misconfigurations in the resources and assets\nwithin your organization, folders, and projects. Findings contain a series of daily snapshots\nthat capture the state and properties of a finding each day.\n\n\nThe following table shows the retention periods for findings in Security Command Center.\n| **Note:**\n|\n| - The retention periods for findings in Security Command Center are subject to change.\n| - Data retention differs by finding class and state. For example, for a vulnerability, if the underlying issue has been resolved or if the affected resource has been deleted, the data retention policy is limited to 7 days. Whereas if the vulnerability is still active, the data retention policy is longer.\n| - Retention periods are based on the creation times of the findings.\n\n| **Finding** | **Retention period** |\n|------------------------------------|------------------------------------------------------------------------------------------------------------------|\n| Inactive vulnerability | 7 days |\n| Inactive misconfiguration | 30 days |\n| Everything active (except threats) | Deleted after the following amount of time has passed: - 13 months (Enterprise and Premium) - 35 days (Standard) |\n| All other findings | 90 days |\n\n\nA finding persists in Security Command Center as long as it contains at least one snapshot that\nremains within the applicable retention period. To keep findings and all of their data for\nlonger periods, export them to another storage location. To learn more, see\n[Exporting Security Command Center data](/security-command-center/docs/how-to-export-data).\n\nAny third-party finding is\ndeleted after the creation time exceeds the retention period. Findings that are generated in error or without\nany security, risk, or compliance value might be deleted at any time.\n\n\nFor all tiers, an exception to the retention periods applies when an organization\nis deleted from\nGoogle Cloud. When an organization is deleted, all findings derived from the\norganization and its folders and projects are deleted within the retention period\ndocumented in [Data deletion on Google Cloud](/docs/security/deletion).\n\nIf a project is deleted, the findings from the project are not deleted at the same time, but\nare instead retained for the auditability of the organization that contained\nthe deleted project. The retention period depends on the tier that was active in the\ndeleted project: 13 months for the Enterprise and Premium tiers\nor 35 days for the Standard tier.\n\n\nIf you delete a project and need to delete all of the findings for the\nproject at the same time, contact [Cloud Customer Care](/support),\nwho can initiate an early deletion of all findings in\nthe project for you.\n\nData retention for disk clones\n\nVirtual Machine Threat Detection takes short-lived clones of your VM's persistent disk and\nstores them in Google-owned projects, in the same zone for zonal disks or the\nsame region for regional disks. VM Threat Detection scans the disk clones and\ndeletes them within an hour after completing disk scan activities and handling\nerrors, such as timeouts.\n\nInfrastructure security\n\nSecurity Command Center is built on top of the same infrastructure that Google uses for\nits own consumer and enterprise services. The layered security of our\ninfrastructure is designed to protect all services, data, communications,\nand operations in Google Cloud.\n\nTo learn more about Google's infrastructure security, see [Google infrastructure\nsecurity design overview](/docs/security/infrastructure/design).\n\nWhat's next\n\n- To learn about Security Command Center's features and benefits, see\n [Security Command Center overview](/security-command-center/docs/security-command-center-overview).\n\n- Learn more about\n [using Security Command Center](/security-command-center/docs/how-to-use-security-command-center)."]]
