当您注册 Security Command Center 时， Google Cloud 会处理与您所用的 Google Cloud 服务相关的信息，包括：
与您的 Google Cloud资源关联的配置和元数据
Identity and Access Management (IAM) 政策和用户的配置和元数据
Google Cloud级层 API 访问模式和用法
适用于 Google Cloud 组织的 Cloud Logging 内容
Security Command Center 元数据，包括服务设置和安全发现结果
Security Command Center 会处理与您配置来扫描或监控的云日志和资源相关的数据，包括遥测数据和其他数据，以提供发现结果并改进服务。因此，Google 会根据 Google Cloud 隐私权声明的条款将扫描和监控报告作为服务数据进行处理。
为了保护资源免受新威胁和不断演变的威胁的影响，Security Command Center 会分析与配置错误的资源相关的数据、日志中的失陷指标和攻击途径。这些活动可能包括用于改进服务模型的处理、强化客户环境安全的建议、服务的有效性和质量以及用户体验。如果您希望在不处理您的数据以改进服务的情况下使用服务，可以与 Google Cloud 支持团队联系。如果您选择不处理您的数据，则可能无法使用某些依赖于安全遥测的功能。此类示例包括为您的环境量身定制的自定义检测，以及包含您的服务配置的服务改进。
系统会对数据进行静态加密以及对内部系统之间传输的数据进行加密。此外，Security Command Center 的数据访问权限控制符合《健康保险流通与责任法案》(HIPAA) 和其他 Google Cloud
合规性要求。
限制敏感数据
组织中的管理员和其他特权用户在向 Security Command Center 添加数据时必须小心谨慎。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[],[],null,["| Standard, Premium, and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis page describes the data and infrastructure security that apply to\nSecurity Command Center.\n\nData processing\n\nWhen you enroll in Security Command Center, Google Cloud processes information\nrelated to the Google Cloud services you use, including the following:\n\n- The configuration and metadata associated with your Google Cloud resources\n- The configuration and metadata for your Identity and Access Management (IAM) policies and users\n- Google Cloud-level API access patterns and usage\n- Cloud Logging contents for your Google Cloud organization\n- Security Command Center metadata, including service settings and security findings\n\nSecurity Command Center processes data related to your cloud logs and assets that you\nconfigure to be scanned or monitored, including telemetry and other data\ntherein, to provide findings and improve the service. As such, the scanning and\nmonitoring reports are processed as Service Data by Google pursuant to the terms\nof the [Google Cloud Privacy Notice](/terms/cloud-privacy-notice).\n\nIn order to protect your assets against new and evolving threats,\nSecurity Command Center analyzes data related to misconfigured assets, indicators of\ncompromise in logs, and attack vectors. This activity may include processing\nto improve service models, recommendations for hardening customer environments,\nthe effectiveness and quality of services, and user experience. If you prefer to\nuse the service without your data being processed for purposes of improving the\nservice, you can contact [Google Cloud Support](/support) to opt out.\nCertain features that depend on security telemetry might not be available to you\nif you opt out. Examples of these are customized detections tailored to your\nenvironment, and service improvements that incorporate your service\nconfigurations.\n\nData is encrypted at rest and in transit between internal systems. Additionally,\nSecurity Command Center's data access controls are\n[compliant](/security/compliance/hipaa-compliance) with the Health Insurance\nPortability and Accountability Act (HIPAA) and other Google Cloud\n[compliance offerings](/security/compliance/offerings).\n\nLimiting sensitive data\n\nAdministrators and other privileged users in your organization must exercise\nappropriate care when adding data to Security Command Center.\n\nSecurity Command Center lets privileged users add descriptive information to\nGoogle Cloud resources and the findings generated by scans. In some cases,\nusers may unknowingly relay sensitive data when using the product, for example,\nadding customer names or account numbers to findings. To protect your data, we\nrecommended that you avoid adding sensitive information when naming or\nannotating assets.\n\nAs an additional safeguard, Security Command Center can be integrated with\n[Sensitive Data Protection](/sensitive-data-protection/docs/sending-results-to-scc). Sensitive Data Protection discovers,\nclassifies, and masks sensitive data and personal information, such as credit\ncard numbers, Social Security numbers, and Google Cloud credentials.\n\nDepending on the quantity of information, Sensitive Data Protection costs can be\nsignificant. Follow best practices for [keeping Sensitive Data Protection costs under\ncontrol](/sensitive-data-protection/docs/best-practices-costs).\n\nFor guidance on setting up Security Command Center, including managing resources, see\n[Optimizing Security Command Center](/security-command-center/docs/optimize-security-command-center).\n\nData retention for findings\n\n\nData that Security Command Center processes is captured and stored in *findings* that\nidentify threats, vulnerabilities, and misconfigurations in the resources and assets\nwithin your organization, folders, and projects. Findings contain a series of daily snapshots\nthat capture the state and properties of a finding each day.\n\n\nThe following table shows the retention periods for findings in Security Command Center.\n| **Note:**\n|\n| - The retention periods for findings in Security Command Center are subject to change.\n| - Data retention differs by finding class and state. For example, for a vulnerability, if the underlying issue has been resolved or if the affected resource has been deleted, the data retention policy is limited to 7 days. Whereas if the vulnerability is still active, the data retention policy is longer.\n| - Retention periods are based on the creation times of the findings.\n\n| **Finding** | **Retention period** |\n|------------------------------------|------------------------------------------------------------------------------------------------------------------|\n| Inactive vulnerability | 7 days |\n| Inactive misconfiguration | 30 days |\n| Everything active (except threats) | Deleted after the following amount of time has passed: - 13 months (Enterprise and Premium) - 35 days (Standard) |\n| All other findings | 90 days |\n\n\nA finding persists in Security Command Center as long as it contains at least one snapshot that\nremains within the applicable retention period. To keep findings and all of their data for\nlonger periods, export them to another storage location. To learn more, see\n[Exporting Security Command Center data](/security-command-center/docs/how-to-export-data).\n\nAny third-party finding is\ndeleted after the creation time exceeds the retention period. Findings that are generated in error or without\nany security, risk, or compliance value might be deleted at any time.\n\n\nFor all tiers, an exception to the retention periods applies when an organization\nis deleted from\nGoogle Cloud. When an organization is deleted, all findings derived from the\norganization and its folders and projects are deleted within the retention period\ndocumented in [Data deletion on Google Cloud](/docs/security/deletion).\n\nIf a project is deleted, the findings from the project are not deleted at the same time, but\nare instead retained for the auditability of the organization that contained\nthe deleted project. The retention period depends on the tier that was active in the\ndeleted project: 13 months for the Enterprise and Premium tiers\nor 35 days for the Standard tier.\n\n\nIf you delete a project and need to delete all of the findings for the\nproject at the same time, contact [Cloud Customer Care](/support),\nwho can initiate an early deletion of all findings in\nthe project for you.\n\nData retention for disk clones\n\nVirtual Machine Threat Detection takes short-lived clones of your VM's persistent disk and\nstores them in Google-owned projects, in the same zone for zonal disks or the\nsame region for regional disks. VM Threat Detection scans the disk clones and\ndeletes them within an hour after completing disk scan activities and handling\nerrors, such as timeouts.\n\nInfrastructure security\n\nSecurity Command Center is built on top of the same infrastructure that Google uses for\nits own consumer and enterprise services. The layered security of our\ninfrastructure is designed to protect all services, data, communications,\nand operations in Google Cloud.\n\nTo learn more about Google's infrastructure security, see [Google infrastructure\nsecurity design overview](/docs/security/infrastructure/design).\n\nWhat's next\n\n- To learn about Security Command Center's features and benefits, see\n [Security Command Center overview](/security-command-center/docs/security-command-center-overview).\n\n- Learn more about\n [using Security Command Center](/security-command-center/docs/how-to-use-security-command-center)."]]
