Security Command Center는 다양한 보안 표준의 제어에 매핑된 감지기를 통해 사용자의 규정 준수를 모니터링합니다.
Security Command Center는 지원되는 각 보안 표준에 대해 제어 하위 집합을 확인합니다. 선택된 제어의 경우 Security Command Center에 통과하는 제어 수가 표시됩니다. 통과하지 못한 제어의 경우 Security Command Center에 제어 실패를 설명하는 발견 사항 목록이 표시됩니다.
CIS는 CIS Google Cloud Foundations 벤치마크의 각 지원 버전에 대한 Security Command Center 감지기 매핑을 검토하고 인증합니다.
추가 규정 준수 매핑은 참조 목적으로만 포함되었습니다.
Security Command Center는 정기적으로 새로운 벤치마크 버전 및 표준에 대한 지원을 추가합니다. 이전 버전이 계속 지원되지만 결국은 지원이 중단됩니다. 사용 가능한 지원되는 최신 벤치마크 또는 표준을 사용하는 것이 좋습니다.
보안 상황 서비스를 사용하면 조직 정책 및 Security Health Analytics 감지기를 비즈니스에 적용되는 표준 및 제어에 매핑할 수 있습니다. 보안 상황을 만든 후 비즈니스 규정 준수에 영향을 미칠 수 있는 환경 변경사항을 모니터링할 수 있습니다.
Security Health Analytics 및 Web Security Scanner와 같은 Security Command Center 감지 서비스는 감지 모듈(감지기)을 사용하여 클라우드 환경의 취약점 및 잘못된 구성을 확인합니다.
취약점이 발견되면 감지기가 발견 사항을 생성합니다. 발견 사항은 취약점 또는 기타 보안 문제에 대한 기록으로 다음과 같은 정보가 포함됩니다.
취약점에 대한 설명
제어가 규정을 준수하도록 하는 취약점 해결을 위한 권장사항
발견 사항에 해당하는 제어의 숫자 ID
취약점 해결을 위한 권장 단계
표준의 모든 제어가 Security Command Center 발견 사항에 매핑될 수 있는 것은 아닙니다. 일반적으로 특정 제어를 자동화할 수 없기 때문이지만 다른 이유로 인해서도 발생할 수 있습니다. 따라서 Security Command Center에서 확인하는 총 제어 수는 일반적으로 표준에서 정의하는 총 제어 수보다 적습니다.
CIS는 CIS Google Cloud Foundations 벤치마크의 각 지원 버전에 대한 Security Command Center 감지기 매핑을 검토하고 인증합니다.
추가 규정 준수 매핑은 참조 목적으로만 포함되었습니다.
Security Health Analytics 및 Web Security Scanner 발견 사항 및 지원되는 감지기와 규정 준수 표준 간의 매핑에 대한 자세한 내용은 취약점 발견 사항을 참조하세요.
클라우드 환경 전반의 규정 준수 평가
다음 위치에서 클라우드 환경이 특정 보안 표준을 준수하는 정도를 한눈에 확인할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-06-17(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nYou can use Security Command Center to evaluate your Google Cloud environment against\nvarious regulatory frameworks.\n| **Note:** This document applies to compliance management if you haven't enable Compliance Manager ([Preview](/products#product-launch-stages)). For information about compliance with Compliance Manager, see [Compliance Manager\n| overview](/security-command-center/docs/compliance-manager-overview).\n\n\nSecurity Command Center monitors\nyour compliance with detectors that are mapped to the controls of a wide variety of security\nstandards.\n\nFor each supported security standard,\nSecurity Command Center checks a\nsubset of the controls. For the controls checked, Security Command Center shows you how many are\npassing. For the controls that are not passing, Security Command Center shows you a list of findings\nthat describe the control failures.\n\n\nCIS reviews and certifies the mappings of\nSecurity Command Center\ndetectors to each supported version of the CIS Google Cloud Foundations Benchmark.\nAdditional compliance mappings are included for reference purposes only.\n\n\nSecurity Command Center\nadds support for new benchmark versions and standards periodically. Older versions remain\nsupported, but are eventually deprecated. We recommend that you use the latest supported benchmark\nor standard available.\n\n\nWith the\n[security posture service](/security-command-center/docs/security-posture-overview),\nyou can map organization policies and Security Health Analytics detectors to the standards and controls\nthat apply to your business. After you create a security posture, you can monitor for any changes\nto the environment that could affect your business's compliance.\n\n\nWith [Compliance Manager](/security-command-center/docs/compliance-manager-overview)\n([Preview](/products#product-launch-stages)), you can deploy frameworks that map regulatory controls to cloud\ncontrols. After you create a framework, you can monitor for any changes to the environment that\nmight affect your business's compliance and audit your environment.\n\nSupported security standards **Note:** These standards are supported if you have't enabled Compliance Manager ([Preview](/products#product-launch-stages)). For information about the frameworks that you can use with Compliance Manager, see the [Compliance Manager overview](/security-command-center/docs/compliance-manager-overvew#built-in-frameworks).\n\nGoogle Cloud\n\n\nSecurity Command Center\nmaps detectors for Google Cloud to one or more of the following compliance\nstandards:\n\n- [Center for Information Security (CIS) Controls 8.0](https://www.cisecurity.org/controls/v8)\n- [CIS Google Cloud Computing Foundations Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform) v2.0.0, v1.3.0, v1.2.0, v1.1.0, and v1.0.0\n- [CIS Kubernetes Benchmark v1.5.1](https://www.cisecurity.org/benchmark/kubernetes)\n- [Cloud Controls Matrix (CCM) 4](https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4)\n- [Health Insurance Portability and Accountability Act (HIPAA)](https://www.hhs.gov/hipaa/for-professionals/security/index.html)\n- [International Organization for Standardization (ISO) 27001, 2022 and 2013](https://www.iso.org/standard/27001)\n- [National Institute of Standards and Technology (NIST) 800-53 R5 and R4](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/)\n- [National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 1.0](https://www.nist.gov/cyberframework/framework-version-10)\n- [Open Web Application Security Project (OWASP) Top Ten, 2021 and 2017](https://owasp.org/www-project-top-ten/)\n- [Payment Card Industry Data Security Standard (PCI DSS) 4.0 and 3.2.1](https://www.pcisecuritystandards.org/document_library/)\n- System and Organization Controls (SOC) 2 [2017 Trust Services Criteria (TSC)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)\n\nAWS\n| **Enterprise tier only:** This feature is available only with the\n| [Security Command Center Enterprise tier](/security-command-center/docs/service-tiers).\n\nSecurity Command Center\nmaps detectors for Amazon Web Services (AWS) to one or more of the following compliance\nstandards:\n\n- [CIS Amazon Web Services Foundations](https://www.cisecurity.org/benchmark/amazon_web_services) 2.0.0\n- [CIS Critical Security Controls Version 8.0](https://www.cisecurity.org/controls/v8)\n- [Cloud Controls Matrix (CCM) 4](https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4)\n- [Health Insurance Portability and Accountability Act (HIPAA)](https://www.hhs.gov/hipaa/for-professionals/security/index.html)\n- [International Organization for Standardization (ISO) 27001, 2022](https://www.iso.org/standard/27001)\n- [National\n Institute of Standards and Technology (NIST) 800-53 R5](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/)\n- National Institute of Standards and Technology (NIST) [Cybersecurity Framework (CSF) 1.0](https://www.nist.gov/cyberframework/framework-version-10)\n- [Payment Card Industry Data Security Standard (PCI DSS) 4.0 and 3.2.1](https://www.pcisecuritystandards.org/document_library/)\n- System and Organization Controls (SOC) 2 [2017 Trusted Services Criteria (TSC)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)\n\nDetectors and findings as compliance controls\n\nSecurity Command Center detection services, like Security Health Analytics and\nWeb Security Scanner, use detection modules (detectors) to check for\nvulnerabilities and misconfigurations in your cloud environment.\n\nWhen a vulnerability is found, the detector generates a *finding*. A finding is\na record of a vulnerability or other security issue that includes information\nsuch as the following:\n\n- A description of the vulnerability\n\n- A recommendation to address the vulnerability that would bring the control\n into compliance\n\n- The numerical ID of the control that corresponds to the finding\n\n- Recommended steps for remediating the vulnerability\n\nNot all controls in a standard can be mapped to Security Command Center findings,\nusually because certain controls can't be automated, but possibly for other\nreasons. Consequently, the total number of controls that Security Command Center\nchecks for is usually less than the total number of controls that a standard\ndefines.\n\nCIS reviews and certifies the mappings of Security Command Center detectors to each\nsupported version of the CIS Google Cloud Foundations Benchmark.\nAdditional compliance mappings are included for reference purposes only.\n\nTo learn more about Security Health Analytics and Web Security Scanner findings and\nthe mapping between supported detectors and compliance standards, see\n[vulnerabilities findings](/security-command-center/docs/concepts-vulnerabilities-findings).\n\nEvaluate compliance across your cloud environment\n\nYou can see at a glance how compliant your cloud environment is with a given\nsecurity standard in the following places:\n\n- The [**Compliance**](https://console.cloud.google.com/security/command-center/compliance) page in the Google Cloud console.\n- The **Risk \\\u003e Overview** page in the Security Operations console. This page shows an at-a-glance view of the top risks found in your cloud environments, including compliance.\n\nEach security standard shows a percentage of how many of their constituent\ncontrols receive a passing grade at the selected scope, whether that is at the\norganization, folder, or project level.\n\nWhere Security Command Center has been activated affects what is shown:\n\n- **At the project level** : You can only view the activated project's compliance\n statistics. If you switch to a folder or organization that the project belongs\n to in the Google Cloud console, the **Compliance** page does not display.\n\n- **At the organization level** : If you switch to the activated organization in\n the Google Cloud console, the **Compliance** page shows compliance\n statistics for the entire organization, including its folders and projects.\n\n To view compliance statistics for individual folders and projects within that\n organization, switch to that resource level in the Google Cloud console.\n\nCompliance reports are generated daily. Reports can be 24 hours stale, and might\nbe missing if they've failed to generate.\n| **Note:** Security Command Center vulnerability detection services, such as Security Health Analytics and Web Security Scanner, monitor controls based on a best effort mapping between the detectors of the services and the controls of a standard.\n\nAssess compliance in Google Cloud console\n\n1. Go to the **Compliance** page in the Google Cloud console.\n\n\n [Go to Compliance](https://console.cloud.google.com/security/command-center/compliance)\n\n \u003cbr /\u003e\n\n2. Select the project, folder, or organization you want to view compliance for.\n\n3. Click **View details** in one of the standards cards to open its\n **Compliance detail** page.\n\nFrom this page, you can do the following things:\n\n- View compliance against the selected standard on a particular date.\n\n- Switch the compliance standard that you're viewing the details for.\n\n- Export a report of the compliance details to a CSV file.\n\n- Track compliance progress over time with a trend chart.\n\n- Expand security standard controls to view their constituent rules and\n rule severity.\n\n- Click rules to view findings for non-compliant resources and remediate issues\n where appropriate. For information on remediating findings, see\n [Remediating Security Health Analytics findings](/security-command-center/docs/how-to-remediate-security-health-analytics-findings)\n and\n [Remediating Web Security Scanner findings](/security-command-center/docs/how-to-remediate-web-security-scanner-findings)."]]
