[ PLATFORM // GOOGLE_CLOUD ]
Security for GCP.
Org hierarchy first.
Folder and project-level posture from IAM, VPC SC, Security Command Center, and asset inventory — one graph for toxic combinations.
200+
Projects
Unified
SCC findings
Tracked
Org policies
- org-prod
- folder-app
- prj-checkout
- prj-data
SCC HIGH · public bucket gcs://checkout-logs
What we assess
in Google Cloud.
Platform-native domains — not a generic cloud checklist pasted from another provider.
IAM & admin
Primitive roles, service account keys, domain-wide delegation.
VPC & firewall
Open 0.0.0.0 rules, legacy networks, private Google access.
GCS
Public buckets, uniform access, CMEK usage.
GKE
Workload identity, pod security, exposed services.
SCC
High/Critical findings with mute reason audit.
Logging
Admin activity, data access, sink coverage.
Org policies
Constraints on external IPs, OS Login, key creation.
Secrets
Secret Manager versioning and IAM bindings.
Onboarding preview
from checklist.
Steps align with NNSEC_Onboarding_Checklist — full runbook generates after discovery wizard.
- 01
Org discovery
Read-only SA at org or folder with Security Reviewer roles.
- 02
Asset export
Cloud Asset Inventory feed enabled.
- 03
SCC link
Findings stream into NorthSec AI normalizer.
- 04
Scope projects
Labels define prod boundary.
- 05
Risk scoring
Category scores align to monthly report template.
- 06
Board pack
Quarterly deck includes GCP-specific heatmaps.
Tools we deploy
and integrate.
Open-source and native cloud APIs — no proprietary agent required unless noted for on-prem.
Connector · Organization-level service account with custom role — no project Editor grants.
Framework mapping
for Google Cloud.
Evidence exports attach findings to auditor-friendly control IDs.
CIS GCP
CIS · SOC 2
HIPAA BAA
Healthcare workloads
PCI SAQ-A
Cardholder env boundaries
[ TIERS ]
Connector included by tier
| foundation · $3,500 | ☑ |
| growth · $5,000 | ☑ |
| scale · $8,000 | ☑ |
| enterprise · $12,000 | ☑ |
Customer story
0 public GCS buckets
AI startup remediated 19 exposed buckets found on day-7 scan.
AI / ML
FAQ
Org-level SA preferred for multi-project; single-project uses folder scope.
Connect Google Cloud to NorthSec AI
Full coverage · read-only · per-tenant KMS