Assured Workloads frameworks

This page provides reference content for the built-in frameworks that are included in Assured Workloads and Audit Manager.

Google Recommended AI Essentials - Gemini Enterprise Agent Platform

Supported cloud provider: Google Cloud

This framework outlines Google recommended security best practices for Gemini Enterprise Agent Platform workloads, providing a prescriptive collection of essential preventative and detective policies. When you acctivate AI Protection within the Security Command Center, a detailed security compliance assessment against this framework is automatically displayed on the Agent Platform Security dashboard.

This framework includes the following cloud controls:

CIS GCP Foundations Benchmark v3.0

Supported cloud provider: Google Cloud

Prescriptive guidance for establishing a secure baseline configuration for Google Cloud Platform. This benchmark provides technical best practices for hardening foundational services like IAM, Logging, Networking, and Storage.

This framework includes the following cloud controls:

CIS GKE 1.7

Supported cloud provider: Google Cloud

The CIS GKE Benchmark is a set of security recommendations and best practices specifically tailored for Google Kubernetes Engine (GKE) clusters. The benchmark aims to enhance the security posture of GKE environments.

This framework includes the following cloud controls:

CIS Critical Security Controls v8

Supported cloud provider: Google Cloud

A prioritized set of safeguards to protect against prevalent cyber threats. It offers a practical approach to cyber defense, tiered into Implementation Groups (IG1, IG2, IG3) to suit organizations of varying maturity.

This framework includes the cloud control groups and cloud controls in the following sections.

cis-controls-1-1

Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. For mobile end-user devices, MDM type tools can support this process, where appropriate. This inventory includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud environments. Additionally, it includes assets that are regularly connected to the enterprise’s network infrastructure, even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets bi-annually, or more frequently.

cis-controls-10-2

Configure automatic updates for anti-malware signature files on all enterprise assets.

cis-controls-10-3

Disable autorun and autoplay auto-execute functionality for removable media.

cis-controls-10-6

Centrally manage anti-malware software.