Google Cloud Security Assessment
195 questions across 12 pillars of a Google Cloud estate, scored per control, evidence read-only.
195 controls · 12 pillars · 39 categories · evidence can be collected automatically
195 questions across 12 pillars of a Google Cloud estate, scored per control, evidence read-only.
195 controls · 12 pillars · 39 categories · evidence can be collected automatically
Most cloud incidents trace back to a configuration decision nobody owned. This assessment gives you an independent, scored account of how your cloud estate is actually configured, in language a board and an auditor can both read. It is the written evidence you need when NIS2, DORA or ISO 27001 asks who holds administrative access and how that is proved.
195 questions across 12 pillars and 39 categories, worked through with the owners of identity, networking, data and the build pipeline. Nothing is installed: the collector is read-only and runs against a role you grant and can revoke, so there is no change window and no agent on anything. The output is a score per pillar and category, which sits comfortably ahead of an ISO 27001 surveillance visit or an annual board assurance review.
The assessment walks the resource hierarchy and organisation policy constraints, IAM role scope and service account key lifecycle, Cloud Audit Logs coverage and routing, Security Command Center finding handling, VPC firewall and hierarchical policy, Cloud KMS and Secret Manager practice, Compute Engine, GKE and Cloud Run hardening, Cloud Armor and Identity-Aware Proxy at the edge, and Binary Authorization on the deployment path. A read-only collector reads what it is permitted to read, and every finding arrives as a suggestion the assessor accepts or overrides. Anything it could not read is recorded as unread, never scored as a failure.
195 controls across 12 pillars and 39 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
A read-only collector script reads Google Cloud configuration using permissions you grant and can withdraw, and every finding becomes a suggestion an assessor accepts or overrides before it is scored. Anything the collector could not read is marked unread rather than counted as a failure.
It reads configuration, not intent: it cannot tell you whether a permissive firewall rule is an oversight or a documented exception, which is what the interview is there to establish.
Defence and critical infrastructure suppliers have to show the boundary between workloads of different sensitivity is set by organisation policy rather than left to individual project owners.
Public sector cloud spending carries a duty to show that privileged access is granted for a bounded period and that audit logs survive longer than the platform default.
Financial services tenants are expected to prove that encryption keys, their separation and their residency are under their own control and not inherited defaults.
Health and education estates keep patient and student records in managed storage and analytics services, and 20 scored questions go to exactly that exposure.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 195 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.