---
names: 
  full: "Google GCE Instance Confidential Compute is not enabled"
  contextual: "Instance Confidential Compute is not enabled"
description: "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted \ 
 for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while \ 
 it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere \ 
 outside the central processing unit (CPU).
 Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer \ 
 data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are \ 
 generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both \ 
 performance and security, there is no significant performance penalty to Confidential Computing workloads."
type: COMPLIANCE_POLICY
categories:
  - "SECURITY"
frameworkMappings:
  - /frameworks/cis-gcp-v3.0.0/04/11
  - /frameworks/cloudaware/resource-security/data-encryption
similarPolicies:
  cloudConformity:
    - url: "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/gcp/ComputeEngine/confidential-computing.html"
      name: "Enable Confidential Computing for Virtual Machine Instances"
