Skip to main content

📝 Google BigQuery Dataset is not encrypted with Customer-Managed Encryption Key (CMEK) 🟢

  • Contextual name: 📝 Dataset is not encrypted with Customer-Managed Encryption Key (CMEK) 🟢
  • ID: /ce/ca/google/big-query/dataset-cmek-encryption
  • Located in: 📁 Google BigQuery

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

BigQuery by default encrypts the data as rest by employing Envelope Encryption using Google managed cryptographic keys. The data is encrypted using the data encryption keys and data encryption keys themselves are further encrypted using key encryption keys. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.

Rationale​

BigQuery by default encrypts the data as rest by employing Envelope Encryption using Google managed cryptographic keys. This is seamless and does not require any additional input from the user.

For greater control over the encryption, customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. Setting a Default Customer-managed encryption key (CMEK) for a data set ensure any tables created in future will use the specified CMEK if none other is provided.

... see more

Remediation​

Open File

Remediation​

From Google Cloud CLI​

The default CMEK for existing data sets can be updated by specifying the default key in the EncryptionConfiguration.kmsKeyName field when calling the datasets.insert or datasets.patch methods

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS GCP v1.2.0 → 💼 7.3 Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets - Level 2 (Automated _ Roadmapped)1
💼 CIS GCP v1.3.0 → 💼 7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets - Level 2 (Manual)1
💼 CIS GCP v2.0.0 → 💼 7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets - Level 2 (Automated)1
💼 CIS GCP v3.0.0 → 💼 7.3 Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets - Level 2 (Automated)1
💼 Cloudaware Framework → 💼 Data Encryption42
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)61432
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1724
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)132
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)124
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)432
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)124
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records1015
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected1528
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization38
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated32
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected114
💼 NIST SP 800-53 Revision 5 → 💼 IA-5 Authenticator Management1816
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31625
💼 PCI DSS v3.2.1 → 💼 3.2 Do not store sensitive authentication data after authorization (even if encrypted).35
💼 PCI DSS v3.2.1 → 💼 3.4 Render PAN unreadable anywhere it is stored.1712
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.712
💼 PCI DSS v3.2.1 → 💼 3.7 Ensure that security policies and operational procedures for protecting stored cardholder data are documented, in use, and known to all affected parties.5
💼 PCI DSS v3.2.1 → 💼 8.2.1 Using strong cryptography, render all authentication credentials unreadable during transmission and storage on all system components.14
💼 PCI DSS v4.0.1 → 💼 3.1.1 All security policies and operational procedures identified in Requirement 3 are documented, kept up to date, in use, and known to all affected parties.5
💼 PCI DSS v4.0.1 → 💼 3.3.1 SAD is not retained after authorization, even if encrypted.35
💼 PCI DSS v4.0.1 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.13
💼 PCI DSS v4.0.1 → 💼 3.3.3 Any storage of sensitive authentication data is limited to that which is needed for a legitimate issuing business need, is secured and encrypted using strong cryptography.5
💼 PCI DSS v4.0.1 → 💼 3.5.1 PAN is rendered unreadable anywhere it is stored.312
💼 PCI DSS v4.0.1 → 💼 3.5.1.2 If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable.5
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.12
💼 PCI DSS v4.0.1 → 💼 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.14
💼 PCI DSS v4.0 → 💼 3.1.1 All security policies and operational procedures identified in Requirement 3 are documented, kept up to date, in use, and known to all affected parties.5
💼 PCI DSS v4.0 → 💼 3.3.1 SAD is not retained after authorization, even if encrypted.35
💼 PCI DSS v4.0 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.813
💼 PCI DSS v4.0 → 💼 3.3.3 Any storage of sensitive authentication data is limited to that which is needed for a legitimate issuing business need, is secured and encrypted using strong cryptography.5
💼 PCI DSS v4.0 → 💼 3.5.1 PAN is rendered unreadable anywhere it is stored.312
💼 PCI DSS v4.0 → 💼 3.5.1.2 If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable.5
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.12
💼 PCI DSS v4.0 → 💼 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.614
💼 SOC 2 → 💼 CC6.1-3 Restricts Logical Access121
💼 SOC 2 → 💼 CC6.1-10 Uses Encryption to Protect Data611