Monitoring, logging, and alerting guidelines

The following guidelines for the minimum viable security platform align with the monitoring, logging, and alerting pillar.

Basic level guidelines

Implement the following monitoring, logging, and alerting guidelines first.

Item	Subscribe to security bulletins
Description	Subscribe to the security bulletin notifications for Google Cloud products so that you are notified of vulnerabilities and mitigation measures.
Related information	Security Bulletins
Item ID	MVSP-CO-1.54
Mapping	Related NIST-800-53 controls: SI-5 Related CRI profile controls: PR.IP-1.4

Item	Configure Essential Contacts groups
Description	Configure Essential Contacts to ensure that a monitored group alias or mailing list receive important notifications. Google sends critical security alerts (like a potential account compromise) to the email addresses listed as Essential Contacts. If an individual's email is used for this purpose, the alert is missed if that person is unavailable or has left the company. Using a monitored group email address helps ensure these time-sensitive alerts are delivered to an active team that can respond quickly.
Related information	Essential Contacts overview
Item ID	MSVP-CO-1-55
Mapping	Related NIST-800-53 controls: IR-4 Related CRI profile controls: PR.IP-1.4 Compliance Manager control: Define Essential Contacts

Item	Monitor billing anomalies
Description	Use the billing anomaly feature in Cloud Billing to track any spikes or deviations in expected spend. A sudden, unexpected spike in a cloud bill is a primary indicator of a security compromise. Unexpected billing spikes are sometimes caused by attackers who have gained access and are using resources for unauthorized activities. Enabling billing anomaly detection provides an essential early warning system so that you can automatically flag this suspicious activity.
Related information	View and manage cost anomalies Set up programmatic notifications
Item ID	MSVP-CO-1-56
Mapping	Related NIST-800-53 controls: AU-6 Related CRI profile controls: DE.AE-1.1

After you implemented the basic guidelines, implement the following monitoring, logging, and alerting guidelines.

Item	Enable Firewall Rules Logging
Description	By default, firewall rules don't automatically write logs.Firewall Rules Logging lets you audit, verify, and analyze the effects of your firewall rules. For example, you can determine if a firewall rule designed to deny traffic is functioning as intended. Logging is also useful if you want to determine how many connections are affected by a given firewall rule. Enable logging for each firewall rule. You can configure logging using a pipeline that you use to create a firewall.
Related information	Use Firewall Rules Logging
Item ID	MSVP-CO-1-58
Mapping	Related NIST-800-53 controls: AU-2 AU-3 AU-8 AU-9 Related CRI profile controls: DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4 Compliance Manager control: Enable Firewall Rule Logging

Item	Share audit logs from Cloud Identity
Description	If using Cloud Identity, share audit logs from Cloud Identity to Google Cloud. Admin Activity audit logs from Google Workspace or Cloud Identity are ordinarily managed and viewed in the Google Admin console, separately from your logs in your Google Cloud environment. These logs contain information that is relevant for your Google Cloud environment, such as user login events. We recommend that you share Cloud Identity audit logs to your Google Cloud environment to centrally manage logs from all sources.
Related information	Audit logs for Google Workspace Share data with Google Cloud services
Item ID	MSVP-CO-1-59
Mapping	Related NIST-800-53 controls: AC-2 AC-3 AC-8 AC-9 Related CRI profile controls: DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 Compliance Manager control: Import Google Workspace Audit Logs

After you implemented the intermediate guidelines, implement the following monitoring, logging, and alerting guidelines.

Item	Enable Access Transparency logs
Description	Standard logs show you what your organization's own users are doing, but Access Transparency logs show what Google support staff do when they access the account. This access typically only happens in response to a support request. Access Transparency logs provide a complete and verifiable audit trail of all access, which is essential for meeting strict compliance and data governance requirements. You can enable Access Transparency at the organization level.
Related information	Enabling Access Transparency
Item ID	MSVP-CO-1-57
Mapping	Related NIST-800-53 controls: AU-2 AU-3 AU-8 AU-9 Related CRI profile controls: DM.ED-7.1 DM.ED-7.2 DM.ED-7.3 DM.ED-7.4 PR.IP-1.4 Compliance Manager control: Enable Access Transparency

Item	Export logs to a log sink for long-term storage
Description	Create a log sink to export logs for your security monitoring solution and set the retention period to meet your requirements. The default log retention periods are often not long enough to meet the 1-7 year requirements mandated by compliance regulations like PCI or HIPAA. Creating a log sink to export logs to a long-term storage location is essential for meeting certain legal and regulatory obligations. Log sinks also let you send logs to a centralized security monitoring system for advanced threat detection.
Related information	Route log entries
Item ID	MSVP-CO-1-60
Mapping	Related NIST-800-53 controls: AU-9 Related CRI profile controls: PR.DS-4.1 Compliance Manager control: Configure Log Sinks