Key Settings One-Pager
The essential goal, the features that carry it, the mistake to avoid, and the proof to keep — for each of the ten Brilliant at the Basics requirements. A quick reference to pin up, not a substitute for the full step-by-step guide. Confirm every setting against Google Cloud’s own documentation.
For CUI, deploy inside Assured Workloads with the correct US government / Impact Level compliance regime.
Phishing-Resistant Multi-Factor Authentication
Make a stolen password useless on its own.
Register a backup security key for every user before you enforce, or a single lost key can lock someone out of the whole account.
Screenshot of 2-Step Verification enforcement setting · List of users with security keys enrolled · Admin console audit log of the policy change
Least-Privilege Access Control
Give each person only the access their job needs — and no more.
Avoid the basic Owner and Editor roles for daily work; they are huge and are the most common cause of over-privileged accounts.
Export of IAM policy bindings per project · IAM Recommender history showing applied changes · Organization policy report on service account key constraints
Asset & Account Inventory
Keep a live list of every device, identity, and app you defend.
The console only shows the RESOURCE view; use the gcloud CLI or an export if you need IAM policy or deeper details for a full audit.
Exported asset list from Asset Inventory · Resource Manager hierarchy diagram or screenshot · List of all user and service accounts
Logging, Monitoring & Audit
Record important events and watch for trouble.
Data Access audit logs are off by default; many teams think everything is logged and only find out otherwise during an incident.
Screenshot of enabled Data Access audit log config · Log Router sink pointing to retained storage · Security Command Center findings report
Network Segmentation & Boundary Protection
Keep one compromised thing from reaching everything else.
Always run a new VPC Service Controls perimeter in dry-run mode first; enforcing it blind can suddenly break legitimate access.
VPC and subnet configuration export · Firewall rule list showing default-deny · VPC Service Controls perimeter configuration
Vulnerability & Patch Management
Find weak spots and fix the risky ones first.
Findings appear only after the OS Config agent is running; a VM without the agent looks 'clean' simply because nothing is checking it.
VM Manager vulnerability report export · Patch deployment job history · Security Command Center findings list with remediation status
Data Protection & Encryption
Scramble sensitive data so only the right people can read it.
Your KMS key ring must be in the same location as the data it protects, or you won't be able to attach it to that resource.
Cloud KMS key ring and key configuration · Resource settings showing CMEK enabled · Key rotation schedule record
Backup & Recovery
Be able to restore your data after an attack or outage.
A backup you have never restored is only a hope; schedule real restore tests so you find problems before a disaster does.
Backup plan and vault configuration · Snapshot schedule showing recent successful backups · Documented restore test results
Secure Configuration Baseline
Start every service from a known-good, hardened setting.
Turn on new org policy constraints in a test folder first; a strict constraint can unexpectedly block legitimate deployments across projects.
Security posture definition and compliance report · Organization policy constraint settings · Security Health Analytics findings showing resolved items
Secure AI Adoption & Data Loss Prevention
Use AI and share files without leaking sensitive information.
De-identify data before it reaches the model, not after; once sensitive text is in a prompt or training set it is very hard to pull back out.
Sensitive Data Protection scan results and de-id templates · VPC Service Controls perimeter covering Vertex AI · Vertex AI audit logs and written AI use policy