GCP Security Best Practices Checklist: 10 Free or Low-Cost Services to Turn On

Google Cloud ships a set of security services that cost nothing or a few dollars a month, and many of them are switched off by default. The best GCP security practice with the highest return is to turn those services on before buying any third-party tool.

7 of the 10 services below are free. The other three cost cents per resource and stay inside free tiers for a small environment. Prices below were checked against Google's pricing pages on November 9, 2026.

Which Google Cloud security services are free or close to free?

The table below lists each Google Cloud security service in this checklist, what the service protects, and the published price. Every price links to the Google page we checked.

Google changes prices and tier contents. Recheck the linked pages before a budget decision.

1. What does Security Command Center Standard give you for free?

Security Command Center (SCC) Standard is Google Cloud's free security dashboard, and the tier is activated once at the organization level. Google's service tiers page lists the Standard tier as offered at no additional charge.

For an organization activating SCC Standard today, the free tier includes:

• ☐ Vulnerability Assessment for Google Cloud: agentless scanning of Compute Engine VMs for critical and high severity software vulnerabilities (limited capabilities in Standard)
• ☐ Compliance Manager, with a limited set of capabilities
• ☐ Sensitive Actions Service: findings when someone takes a high-risk action in the organization
• ☐ Compute Engine security risk dashboard findings
• ☐ Export of findings to BigQuery and Pub/Sub

Security Health Analytics, the misconfiguration detectors many older guides describe as free, changed in the current tier model. Google's page says the detectors are not supported with new Standard tier activations. Organizations migrated from the older Standard-legacy tier keep a subset. Threat detection services (Event Threat Detection, Container Threat Detection, VM Threat Detection) sit in Premium.

Where to turn on SCC Standard: Console, Security, Security Command Center, at the organization level. A project-level activation leaves out organization-wide findings.

Our Security Command Center Standard vs Premium guide covers the tiers, Premium pricing and when Premium is worth paying for.

2. Which Organization Policy constraints should every GCP organization enforce?

Organization Policy sets guardrails that apply to every project under the organization, and Google lists all use of the Organization Policy Service API as free of charge. One policy at the organization level replaces dozens of per-project settings that drift over time.

Google enforces a security baseline on organizations created on or after May 3, 2024. Older organizations need the same constraints set by hand:

• ☐ iam.managed.disableServiceAccountKeyCreation: blocks long-lived service account keys, the credential type that leaks most often into repos and laptops
• ☐ iam.allowedPolicyMemberDomains: limits IAM grants to identities in the company's own Google Workspace or Cloud Identity account
• ☐ storage.uniformBucketLevelAccess: removes per-object ACLs so bucket access is managed only through IAM
• ☐ storage.publicAccessPrevention: stops buckets from being shared to allUsers

Where to check: Console, IAM and Admin, Organization Policies, at the organization node. Run gcloud org-policies list --organization=ORGANIZATION_ID to see which constraints are set.

Our SOC 2 CC6 on GCP guide lists the full Org Policy baseline we use and the gcloud evidence auditors accept for each constraint.

3. How does Cloud Asset Inventory help with Google Cloud security?

Cloud Asset Inventory gives a complete, searchable list of every resource and IAM policy in the organization, with change history. Google states that all use of Cloud Asset Inventory is free of charge. Only the storage for exported data, such as a Cloud Storage bucket or BigQuery table, is billed.

An accurate inventory answers the first question in every security review: what runs in this organization? Cloud Asset Inventory finds the forgotten test project with a public IP, the service account nobody owns, and the bucket created outside Terraform.

• ☐ Run gcloud asset search-all-resources --scope=organizations/ORGANIZATION_ID once a quarter and compare the output to the in-scope system list (our SOC 2 scoping guide covers how to draw that list)
• ☐ Export IAM policies with gcloud asset search-all-iam-policies before each access review

4. Are Google Cloud Admin Activity audit logs on by default?

Admin Activity audit logs are on by default for every Google Cloud project and cannot be turned off. Google's audit logging docs say Admin Activity logs are always written; you can't configure, exclude, or disable them. The logs land in the _Required bucket, which keeps them for 400 days with no retention charge.

Admin Activity logs record configuration changes: a VM created, a firewall rule opened, an IAM role granted. They answer who changed what, and when during an incident or an audit.

• ☐ Confirm nobody routes logs away from the _Required sink
• ☐ Create a log-based alert for IAM policy changes on the organization and on production projects
• ☐ Create an alert for firewall rules that allow 0.0.0.0/0

The free logs cover the record. Detection on top of the record is a separate design question, covered in our security logging and monitoring architecture guide.

5. How does IAM Recommender reduce excess permissions in GCP?

IAM Recommender compares the roles granted to each principal against the permissions that principal used over the last 90 days and suggests smaller roles. Google's Recommender pricing page says Google Cloud generates most recommendations and insights for free to all customers. Firewall Insights is the one premium recommender.

Broad roles such as Owner and Editor tend to pile up on service accounts and former project leads. IAM Recommender gives a list of grants to shrink, with the evidence behind each suggestion. Larger identity redesigns, such as moving to group-based roles or federating a second identity provider, are the kind of work our identity and access management team takes on.

• ☐ Review IAM recommendations on production projects each month
• ☐ Review unattended project recommendations and shut down projects nobody uses
• ☐ Record each accepted or rejected recommendation, which doubles as least privilege evidence (see our CC6.3 least privilege guide)

6. How do you use Identity-Aware Proxy to replace open SSH and RDP ports?

Identity-Aware Proxy (IAP) TCP forwarding lets engineers reach VMs over SSH or RDP through Google's identity check, so VMs need no public IP and no firewall rule open to the internet. Google lists IAP's core features as free. Load balancer charges apply when IAP protects a web application behind an HTTPS load balancer.

Firewall rules that open port 22 or 3389 to the internet come up often in the Google Cloud reviews we run. IAP replaces them with a single firewall rule for Google's IAP range:

• ☐ Create one ingress rule allowing TCP 22 and 3389 from 35.235.240.0/20 (the range Google documents for IAP TCP forwarding)
• ☐ Delete rules that allow 22 or 3389 from 0.0.0.0/0
• ☐ Grant roles/iap.tunnelResourceAccessor only to the engineers who need VM access
• ☐ Remove external IPs from VMs that serve no public traffic

Engineers then connect with gcloud compute ssh VM_NAME --tunnel-through-iap. Every connection is tied to a named identity and written to the audit log. Our boundary protection guide covers the wider network design.

7. Is Binary Authorization free on Cloud Run?

Binary Authorization for Cloud Run is free of charge. Binary Authorization checks each container image at deploy time and blocks images that are unsigned or come from an unapproved registry.

• ☐ Turn on Binary Authorization for Cloud Run services in production
• ☐ Start with a policy that allows only images from the company's own Artifact Registry
• ☐ Add attestations from the CI pipeline once the registry rule is stable (our CI/CD security guide covers signing and pipeline controls)

Binary Authorization for GKE costs $0.01613 per cluster per hour, about $12 per month. Google gives every billing account a $12 monthly credit, which covers one GKE cluster with enforcement.

8. How much does VM Manager cost for patching Compute Engine VMs?

VM Manager handles patch jobs, OS inventory and vulnerability reports for Compute Engine VMs. Google's VM Manager pricing includes 100 VMs per Cloud Billing account per month for free. After the free tier, each VM with an active OS Config agent costs $0.003 per hour, about $2.19 per VM per month. A limited functionality mode is free for any number of VMs, but patch jobs need full VM Manager.

VM Manager answers two audit questions at once: which packages run on each VM, and when each VM was last patched.

• ☐ Turn on VM Manager for projects with Compute Engine VMs
• ☐ Create a patch deployment on a schedule that matches the patching policy, for example weekly for critical updates
• ☐ Use the OS inventory to confirm an endpoint protection agent runs on each server (see our CC6.8 malware prevention guide)

Managed services such as Cloud Run, Cloud SQL and GKE Autopilot need no VM Manager, because Google patches the operating system for them.

9. When should you turn on Data Access audit logs in Google Cloud?

Data Access audit logs record who read or changed data inside a service, and Google turns them off by default for every service except BigQuery because of the volume. Cloud Logging charges $0.50 per GiB after the first 50 GiB per project per month.

Turn on Data Access logs for services that hold regulated or customer data. Turning them on everywhere at once creates a large bill with little added value.

• ☐ List the projects and services that hold customer or regulated data (health records, payment data, personal information)
• ☐ Turn on Data Access logs for those services only, for example Cloud Storage buckets and Cloud SQL instances holding patient data
• ☐ Watch log volume for the first month and add exclusion filters for noisy service accounts

For health-tech companies under HIPAA, Data Access logs on systems that store electronic protected health information give the access record the Security Rule's audit controls standard expects. The GCP audit logs spoke post (coming next in this series) covers scoping and cost in detail.

10. What do Secret Manager, Cloud KMS and Artifact Analysis cost?

Secret Manager, Cloud KMS and Artifact Analysis each cost cents per item, and together they remove three common risks: credentials in code, keys you cannot control, and container images with known vulnerabilities.

Secret Manager stores API keys, database passwords and tokens outside the code base. Pricing:

• 6 active secret versions free per billing account, then about $0.06 per version per month
• 10,000 access operations free per month, then $0.03 per 10,000

Cloud KMS gives customer-managed encryption keys (CMEK) for services that support them. A software key version costs about $0.06 per month. Google already encrypts data at rest with Google-managed keys by default. CMEK adds value when a customer contract or regulator asks for keys you control and can revoke.

Artifact Analysis scans container images in Artifact Registry for known CVEs. Google charges $0.26 per image for the first scan. Later scans of the same image digest are free.

• ☐ Move secrets from environment variables and config files into Secret Manager
• ☐ Turn on the Container Scanning API for production Artifact Registry repositories
• ☐ Use Cloud KMS keys only where a contract or regulation calls for customer-managed keys

Artifact Analysis findings feed a vulnerability management process. Our CC7.1 vulnerability management guide covers remediation timelines and evidence, and the vulnerability risk acceptance guide covers findings a team decides to accept.

What do the free Google Cloud services leave out?

The free and low-cost services in this checklist cover visibility, guardrails and access. Several capabilities still need a paid tier or another tool:

• Threat detection: Event Threat Detection, Container Threat Detection and VM Threat Detection are SCC Premium features
• Misconfiguration scanning for new SCC activations: full Security Health Analytics sits in Premium, or in a third-party CSPM such as Wiz or Datadog Cloud Security
• Log review and alert triage: a person or a SIEM has to read the logs and act on alerts (see our CC7.2 security monitoring guide)
• Endpoint protection on VMs: Google provides no free EDR agent for Compute Engine

A paid tool earns a place after the free services above are on and someone owns the findings.

How does this GCP security checklist map to SOC 2 and ISO 27001?

Each service in this checklist produces evidence for a SOC 2 Common Criteria control and an ISO 27001:2022 Annex A control. The mapping below is a short reference, and the control still needs an owner and a review record. Our SOC 2 Trust Services Criteria guide explains each criterion in full.

Google Cloud's own SOC 2 report covers the data centers and the platform. The services in this checklist sit on the customer side, the complementary user entity controls Google's report expects every customer to run. In the company's own report, Google appears as a subservice organization, explained in our CSOCs and inclusive method guide.

A GRC platform such as Vanta or Drata connects to Google Cloud and collects much of this evidence on a schedule (see how a SOC 2 audit runs on Drata and Vanta). Our compliance-as-code guide covers scripting the evidence a platform misses.

ISO 27001:2022 Annex A mapping

Our ISO 27001 and SOC 2 control mapping guide shows how one set of controls covers both frameworks.

How should you triage Google Cloud security findings?

Triage Google Cloud security findings by exposure first and severity second. A scanner rates each finding on the issue alone, and the real risk depends on what an attacker can reach.

• ☐ An open SSH or RDP firewall rule rates HIGH even with no VMs behind the rule, so delete the rule before an engineer attaches a VM to the network
• ☐ A critical CVE on a VM with no public IP carries less risk than the same CVE on an internet-facing host, so patch internet-facing hosts first
• ☐ A check that failed because an API was disabled or a permission was missing means not assessed, so record the gap and rerun the check

For SOC 2 CC7.1 and ISO 27001 8.8, auditors look for the triage record and the remediation, alongside the scan itself.

How do you check which of these services are on today?

Run a read-only review of the organization before turning anything on. Three gcloud commands give a fast first look:

1. gcloud org-policies list --organization=ORGANIZATION_ID shows which guardrails are set
2. gcloud scc manage services list --organization=ORGANIZATION_ID shows which Security Command Center services are active
3. gcloud compute firewall-rules list --filter="sourceRanges:0.0.0.0/0" lists rules open to the internet

When we run a security architecture review on a client's Google Cloud organization, our discovery script checks every item in this list, flags free services that are switched off, and gives each finding a severity.

Turn on the free GCP security services first

Seven of the ten services in this GCP security best practices checklist cost nothing, and the other three cost cents per VM, secret, key or image. Turning them on gives a security program an inventory, guardrails, an audit trail and a patching record before any money goes to new tools.

If you want a second pair of eyes on your Google Cloud organization, book a call with us. We run a read-only review that shows which of these services are on, which are off, and which findings to fix first, as part of our security architecture and SOC 2 compliance work.

Frequently Asked Questions

Is Google Cloud Security Command Center free?

Yes. The Security Command Center Standard tier is free of charge and is activated at the organization level. For organizations activating Standard today, the free tier includes agentless vulnerability assessment for Compute Engine VMs, a limited Compliance Manager and Sensitive Actions findings. Security Health Analytics misconfiguration detectors and threat detection services need SCC Premium.

Are Google Cloud audit logs free?

Admin Activity audit logs are free, always on, and kept for 400 days in the _Required log bucket with no retention charge. Data Access audit logs are off by default for every service except BigQuery. Cloud Logging includes the first 50 GiB per project per month and then charges $0.50 per GiB.

Which GCP security services should be turned on first?

Start with Security Command Center Standard at the organization level, then Organization Policy guardrails, Cloud Asset Inventory and an alert on Admin Activity audit logs. These four cost nothing and give visibility, guardrails and an audit trail before any paid tool is added.

Does Google Cloud enforce security defaults on new organizations?

Yes. Google enforces a security baseline of Organization Policy constraints on organizations created on or after May 3, 2024. The baseline includes disabling service account key creation, restricting IAM grants to the company's own domain, and uniform bucket-level access. Older organizations need these constraints set by hand.

Do the free Google Cloud security services cover SOC 2?

The free and low-cost Google Cloud services produce evidence for SOC 2 criteria such as CC6.1 logical access, CC6.6 boundary protection, CC7.1 vulnerability management and CC7.2 monitoring. Each SOC 2 control still needs a policy, a named owner and a record of regular review.