Use Data Security Posture Management

This document describes how you can enable and use Data Security Posture Management (DSPM).

Enable DSPM

Complete the following to enable DSPM at the organization level:

  1. To get the permissions that you need to enable DSPM, ask your administrator to grant you the following IAM roles on your organization:

    For more information about granting roles, see Manage access to projects, folders, and organizations.

    You might also be able to get the required permissions through custom roles or other predefined roles.

  2. Enable DSPM using one of the following methods:
  3. Enable discovery of the resources that you want to protect with DSPM.

When you enable DSPM, the following services are also enabled:

  • Compliance Manager to create, apply, and manage data security frameworks and cloud controls.
  • Sensitive Data Protection to use data sensitivity signals for default data risk assessment.
  • Event Threat Detection (part of Security Command Center) at the organization level to use the data access governance cloud control and the data flow governance cloud control
  • AI Protection to help secure the lifecycle of your AI workloads.

The DSPM service agent (service-org-ORGANIZATION_ID@gcp-sa-dspm-hpsa.iam.gserviceaccount.com) is created when you enable DSPM.

For information about the DSPM Identity and Access Management roles, see Identity and Access Management for organization-level activations.

Use the DSPM dashboard

Complete the following actions to use the dashboard to analyze your data security posture.

  1. To get the permissions that you need to use the DSPM dashboard, ask your administrator to grant you the following IAM roles on your organization:

    For more information about granting roles, see Manage access to projects, folders, and organizations.

    You might also be able to get the required permissions through custom roles or other predefined roles.

  2. Use the DSPM dashboard for data discovery and risk analysis. When you enable DSPM, you can immediately assess how your environment aligns with the Data security and privacy essentials framework.

    In the console, click the Data Security & Compliance tab under Data Protection.

    Go to Data Security Dashboard

    The following information is available:

    • Data map explorer
    • Data security findings
    • Insights about applied data security controls and frameworks

    Use this information to review and remediate findings so that your environment better aligns with your security and compliance requirements.

    The data map explorer might take 24 hours after you activate Security Command Center to populate all the data from Security Command Center and Cloud Asset Inventory.

Create custom data security frameworks

If required, copy the Data security and privacy essentials framework and customize it to meet your data security and compliance requirements. For instructions, see Apply a framework.

Deploy advanced data security cloud controls

If required, add the advanced data security cloud controls in custom frameworks. These controls require additional configuration. For instructions on deploying cloud controls and frameworks, see Apply a framework.

Consider the following:

  • Review the information for each advanced data security cloud control for limitations.

  • Complete the tasks for each rule, as described in the following table.

    Rule Additional configuration
    Data access governance cloud control
    • Enable Data Access audit logs for Cloud Storage and Vertex AI (where applicable in your environment).

      Set the data access permission type to DATA_READ. Enable the data access logs at the organization level or project level, depending on where you apply the Data access governance cloud control.

      Verify that only authorized principals are exempted from audit logging. Principals exempted from audit logging are also exempted from DSPM.

    • Add one or more allowed principals (up to a maximum of 200 principals), using one of the following formats:
      • For a user, principal://goog/subject/USER_EMAIL_ADDRESS

        Example: principal://goog/subject/alex@example.com

      • For a group, principalSet://goog/group/GROUP_EMAIL_ADDRESS

        Example: principalSet://goog/group/my-group@example.com
    Data flow governance cloud control

    • Enable Data Access audit logs for Cloud Storage and Vertex AI(where applicable in your environment).

      Set the data access permission type to DATA_READ. Enable the data access logs at the organization level or project level, depending on where you apply the Data access governance cloud control.

      Verify that only authorized principals are exempted from audit logging. Principals exempted from audit logging are also exempted from DSPM.

    • Specify allowed countries using the country codes that are defined in the Unicode Common Locale Data Repository (CLDR).
    Data protection and key governance cloud control Enable CMEK in BigQuery and Vertex AI.
    Data deletion cloud controls Set the retention periods. For example, to set a 90 day retention period in seconds, set the retention period to 777600.

What's next