Authentication and authorization guidelines

The following guidelines for the minimum viable security platform align with the authentication and authorization security pillar.

Basic level guidelines

Implement the following authentication and authorization guidelines first.

Item	Define the identity source of truth
Description	Decide on your source of truth for provisioning managed user identities. Patterns include creating user identities in Cloud Identity, syncing identities from an existing identity provider, or using Workforce Identity Federation.
Related information	Decide how to onboard identities to Google Cloud
Item ID	MVSP-CO-1.4
Mapping	Related NIST-800-53 controls: AC-2 Related CRI profile controls: PR.AC-1.1

Item	Create redundant administrator accounts
Description	Don't have a single super admin or Organization Administrator. Create one or more (up to 20) backup administrator accounts. A single super admin or Organization Administrator can result in lockout scenarios. This situation also carries a higher risk as one person can make platform-altering changes, potentially with no oversight.
Related information	Security best practices for administrator accounts Setting up your organization resource
Item ID	MVSP-CO-1.7
Mapping	Related NIST-800-53 controls: IA-2 IA-4 IA-5 Related CRI profile controls: PR.AC-1.1 PR.AC-1.2 PR.AC-1.3 PR.AC-6.1 PR.AC-7.1 PR.AC-7.2 Compliance Manager control: Limit Super Admin Accounts

Item	Enforce strong password policies
Description	Enforce strong and unique passwords for all user accounts. Consider using a password manager. Weak or no credentials are a common pattern that malicious users can easily exploit.
Related information	Enforce and monitor password requirements for users Enable, disable, and use password policies
Item ID	MVSP-CO-1.9
Mapping	Related NIST-800-53 controls: IA-5 Related CRI profile controls: PR.AC-1.1

Item	Use roles based on job functions
Description	Use Identity and Access Management (IAM) roles that are based on job functions to assign permissions to users. Job functions are predefined roles that allow admins to provide a set of permissions that is limited to a job function, thus improving productivity and reducing the back-and-forth of asking for permissions. To better align with your organization's requirements, you can create custom roles based on predefined roles.
Related information	Predefined roles for job functions
Item ID	MVSP-CO-1.20
Mapping	Related NIST-800-53 controls: AC-6 Related CRI profile controls: PR.AC-4.1