{ "scg_version": "1", "schema": "/api/v1/fedramp/20x/scg-schema.json", "system": { "name": "RegScale Trust Center 20x (Class C)", "short_name": "trust-center-20x-class-c" }, "guide": { "title": "Secure Configuration Guide", "version": 1, "published_at": "2026-09-28T23:19:55.551383+00:00", "release_notes": "", "no_admin_settings_ack": false }, "sections": [ { "kind": "admin_account_lifecycle", "title": "Top-Level Administrative Accounts", "body_md": "## Top-Level Administrative Accounts (Account Lifecycle)\n\n**Account types and scope**\n\n- Top-Level Administrative Accounts (TLAs) are enterprise-scoped, named-individual accounts in the CSP-controlled Microsoft Entra tenant. They are never assigned to customers. Naming convention: `firstinitial.lastname_RS@regscale.com`. No shared or generic accounts are used.\n- For the Trust Center, TLA authority over resources is exercised in Google Cloud (GCP) via federated identity. On `trust-center-production` there are no human IAM bindings at the project level \u2014 every project binding is a service account. Human administrative access is inherited from the organization/folder (RegScale Org `345786972061`, folder `72611696813`). TLA roles are therefore:\n - Entra: Global Administrator, Privileged Role Administrator (identity plane).\n - GCP: organization/folder-level roles inherited to the project (no direct project-level human grants).\n- Separation of duties: TLA assignment requires documented approval, uses eligible (not permanent) assignment, is reviewed quarterly, and is not assigned to developers, support, or general operations.\n\n**Secure access**\n\n- MFA is enforced via Entra Conditional Access. Phishing-resistant FIDO2 (YubiKey) is required for interactive privileged access. Legacy authentication is disabled and sign-in risk policies are enabled.\n- Just-in-time elevation uses Entra PIM: eligible-only, time-bound activation, MFA at activation, business justification, and a minimum duration.\n- On the GCP side there are no Context-Aware Access levels configured; elevation is Entra-PIM-only on the identity side, with least-privilege GCP IAM roles on the resource side.\n- Device and session controls: Conditional Access restricts login to compliant/managed devices, enforces session timeout, and alerts on high-risk sign-ins.\n- Operational-use restriction: TLAs are used for configuration tasks only, never for daily email, development, or support; separate non-privileged accounts are used for routine work.\n\n**Decommissioning**\n\n- Access is removed on role change, termination, or inactivity within one business day: Entra PIM eligibility and active assignments are removed and the Entra account is disabled; audit logs are preserved.\n- Because human access is organization/folder-inherited, offboarding removes the identity's org/folder-level GCP grants and any service-account impersonation, and confirms no residual roles inherit to the project.", "frr_ids": [ "SCG-CSO-RSC" ] }, { "kind": "admin_settings", "title": "Administrative-Only Security Settings", "body_md": "## Administrative-Only Security Settings\n\nThe settings below can be changed only by Top-Level Administrative Accounts. Each lists its authority, what it controls, and the security implication if changed.\n\n**Conditional Access policies** \u2014 Authority: Entra Global Admin / Privileged Role Admin. Controls MFA enforcement, device compliance, location/risk-based access, and blocking of legacy authentication, including the session that federates into GCP. Weakening these disables MFA on GCP-bound access and enables phishing and token replay.\n\n**Resource authorization (IAM)** \u2014 Authority: GCP organization/folder IAM admins (inherited to the project); there are no direct human project bindings. Controls GCP IAM role assignment, project/organization permission inheritance, Org Policy constraints, and service-account governance. Improper IAM grants enable privilege escalation and bypass of separation of duties.\n\n**Logging and audit configuration** \u2014 Authority: TLAs controlling GCP logging and Entra tenant logging. Admin-activity logging and DATA_WRITE audit logging are enabled. Changes are logged. The encrypted export of GCP logs to Microsoft Sentinel is not yet live; until the Sentinel-side GCP connector exists, GCP logs are reviewed in Cloud Logging. Disabling or redirecting audit logging breaks AU-family visibility and forensic retention.\n\n**Encryption configuration and key governance** \u2014 Authority: TLAs managing GCP encryption. Trust Center data at rest uses Google-managed AES-256, validated under FIPS 140-3 BoringCrypto (CMVP #4735). Cloud SQL enforces `ENCRYPTED_ONLY` TLS on private IP only. The application derives a field-encryption key from a Secret Manager salt. Weakening encryption or key access exposes data at rest and cryptographic material.\n\n**Identity federation and trust** \u2014 Authority: Entra Global Admin (identity) plus GCP Workforce Identity Federation owner. Controls the Entra-to-GCP federation trust, SSO integrations, and cross-tenant trust. A bad federation trust introduces an untrusted identity provider into GCP access.\n\n**Oversight** \u2014 All changes above generate audit logs (Cloud Audit Logs and Entra logs), require change-management approval, and are reviewed quarterly.", "frr_ids": [ "SCG-CSO-RSC" ] }, { "kind": "privileged_settings", "title": "Privileged-Account Security Settings", "body_md": "## Privileged (non-TLA) Account Security Settings\n\n- Privileged non-TLA accounts operate under least privilege, time-bound access, and quarterly review.\n- They may manage tenant-scoped application RBAC, API configurations, and deployments.\n- They may not modify enterprise Conditional Access, enterprise IAM, centralized logging, encryption governance, or federation.\n- \"Deployments\" means GCP Cloud Run and Artifact Registry via the CI deploy identity `gh-deploy@trust-center-production.iam.gserviceaccount.com`, which is keyless (GitHub Workload Identity Federation) and holds exactly: `run.admin`, `artifactregistry.writer`, `iam.serviceAccountUser`, `secretmanager.secretAccessor`, `vpcaccess.user`, and `serviceusage.serviceUsageConsumer`.", "frr_ids": [ "SCG-CSO-RSC" ] }, { "kind": "secure_defaults", "title": "Secure Defaults", "body_md": "## Secure Defaults\n\n- Baseline defaults: mandatory MFA via Conditional Access, phishing-resistant authentication, PIM eligible-only assignment, legacy authentication disabled, device compliance, immutable centralized logging, and least-privilege RBAC.\n- The GCP baseline is enforced via Organization Policy constraints set on `trust-center-production`:\n - `iam.disableServiceAccountKeyCreation` \u2014 no service-account keys (keyless enforced)\n - `storage.publicAccessPrevention` \u2014 no public buckets\n - `sql.restrictPublicIp` \u2014 no public IP on Cloud SQL\n- FedRAMP High control requirements take precedence on any baseline conflict; deviations are treated as security events and are validated at least quarterly.\n\n**Break-glass accounts** \u2014 Hardware-protected credentials held in an offline vault, excluded from Conditional Access only as needed, rotated immediately after use, covering a GCP organization-level emergency access path, alerted on use, and reviewed quarterly.\n\n**Continuous monitoring** \u2014 Administrative activity is logged to GCP Cloud Audit Logs (Admin Activity and Data Access) plus Entra sign-in/PIM logs and application audit logs, with daily security operations review.\n\n**Secure decommissioning** \u2014 On decommission: disable admin accounts (Entra and GCP IAM), rotate/destroy keys, preserve logs per FedRAMP High retention, execute secure data destruction, and notify customers per contract.", "frr_ids": [ "SCG-CSO-SDF" ] }, { "kind": "obtain_and_use", "title": "How to Obtain and Use This Guide", "body_md": "## How to Obtain and Use This Guide\n\n- This Secure Configuration Guide is published in the RegScale Trust Center and is retrievable in human-readable form (Markdown, HTML, PDF) and machine-readable form (JSON and YAML with a detached JWS signature).\n- Consumers verify integrity with the published JWS signature against the tenant JWK set, and compare the machine-readable settings against their own deployment where applicable.\n- Versioning and release history are maintained. Each release is immutable and dated. Readers should always use the latest version unless auditing a prior release.", "frr_ids": [ "SCG-CSO-AUP" ] }, { "kind": "compare_capability", "title": "Settings Comparison Capability", "body_md": "", "frr_ids": [ "SCG-ENH-CMP" ] }, { "kind": "export_capability", "title": "Settings Export Capability", "body_md": "", "frr_ids": [ "SCG-ENH-EXP" ] }, { "kind": "api_capability", "title": "Settings API Capability", "body_md": "", "frr_ids": [ "SCG-ENH-API" ] } ], "settings": [ { "component": "CI deploy identity", "setting": "gh-deploy service account", "recommended_value": "Keyless (GitHub WIF), 6 least-privilege roles", "rationale": "Deploys without exportable keys and only the roles required to ship.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "Entra Conditional Access", "setting": "Legacy authentication", "recommended_value": "Blocked", "rationale": "Prevents authentication protocols that cannot enforce MFA.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "Entra Conditional Access", "setting": "MFA for privileged access", "recommended_value": "Required (phishing-resistant FIDO2 / YubiKey)", "rationale": "Enforces phishing-resistant MFA on all privileged access, including sessions that federate into GCP.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "Entra PIM", "setting": "TLA role assignment", "recommended_value": "Eligible only, time-bound", "rationale": "Removes standing privilege; elevation is just-in-time with MFA and justification.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP Cloud Audit Logs", "setting": "Admin Activity + Data Access", "recommended_value": "Enabled (Sentinel export pending)", "rationale": "Records administrative changes for AU-family visibility and forensic retention.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP Cloud SQL", "setting": "Connection encryption", "recommended_value": "ENCRYPTED_ONLY on private IP", "rationale": "Rejects cleartext connections; database is reachable only privately.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP encryption at rest", "setting": "Data-at-rest algorithm", "recommended_value": "Google-managed AES-256, FIPS 140-3 BoringCrypto (CMVP #4735); no CMEK", "rationale": "Protects data at rest with a validated cryptographic module.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP IAM", "setting": "Human bindings at project level", "recommended_value": "None; access organization/folder-inherited", "rationale": "Eliminates direct project-level human grants; access is centrally governed and reviewable.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP Org Policy", "setting": "iam.disableServiceAccountKeyCreation", "recommended_value": "Set (no service-account keys)", "rationale": "Enforces keyless (federated) identity; blocks long-lived exportable credentials.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP Org Policy", "setting": "sql.restrictPublicIp", "recommended_value": "Set (no public database IP)", "rationale": "Keeps Cloud SQL private; blocks public network reachability.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" }, { "component": "GCP Org Policy", "setting": "storage.publicAccessPrevention", "recommended_value": "Set (no public buckets)", "rationale": "Prevents accidental public exposure of object storage.", "applies_to_privileged": true, "is_secure_default": true, "reference": "" } ], "attachments": [], "links": [], "release_history": [] }