# 1.3 Ensure Security Key Enforcement is Enabled for All Admin Accounts (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000232872-1-3-ensure-security-key-enforcement-is-enabled-for-all-admin-accounts-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: ### Level 2 ### Description: Enable Security Key Enforcement for all Google Cloud Platform (GCP) admin accounts to enhance account security. ### Rationale: Admin accounts with the Organization Administrator role have the highest privileges in GCP and should be safeguarded with the strongest form of multi-factor authentication (MFA): Security Keys. Unlike weaker second factors such as SMS or OTP, Security Keys use encrypted signatures for authentication, ensuring that login credentials cannot be phished. ### Impact: - Losing access to a security key may result in account lockout. - It is crucial to configure backup security keys to mitigate this risk. ### Default Value: By default, Security Key Enforcement is not enabled for Organization Administrator accounts. Remediation: Test Plan: Identify Organization Administrators: Run the following command to retrieve the IAM policy for your organization: gcloud organizations get-iam-policy 1. Look for users assigned the role roles/resourcemanager.organizationAdmin. 2. Manually confirm that Security Key Enforcement is enabled for each admin account. 3. Identify all users with the Organization Administrator role. 4. Configure Security Key Enforcement for each admin account using the [Google Cloud Security Key Setup Guide](https://cloud.google.com/security-key/). ## Backout Plan: Step 1: Disable Security Key Enforcement (Temporarily) If necessary, temporarily disable enforcement: gcloud identity accounts update-mfa-policy \\ --disable-enforce \\ --organization-id ORGANIZATION\_ID Step 2: Restore User Access (If Impacted) Re-add affected users if access was removed: gcloud projects add-iam-policy-binding PROJECT\_ID \\ --member="user:RESTORED\_EMAIL" \\ --role="roles/resourcemanager.organizationAdmin" Step 3: Notify Users & Adjust Policies - Inform affected admins about the change. - Review IAM policies to ensure that only necessary accounts retain admin privileges. ### **References:** 1. **[Google Cloud Security Key Setup Guide](https://cloud.google.com/security-key/)** 2. **[Benefits of Security Keys for Enhanced Account Security](https://gsuite.google.com/learnmore/key_for_working_smarter_faster_and_more_securely.html)** ### **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

6.3 Require MFA for Externally-Exposed Applications

Enforce MFA for all externally accessible enterprise or third-party applications. MFA through directory services or SSO is sufficient.

✅

✅

✅

16.3 Require Multi-Factor Authentication

Enforce MFA for all user accounts, whether managed on-premises or by a third-party provider, to enhance security.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.