# 2.13 Ensure Cloud Asset Inventory Is Enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233001-213-ensure-cloud-asset-inventory-is-enabled-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # Profile Applicability:Level 1 # Description: Google Cloud Asset Inventory (CAI) provides a historical view of Google Cloud resources and IAM policies through a time-series database. It captures metadata about resources, IAM policies, and runtime information within a project. While the Cloud Asset API is not required for basic operation of CAI, enabling it allows for searching and exporting data directly. # Rationale: Cloud Asset Inventory facilitates: - Security analysis: Identifying misconfigurations and vulnerabilities. - Resource change tracking: Monitoring changes over time. - Compliance auditing: Ensuring adherence to organizational and regulatory requirements. Enabling CAI ensures an accurate inventory of assets and IAM policies, which is critical for governance and security. ## Impact: Enabling CAI does not impact regular operations but enables enhanced tracking. Organizations might incur storage costs when exporting asset metadata to Cloud Storage or BigQuery. # Audit Steps: Using Google Cloud Console: 1. Navigate to API & Services > Library by visiting: [https://console.cloud.google.com/apis/library](https://console.cloud.google.com/apis/library).                       ![](https://support.icompaas.com/assets/kb/5f5c4c3603970146.png) 2. Search for Cloud Asset API and select the result.                    ![](https://support.icompaas.com/assets/kb/fe87ad3b10841e26.png) 3. Verify that API Enabled is displayed.                   ![](https://support.icompaas.com/assets/kb/00057ec2cd3650bc.png) Using Google Cloud CLI: Run the following command to check if the Cloud Asset API is enabled: gcloud services list --enabled --filter=name:cloudasset.googleapis.com 1. If the API is enabled, it will be listed in the output. If the response is empty, the API is not enabled. # Remediation Steps: Using Google Cloud Console: 1. Navigate to API & Services > Library by visiting: [https://console.cloud.google.com/apis/library](https://console.cloud.google.com/apis/library).                 ![](https://support.icompaas.com/assets/kb/4bfb350a71b1b056.png) 2. Search for Cloud Asset API and select it.                 ![](https://support.icompaas.com/assets/kb/f0eb4b9de8cf8630.png) 3. Click the ENABLE button.               ![](https://support.icompaas.com/assets/kb/fa043503563982d4.png) Using Google Cloud CLI: Enable the Cloud Asset API by running the following command: gcloud services enable cloudasset.googleapis.com # References: 1. [Cloud Asset Inventory Documentation](https://cloud.google.com/asset-inventory/docs) # Additional Information: - CAI retains a five-week history of asset metadata by default. For longer retention, consider exporting data to Cloud Storage or BigQuery. - Users do not need to enable the API unless they plan to export or search CAI data directly. # CIS Controls:

Control

Description

IG 1

IG 2

IG 3

1.1 Establish and Maintain Asset Inventory

Maintain a detailed, up-to-date inventory of all enterprise assets, including hardware and software assets, network addresses, owners, and departments.

✅

✅

✅

6.6 Authentication and Authorization Inventory

Maintain an accurate inventory of all authentication and authorization systems, reviewing and updating it at least annually.

✅

✅


1.4 Detailed Asset Inventory

Ensure a complete inventory of all technology assets, including hardware and software, connected or unconnected to the organization's network.

✅

✅

✅

16.1 Authentication Systems Inventory

Maintain a record of all authentication systems used by the organization, whether onsite or hosted externally.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.