# 3.1 Ensure That the Default Network Does Not Exist in a Project (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233005-31-ensure-that-the-default-network-does-not-exist-in-a-project-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 2 ### Description: To enhance security, it is recommended to delete the default network in Google Cloud projects. The default network comes preconfigured with insecure firewall rules and a predefined IP range that limits its utility for secure and scalable networking. ### Rationale: The default network automatically includes the following insecure firewall rules: - default-allow-internal: Allows unrestricted ingress traffic for all protocols and ports within the network. - default-allow-ssh: Permits ingress traffic on TCP port 22 (SSH) from any source. - default-allow-rdp: Permits ingress traffic on TCP port 3389 (RDP) from any source. - default-allow-icmp: Allows unrestricted ICMP ingress traffic from any source. These rules are not logged by default and pose a significant security risk. Additionally, the default network uses auto mode, making it incompatible with features like Cloud VPN and VPC Network Peering. Deleting the default network ensures that organizations can configure custom networks aligned with their security and networking requirements. ### Impact: Organizations must migrate all assets from the default network to a newly created network before deleting it. This ensures uninterrupted operations while adhering to security best practices. ### Default Value: By default, a default network is created for each project. ### Audit Steps: #### Using Google Cloud Console: 1. Navigate to the VPC networks page at [Google Cloud Console: VPC Networks](https://console.cloud.google.com/networking/networks/list)                 ![](https://support.icompaas.com/assets/kb/dedaa907fc23012d.png) 2. Verify that no network named default exists in the list.                ![](https://support.icompaas.com/assets/kb/066101e009efdf38.png) #### Using Google Cloud CLI: Set the project: gcloud config set project PROJECT\_ID List all networks in the project: gcloud compute networks list 1. Confirm that default is not listed. ### Remediation Steps: #### Using Google Cloud Console: 1. Navigate to the VPC networks page at [Google Cloud Console: VPC Networks](https://console.cloud.google.com/networking/networks/list)                ![](https://support.icompaas.com/assets/kb/511f2eebe32ce7b7.png) 2. Select the default network and click Edit.                 ![](https://support.icompaas.com/assets/kb/e01fffb6b9b47c2e.png) 3. Click DELETE VPC NETWORK to remove it.                 ![](https://support.icompaas.com/assets/kb/dd2120746e01f41a.png) 4. If necessary, create a new network to replace the default network.  Using Google Cloud CLI: Delete the default network: gcloud compute networks delete default If required, create a new network: gcloud compute networks create NETWORK\_NAME ### Prevention: Prevent default network creation by setting up an Organization Policy: 1. Visit the [Organization Policy for Skipping Default Network Creation](https://console.cloud.google.com/iam-admin/orgpolicies/computeskipDefaultNetworkCreation). 2. Enable the policy to ensure no default networks are created in new projects. ### References: 1. [Google Cloud: Firewall Rules Overview](https://cloud.google.com/compute/docs/networking#firewall_rules) 2. [Google Cloud: Deleting Networks](https://cloud.google.com/compute/docs/reference/latest/networks/delete) 3. [Google Cloud: Logging Firewall Rules](https://cloud.google.com/vpc/docs/firewall-rules-logging) 4. [Google Cloud: Default Network Details](https://cloud.google.com/vpc/docs/vpc#default-network) 5. [gcloud Command Reference: Delete Networks](https://cloud.google.com/sdk/gcloud/reference/compute/networks/delete) CIS Controls:

Control

Description

IG 1

IG 2

IG 3

4.2 Establish and Maintain Secure Configurations

Maintain a secure configuration process for network infrastructure and review documentation annually or when significant changes occur.

✅

✅

✅

11.1 Maintain Security Configurations

Document and maintain standard security configurations for all authorized network devices.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.