# 3.2 Ensure Legacy Networks Do Not Exist for Older Projects (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233006-3-2-ensure-legacy-networks-do-not-exist-for-older-projects-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 1 ### Description: Legacy networks are deprecated and no longer supported for new projects in Google Cloud. This recommendation ensures that older projects do not utilize legacy networks, which lack modern features such as subnetting and are globally scoped. ### Rationale: Legacy networks have the following limitations: - They use a single global IPv4 prefix range and gateway IP address. - They cannot be divided into subnetworks, leading to reduced scalability and flexibility. - Legacy networks span all cloud regions, introducing a single point of contention or failure. - They are unsuitable for high network traffic projects, lacking modern network controls available in auto or custom subnet networks. Ensuring legacy networks are not in use helps improve scalability, performance, and security while adhering to modern networking standards. ### Impact: Legacy networks are gradually being phased out. Ensuring their absence eliminates potential risks associated with outdated configurations. ### Default Value: By default, networks are not created in legacy mode in new projects. ### Audit Steps: #### Using Google Cloud CLI: Set the project name in the Google Cloud Shell: gcloud config set project List the networks configured in the project: gcloud compute networks list 1. Review the MODE column in the output. None of the listed networks should have the mode set to LEGACY. ### Remediation Steps: #### Using Google Cloud CLI: Create a new non-legacy network: (Follow the [documentation](https://cloud.google.com/vpc/docs/vpc#types) to create a network in auto or custom mode:) gcloud compute networks create --subnet-mode=custom Delete the legacy network: (Follow the [documentation](https://cloud.google.com/vpc/docs/using-legacy#deleting_a_legacy_network) to delete any legacy networks:) gcloud compute networks delete 1. Migrate resources: Before deleting legacy networks, migrate all resources (e.g., VMs, routes, firewall rules) to the newly created network. ### References: 1. [Google Cloud: Legacy Networks Overview](https://cloud.google.com/vpc/docs/using-legacy#creating_a_legacy_network) 2. [Google Cloud: Deleting Legacy Networks](https://cloud.google.com/vpc/docs/using-legacy#deleting_a_legacy_network) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

4.2 Establish and Maintain Secure Configuration

Maintain secure configurations for network devices, reviewing and updating them annually or upon significant changes.

✅

✅

✅

11.1 Maintain Standard Security Configurations

Document and maintain standard security configurations for all authorized network devices.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.