# 4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK) (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233021-4-7-ensure-vm-disks-for-critical-vms-are-encrypted-with-customer-supplied-encryption-keys-csek-aut - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: Level 2 Description: Google Cloud enables customers to encrypt VM disks using Customer-Supplied Encryption Keys (CSEK). These keys allow users to manage their own encryption and decryption processes, ensuring control over sensitive data rather than relying exclusively on Google-managed encryption. This practice is particularly critical for safeguarding sensitive virtual machines (VMs), meeting stringent security and compliance requirements. Rationale: By default, Google encrypts data at rest using its own managed keys. While convenient, this gives Google control over encryption. CSEK allows users to retain control, ensuring that only authorized personnel with the correct keys can access encrypted data. However, if the CSEK is lost or forgotten, the data becomes irretrievable, providing additional security by eliminating unauthorized access. Impact: If a customer-supplied encryption key is lost, the associated encrypted data cannot be recovered. Therefore, users must follow robust key management practices to avoid data loss. Default Value: By default, VM disks are encrypted using Google-managed keys and not Customer-Supplied Encryption Keys. Audit Steps: #### Using Google Cloud Console: 1. Navigate to Compute Engine > Disks: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks). ![](https://support.icompaas.com/assets/kb/f4a1a7a7ee3b2974.png) 2. Select the disk linked to the critical VM. ![](https://support.icompaas.com/assets/kb/4f8feeff6dcb033b.png) 3. Verify that the Encryption Type is set to Customer Supplied. ![](https://support.icompaas.com/assets/kb/e597a03af0b24cb1.png) #### Using Google Cloud CLI: Run the following command to check the encryption details of a disk: gcloud compute disks describe --zone --format="json(diskEncryptionKey,name)" 1. Ensure that the diskEncryptionKey property is present and contains a valid sha256 key. Remediation Steps: #### From Google Cloud Console: 1. Navigate to Compute Engine > Disks: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks). ![](https://support.icompaas.com/assets/kb/11530c3601adaba3.png) 2. Click Create Disk. ![](https://support.icompaas.com/assets/kb/cf24be264ee9d312.png) 3. Set the Encryption Type to Customer Supplied. ![](https://support.icompaas.com/assets/kb/426b869a55e44f3e.png) 4. Enter the required encryption key in the designated field. ![](https://support.icompaas.com/assets/kb/adf5893ab3bf6775.png) 5. Click Create to finalize the process. ![](https://support.icompaas.com/assets/kb/cd39caa9d1c06794.png) #### From Google Cloud CLI: To create a new disk with CSEK during VM instance creation: gcloud compute instances create --csek-key-file To create a standalone disk encrypted with a customer-supplied key: gcloud compute disks create --csek-key-file References: 1. [Google Compute Disk API Reference](https://cloud.google.com/compute/docs/reference/rest/v1/disks/get) Additional Information: - Key Management Responsibility: Customers must securely store and manage their encryption keys, as Google does not retain them. Lost keys result in irretrievable data. - Key Format: Keys must be 256-bit strings encoded in RFC 4648 base64. Example Key File: \[ { "uri": "https://www.googleapis.com/compute/v1/projects/myproject/zones/us-central1-a/disks/example-disk", "key": "acXTX3rxrKAFTF0tYVLvydU1riRZTvUNC4g5I11NY-c=", "key-type": "raw" } \] CIS Controls:

Control	Description	IG 1	IG 2	IG 3
3.11 Encrypt Sensitive Data at Rest	Encrypt sensitive data at rest, including on servers, applications, and databases.	✅	✅
14.8 Encrypt Sensitive Information at Rest	Use encryption to secure sensitive information stored at rest.	✅	✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.