# 4.11 Ensure That Compute Instances Have Confidential Computing Enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233025-4-11-ensure-that-compute-instances-have-confidential-computing-enabled-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 2 Description: Google Cloud provides Confidential Computing, a feature that encrypts data in-use during processing. This breakthrough technology ensures that customer data is encrypted in memory and other areas outside the central processing unit (CPU). Confidential VMs leverage Secure Encrypted Virtualization (SEV) provided by AMD EPYC™ CPUs, ensuring data remains encrypted while being processed, queried, or trained. Rationale: Confidential Computing ensures that sensitive data and code remain encrypted in memory, mitigating risks associated with unauthorized access. Encryption keys are hardware-generated, non-exportable, and specific to each VM. By implementing this technology, organizations can reduce the risk of insider threats and unauthorized data exposure, enhancing trust in Google Cloud's infrastructure. Impact: - Disruptions During Maintenance: Confidential VMs do not support live migration, so they may experience downtime during maintenance events. - Additional Costs: Enabling Confidential Computing may incur extra charges. For more details, refer to [Google Cloud Confidential VM Pricing](https://cloud.google.com/compute/confidential-vm/pricing). Default Value: By default, Confidential Computing is disabled for Compute instances. Audit Steps: #### From Google Cloud Console: 1. Navigate to the VM instances page: [VM Instances](https://console.cloud.google.com/compute/instances). ![](https://support.icompaas.com/assets/kb/c99096edd63908c6.png) 2. Select the instance to view its details. ![](https://support.icompaas.com/assets/kb/1bde55d553126330.png) 3. Verify that the Confidential VM service is enabled. #### From Google Cloud CLI: List all instances and their configurations: gcloud compute instances list --format=json 1. Check the enableConfidentialCompute property under the confidentialInstanceConfig section. Ensure its value is true for all instances using machine types starting with n2d-. Remediation Steps: Confidential Computing can only be enabled during instance creation. Existing instances need to be deleted and recreated with this feature enabled. #### From Google Cloud Console: 1. Navigate to the [VM instances page](https://console.cloud.google.com/compute/instances). ![](https://support.icompaas.com/assets/kb/e3341259355eaa6b.png) 2. Click create instance ![](https://support.icompaas.com/assets/kb/36691f1d3ea6399d.png) 3. Configure the desired instance settings. 4. Under the Confidential VM section, check Enable the Confidential Computing service on this VM instance. 5. Click Create to launch the instance. #### From Google Cloud CLI: Create a new instance with Confidential Computing enabled: gcloud compute instances create --zone --confidential-compute --maintenance-policy=TERMINATE ### Backout Plan: Disable Confidential Computing: If confidential computing needs to be disabled, run the following command to disable it on an existing instance: gcloud compute instances update \[INSTANCE\_NAME\] \\--zone \[ZONE\] \\ --no-confidential-compute This command will remove confidential computing settings from the instance. - Revert to Previous Instance Configuration: If you need to revert to the previous instance configuration, restore the instance to its original settings or recreate the VM without the confidential computing option. - Test and Verify: After rolling back, verify that the instance is working as expected and that confidential computing is no longer enabled. - Notify Stakeholders: Notify the relevant teams and stakeholders about the backout and any operational impact it might have on workloads. References: 1. [Creating a Confidential VM Instance](https://cloud.google.com/compute/confidential-vm/docs/creating-cvm-instance) 2. [About Confidential VMs](https://cloud.google.com/compute/confidential-vm/docs/about-cvm) 3. [Google Cloud Confidential Computing](https://cloud.google.com/confidential-computing) CIS Controls:

Control	Description	IG 1	IG 2	IG 3
3.11 Encrypt Sensitive Data at Rest	Encrypt sensitive data stored in servers, applications, and databases using methods such as storage-layer or application-layer encryption.	✅	✅
14.8 Encrypt Sensitive Information at Rest	Secure sensitive data at rest with tools requiring secondary authentication, ensuring access is restricted to authorized users.	✅	✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.