# Ensure Cloud Storage Bucket Has a Sufficient Retention Policy Period

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888293024290-ensure-cloud-storage-bucket-has-a-sufficient-retention-policy-period
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Cloud Storage buckets containing data subject to retention requirements have a Bucket Lock retention policy configured with a minimum retention period that meets or exceeds the organization's compliance or business requirements, preventing objects from being deleted or overwritten before that period elapses.

**Rationale**

Without a retention policy, objects in a bucket can be deleted or overwritten at any time by anyone with sufficient IAM permissions, which may violate regulatory requirements (for example, financial or healthcare record retention) or destroy evidence needed for audits and investigations. A locked retention policy with a sufficient minimum period provides an enforceable, tamper-resistant guarantee that data will not be removed before the required retention period has elapsed, even by project owners.

**Impact**

-   Guarantees that objects cannot be deleted or overwritten before the configured retention period elapses
    
-   Supports regulatory and compliance requirements for data retention
    
-   Locking a retention policy is irreversible, so the period must be chosen carefully before locking
    

**Default Value**

By default, Cloud Storage buckets have no retention policy configured, and objects can be deleted or overwritten at any time by an authorized principal.

**Pre-Requisites**

-   A documented, approved minimum retention period based on regulatory or business requirements
    
-   IAM permissions to configure and lock bucket retention policies (e.g., Storage Admin)
    
-   Awareness that locking a retention policy cannot be undone and cannot be shortened afterward
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Cloud Storage > Buckets and select the bucket to review.
    
4.  Open the Protection tab.
    
5.  Verify that a Retention policy is configured and that the retention period meets or exceeds the required minimum for the data stored in the bucket.
    
6.  Verify whether the policy is locked, if permanent enforcement is required by policy.
    
7.  If no retention policy exists, or the period is insufficient, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Cloud Storage > Buckets and select the bucket to update.
    
4.  Open the Protection tab.
    
5.  Locate Retention policy and select Edit (or Set retention policy).
    
6.  Enter the required retention duration (for example, in days) based on the organization's documented requirement.
    
7.  Save the configuration.
    
8.  If the policy must be permanently enforced, select Lock retention policy and confirm, noting that this action is irreversible.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Cloud Storage > Buckets and select the affected bucket.
    
4.  Open the Protection tab.
    
5.  If the retention policy is unlocked, select Edit and remove or reduce the retention period, or select Remove retention policy.
    
6.  Note that if the retention policy has been locked, it cannot be removed or shortened, and this step is not possible.
    

**Reference**

-   [https://cloud.google.com/storage/docs/bucket-lock](https://cloud.google.com/storage/docs/bucket-lock)
    
-   [https://cloud.google.com/storage/docs/using-bucket-lock](https://cloud.google.com/storage/docs/using-bucket-lock)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.