A secure foundation is essential for tech innovation. As organizations embrace agentic AI, they should also continue to prioritize cloud security and risk management.  

To help organizations better manage security requirements and set configurations, today we’re publishing a recommended security checklist inspired by the Minimum Viable Secure Product (MVSP) principles. These curated controls provide a clear starting point that can help shift security from a perceived blocker to a critical business enabler. 

By providing a clear path to security excellence, the checklist is already helping customers build more resilient and secure cloud environments. Organizations with early access to the checklist told us that it enabled them to immediately identify and activate critical security controls, and helped them transform their security baseline from a work-in-progress to a hardened foundation in a single session. 

Research into cloud security best practices has found that even as organizations steadily moved to the cloud, the most common risks remained unchanged. Weak credentials (47%) and misconfigurations (29%) account for nearly 76% of compromises, according to our 2025 Google Cloud Threat Horizons Report.

What are Google Cloud’s recommendations?

Aligned with our shared fate approach, these recommendations are a curated, tiered checklist featuring 60 security controls vetted by Google Cloud’s Office of the CISO and subject matter experts across six domains: Authentication and authorization, organization resource management, infrastructure resource management, data protection, network security, and monitoring, logging, and alerting. 

The Google Cloud security checklist is designed to be:

• Simple: We focused on universally-beneficial actions that apply regardless of your specific architecture.

• Scalable: We grouped the guidance into Basic, Intermediate, and Advanced categories to help you maintain security controls as your organization grows.

• Automatable: We provided more than a printable checklist by including the tools you’ll need to make changes. The checklist is complemented by  a frequently-updated repository of Terraform code on GitHub for immediate and consistent deployment.

• AI-ready: We designed this curated checklist to help organizations modernize more rapidly by providing foundational components needed to adopt innovative technologies, such as agentic AI.

Aligning with industry standards

Our latest State of Cloud Security Research underscores that the highest-performing organizations aren't just doing more — they are consistently doing the right things.

At Google Cloud, we’ve invested heavily for more than two decades in helping develop and maintain IT and cybersecurity community standards, including the Secure AI Framework and Supply-chain Levels for Software Artifacts. 

Get started today

While it can feel daunting to address security posture and risk in cloud environments, Google Cloud is here to help demystify and simplify achieving better security as a business enabler. Whether you’re a small business or a global enterprise, the checklist provides the essential baseline needed to prepare your environment for the AI era.

You can start implementing the Google Cloud minimum viable secure platform checklist today.