What does the Google Cloud setup guide cover?

It walks through ten security requirements — including phishing-resistant multi-factor authentication, least-privilege access control, asset & account inventory, and more — mapped to the DoW Brilliant at the Basics IT Top 10 and to NIST SP 800-171 / CMMC Level 2. Each requirement has a plain-language explanation, a process-flow diagram, and a click-by-click checklist.

Where do I perform these GCP steps?

In the Google Cloud console (console.cloud.google.com). Every step names the exact portal or console path to follow.

Is my checklist progress saved anywhere?

Your step checklist progress is saved only in your own browser (local storage). Nothing is sent to the site, and you can reset it at any time.

How do I handle CUI in Google Cloud?

Deploy inside Assured Workloads with the appropriate US government / Impact Level compliance regime, so data location and personnel access stay within the compliant boundary.

Does Google Cloud encrypt data by default?

Yes. Google Cloud encrypts all data at rest by default; use Cloud KMS customer-managed encryption keys (CMEK) to add your own key control for sensitive workloads.

Google Cloud Setup Guide

REQUIREMENT 01 OF 10

Phishing-Resistant Multi-Factor Authentication

IT-013.5.3IA.L2-3.5.3

IN PLAIN WORDS

Multi-factor authentication (MFA) means you need two things to log in: a password and a second proof it's really you. Phishing-resistant MFA uses a physical security key or a passkey that a fake website can't trick or copy. It's like a house that needs both a key and a special fingerprint scanner, so a stolen key alone won't get a thief inside.

WHY IT MATTERS

Passwords get stolen or guessed all the time, and without a strong second factor an attacker who has a password can walk right into your defense contractor's cloud.

TOOLS YOU WILL USE

Cloud IdentityGoogle Admin consoleTitan Security Key2-Step Verification

HOW THE SETUP FLOWS

1Open Admin console
2Turn on 2SV
3Require security keys
4Register Titan keys
5Enforce for admins

STEP-BY-STEP CHECKLIST

1. Open the Admin consoleGoogle Cloud sign-in is managed in Google Workspace or Cloud Identity. Go to admin.google.com and sign in as an administrator.
2. Find 2-Step Verification settingsIn the Google Admin console, go to Security > Authentication > 2-Step Verification.
3. Turn on enforcementCheck 'Allow users to turn on 2-Step Verification' and set enforcement to On, choosing an enrollment grace period from 1 day to 6 months.
4. Require security keys onlyUnder 'Methods', pick 'Only security key' so only hardware keys and passkeys are allowed. This blocks weaker codes that phishing can steal.
5. Buy and register keysGive each admin a FIDO2 hardware key such as a Titan Security Key, then have them register it at myaccount.google.com under Security > 2-Step Verification.
6. Protect admin accounts firstApply enforcement to an organizational unit or group that contains your administrators and users who touch sensitive data.
7. Set backup keysHave each user register a second key so a lost key doesn't lock them out; store the spare in a safe place.

Pro tip

Register a backup security key for every user before you enforce, or a single lost key can lock someone out of the whole account.

Government cloud & CUI

For CUI and ITAR work, run identities in an Assured Workloads environment and enforce phishing-resistant 2SV, since FedRAMP High and DoD IL4/IL5 require strong multi-factor authentication.

EVIDENCE TO KEEP

Screenshot of 2-Step Verification enforcement settingList of users with security keys enrolledAdmin console audit log of the policy change

See the full IT-01 practice guide →

Google Cloud setup guide

Frequently asked questions