Overview

Scrut integrates with Google Cloud (GCP) using service account impersonation, allowing organizations to securely connect one or more GCP accounts. Once integrated, Scrut automatically scans GCP environments every 24 hours for misconfigurations, with test findings displayed in the Cloud → Test section. The integration also supports automated controls such as verifying GCP Monitor enablement and Multi-AZ configuration for databases. Recent enhancements ensure GCP test findings include detailed remediation steps and clearer explanations, helping teams better understand issues and take corrective actions. By consolidating this evidence in Scrut’s GRC platform, organizations can reduce manual effort, improve visibility, and stay audit-ready.

Why Connect

• Surface cloud misconfigurations daily with remediation guidance
• Provide timestamped evidence of monitoring and redundancy controls
• Give leadership visibility into posture for audit and risk prioritization.

Supported Automated Tests

Scrut provides pre-built automated tests for Google Cloud. Here are a few examples of Scrut’s Google Cloud tests:

• Access reviews completed for all in-scope applications
• Google Cloud accounts associated with users
• Google Cloud accounts deprovisioned when employees leave

Supported Automated Evidence

Scrut automates the collection of some evidences for Google Cloud. Here are a few examples of Scrut’s Google Cloud-driven evidences that can be collected:

• Alerts from firewall for suspicious activity
• Capacity Monitoring Reports & Management Review
• Encryption for Data at Rest or Transit
• Firewall Rule Review
• Network traffic restrictions for database (security group)
• Offboarding - Logical Access & Physical Access Revocation
• Privilege access management
• Role Based Access on Production resources
• Reports of User Access Reviews
• User Access Approval list to Application, Infrastructure and Service