Yandex Cloud basic security rules

Written by

Updated at May 5, 2026

Note

This feature is at the Preview stage.

This rule set contains the basic security checks for protection of the cloud infrastructure and applications deployed in Yandex Cloud.

These rules help mitigate risks from basic security threats in cloud environments:

Requirement ID	Security standard requirement	Check ID in the CSPM module
Authentication and access management (IAM)
IAM5	Only appropriate administrators can manage IAM group membership	cspm.access.user-groups-access
IAM22	There is no public access to resources within the organization	cspm.access.public-access
IAM27	Access permissions of users and service accounts are regularly audited using the Yandex Security Deck CIEM	cspm.access.check-bindings
Network security (NET)
NET3	Security groups have no access rule that is too broad	cspm.network.network-firewall-scope
Secure virtual environment configuration (ENV)
ENV1	A serial console is either used under control or not used	cspm.access.serial-console
Data encryption and key management (CRYPT)
CRYPT9	KMS keys are stored in a hardware security module (HSM)	cspm.crypto.keys-hsm
CRYPT13	The organization uses Yandex Lockbox for secure secret storage	cspm.crypto.secrets-lockbox
CRYPT14	For Yandex Serverless Containers and Yandex Cloud Functions, Yandex Lockbox secrets are used	cspm.crypto.secrets-serverless
Collecting, monitoring, and analyzing audit logs (AUDIT)
AUDIT1	Yandex Audit Trails is enabled at the organization level	cspm.o11y.audit-trails-no-errors
AUDIT8	Data events are monitored	cspm.o11y.data-plane-events
Application security (APPSEC)
APPSEC1	Yandex SmartCaptcha is used	cspm.appsec.use-smartcaptcha
APPSEC2	Docker images are scanned when uploaded to Yandex Container Registry	cspm.appsec.secure-registry
APPSEC3	Docker images stored in Container Registry are regularly scanned	cspm.appsec.periodic-scan
APPSEC9	A Yandex Smart Web Security profile is used	cspm.appsec.use-sws
APPSEC10	A web application firewall is used	cspm.appsec.use-waf
APPSEC11	Advanced Rate Limiter is used	cspm.appsec.use-arl
Kubernetes security (K8S)
K8S8	One of the three latest Kubernetes versions is used, updates are monitored	cspm.k8s.version-update
K8S11	A Kubernetes security policy is used	cspm.k8s.kspm
K8S12	Audit log collection is set up for incident investigation	cspm.k8s.audit-logs

Yandex Cloud basic security rules

Was the article helpful?