Yandex Cloud basic security rules

Written by

Updated at July 9, 2026

Note

This feature is at the Preview stage.

This rule set contains the basic security checks for protection of the cloud infrastructure and applications deployed in Yandex Cloud.

These rules help mitigate risks from basic security threats in cloud environments:

Requirement ID	Security standard requirement	Check ID in the CSPM module
Authentication and access management (IAM)
IAM1	An identity federation (Single Sign-On, SSO) is configured
Only appropriate administrators can manage IAM group membership
There is no public access to resources within the organization
>
Security groups have no access rule that is too broad
>
A serial console is either used under control or not used
>
KMS keys are stored in a hardware security module (HSM)
The organization uses Yandex Lockbox for secure secret storage
For Yandex Serverless Containers and Yandex Cloud Functions, Yandex Lockbox secrets are used
>
Yandex Audit Trails is enabled at the organization level
Data events are monitored
>
Yandex SmartCaptcha is used
Docker images are scanned when uploaded to Yandex Container Registry
Docker images stored in Container Registry are regularly scanned
A Yandex Smart Web Security profile is used
A web application firewall is used
Advanced Rate Limiter is used
>
A Kubernetes security policy is used