# Cis Gworkspace 4.2.5.1

> Ensure Google Cloud session control is configured

- Skill: `cyberstrikeus/cis-gworkspace-4-2-5-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gworkspace-4-2-5-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gworkspace-4-2-5-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gworkspace-4-2-5-1

---


# 4.2.5.1 Ensure Google Cloud session control is configured

## Profile Applicability

- Enterprise Level 2

## Description

Configure Google cloud session control to strengthen session expiration.

## Rationale

As an administrator, you can control how long different users can access the Google Cloud console and Cloud SDK without having to re-authenticate. For example, you might want users with elevated privileges, like project owners, billing administrators, or others with administrator roles, to re-authenticate more frequently than regular users. If you set a session length, they're prompted to sign in again to start a new session.

## Impact

The potential impact associated with implementation of this setting are:

- When a Google cloud session expires for a user, they see the Verify it's you page and must sign in again.
- If you require a security key, users who do not have one cannot use the GCP Console or Cloud SDK until they set it up. Once they have a security key, they can switch to using their password instead if they want.

### If you're using a third-party identity provider (IdP):

- With the GCP Console -- If you require a user to re-authenticate using their password, they're redirected to the identity provider (IdP). The IdP might not require the user to re-enter their password to start another console session, if the user already has a session active with the IdP -- because they are using another application that caused the session to remain active. If a user must re-authenticate by touching their security key, they can do this while using the console. They will not be redirected to the IdP.
- With the Cloud SDK -- If a password is required for re-authentication, gcloud will require the user to execute the gcloud auth login command to renew the session. This will bring up a browser window, and the user will be taken to the IdP, where they may be prompted for credentials if there's no active session with the IdP. If a user must reauthenticate by touching their security key, they can do this on the Cloud SDK. They will not be redirected to the IdP.

## Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to `https://admin.google.com` as an administrator
2. Select `Security`
3. Select `Access and Data Control`
4. Select `Google Cloud session control`
5. Under `Reauthentication policy`, ensure `Require reauthentication` is `selected` and `Exempt Trusted apps` is `unchecked`
6. Verify `Reauthentication frequency`, is `16 hours (recommended)`
7. Verify `Reauthentication method` is `Security key`

## Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to `https://admin.google.com` as an administrator
2. Select `Security`
3. Select `Access and Data Control`
4. Select `Google Cloud session control`
5. Under `Reauthentication policy`, set `Require reauthentication` to selected and `Exempt Trusted apps` is `unchecked`
6. Set `Reauthentication frequency` to `16 hours (recommended)`
7. Set `Reauthentication method` to `Security key`
8. Select `Override`

## Default Value

`Reauthentication policy` is `Never require reauthentication`

## CIS Controls

| Controls Version | Control                                                      | IG 1 | IG 2 | IG 3 |
| ---------------- | ------------------------------------------------------------ | ---- | ---- | ---- |
| v8               | 4.3 Configure Automatic Session Locking on Enterprise Assets | x    | x    | x    |