2.2 Plan GCP Organization Policies

GCP Organization Policies let administrators set uniform constraints at the organisation, folder or project level — for example, restricting which regions resources can be created in, restricting external data sharing, or restricting which services are usable. Policies are inherited automatically down to folders and projects, and can be overridden further down the hierarchy. In short: they put governance guardrails around your whole GCP environment, so teams can operate freely within a compliant boundary.

Once a GCP Organization is enabled, a set of default Organization Policies is already active. If your company's policy needs to meet the baseline CIS Benchmark, see the organization-policies/ Terraform sub-project:

• Bilingual policy catalogue — a Chinese/English side-by-side table of all 35 policies (including 2 AI/Vertex AI-specific extensions), mapped against CIS Google Cloud Platform Foundation Benchmark v5.0.0.
• Methodology write-up — how to decide, based on your own company's risk and business needs, which policies to enable, at what level, and with what values — rather than adopting the CIS recommendations wholesale.
• Terraform module — reads policies_catalog.yaml and uses for_each to generate google_org_policy_policy resources, ready for terraform init/plan/apply.