> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/scans/policies/gcp-policies.md).

# GCP Policies

GCP policies set what a scan collects and checks in GCP environments.

***

### Edit Scan Policy (GCP)

On the **General** tab you enable or disable the scan modules and define exclusions. Unlike the other policy types, a GCP policy has no **Options** section. The **Edit Scan Policy** page has four tabs: **General**, **Vulnerability**, **Tier 0 Assets** and **Compliance** (see [Compliance Frameworks](/forestall/scans/policies.md#compliance-frameworks)).

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-eb5a0649e2bfa8d306c6e624019bfbb113230675%2Fscans-policies-gcp-policy-settings.png?alt=media" alt="GCP Default Policy General tab with IAM Assessment and Tier0 Analysis"><figcaption><p>GCP Scan Policy Settings</p></figcaption></figure>

***

### Vulnerability Policies and Tiering (GCP)

The **Vulnerability** tab sets which GCP checks run during the scan (see [Vulnerability Policies](/forestall/scans/policies.md#vulnerability-policies)). The **Tier 0 Assets** tab marks your most critical identities.

***

### GCP Scan Modules

**IAM Assessment:** Checks vulnerabilities, misconfigurations and access relationships in GCP, including IAM, resources, roles and permissions across organizations, folders and projects. It is the core module and cannot be disabled.

**Tier0 Analysis:** Optional. An analytics-only module that calculates the attack paths from Tier 2 identities to Tier 0 assets from the data collected by IAM Assessment.

Both modules are enabled in the **GCP Default Policy**.

***

### Exclusions (GCP)

Click **Add New** to add an exclusion row, then select the entity type and enter the entity. The types and their identifiers are listed under [General Exclusions](/forestall/scans/policies.md#general-exclusions).

***

### Tier 0 Assets (GCP)

On the **Tier 0 Assets** tab you mark critical GCP identities as privileged. The types are GCPUser, GCPGroup, GCPServiceAccount and GCPRole. Tier 0 assets are treated as high-impact identities in the attack path analysis.