GCP VM Manager Capability Group

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.

VM Manager OS policies can install, remove, and maintain software packages in an enforced desired state, and Patch can keep managed VM operating systems and packages current. These capabilities can reduce downgrade opportunities by removing or replacing obsolete software versions and enforcing approved versions on managed VMs. The mapping is Partial because T1689 also includes protocol and boot-component downgrades that are outside VM Manager software-package enforcement.

VM Manager OS policies can manage operating-system files and run condition-based configuration scripts while periodically enforcing the desired state. On managed Linux and Windows VMs, these controls can be used to enforce shell and PowerShell history configuration and restore settings that suppress command-history logging. The mapping is Partial because it requires an explicitly authored policy and does not cover network devices, ESXi, or activity that bypasses the managed configuration.

VM Manager OS policies can enforce Windows configuration state through managed files, scripts, packages, and policy assignments. If an organization explicitly uses OS policies to maintain Windows Firewall configuration or associated permissions, VM Manager can help restore or enforce the intended firewall state after unauthorized modification. This mapping is Minimal because the protection depends on specific policy configuration and VM Manager does not inherently prevent all firewall changes.