diff --git a/cfngoat.yaml b/cfngoat.yaml
index 7e80f9a8..317abb65 100644
--- a/cfngoat.yaml
+++ b/cfngoat.yaml
@@ -598,6 +598,8 @@ Resources:
           Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-data"
 
   ### TODO - Custom Upload of insecure document
+      PublicAccessBlockConfiguration:
+        RestrictPublicBuckets: True
 
   FinancialsBucket:
     # not encrypted, no access logs, no versioning