Support compliance requirements
Support compliance requirements
This domain tests how Google Cloud controls map to regulatory obligations: data residency, personnel access, org policy guardrails, and evidence collection.
Core rules
- Shared responsibility: Google secures the infrastructure; you secure configuration, identity, data, and usage. Compliance attestations (SOC 2, ISO 27001, PCI DSS, HIPAA) are available in the Compliance Resource Center, but you must still configure controls.
- Assured Workloads creates folders/projects with controls for regimes such as FedRAMP, IL4, CJIS, ITAR, HIPAA, and data residency. It applies org policies and restricts supported services and locations; it does not automatically encrypt data or replace IAM.
- Organization Policy constraints enforce guardrails: e.g., constraints/gcp.resourceLocations limits resource locations; constraints/compute.vmExternalIpAccess blocks external IPs; constraints/iam.disableServiceAccountKeyCreation blocks new keys. Org policy is not IAM and does not grant access.
- Access Transparency logs when Google personnel access your content; Access Approval requires your approval for that access.
- Data residency: use location constraints and Assured Workloads; confirm each service supports the required region, including KMS key rings and log buckets.
- Audit evidence: Compliance reports, audit logs, and SCC compliance dashboards support audits; export logs to a controlled bucket with retention.
Worked example
A healthcare workload must stay in the US and support HIPAA. Create an Assured Workloads folder with HIPAA and US regions, apply constraints/gcp.resourceLocations to deny non-US locations, use US KMS key rings for CMEK, enable Access Transparency, and export audit logs to a US bucket. The reasoning layers regime controls, location guardrails, encryption, and evidence-not one product. Review the shared responsibility matrix for each service and document the control mapping for each requirement.
Traps
Treating Assured Workloads as automatic encryption; assuming org policy grants permissions; ignoring that not all services are in scope for a regime; confusing data residency with data sovereignty; and forgetting that compliance evidence must be exported and retained.