Designing for security and compliance · Topic 5 of 5
Designing for Compliance and Audits
Meeting health, children's and data privacy laws, data sovereignty, card data and PII rules, SOC 2 and audits with Assured Workloads, audit logs and Access Approval.
- 4 min
- Shared responsibility: Google certifies the platform; you configure and prove your part.
- Healthcare data only in services covered by the BAA.
- Residency: resource locations policy; sovereignty with support controls: Assured Workloads.
What it is
Compliance means meeting laws, contracts and industry standards, and proving it. Google Cloud provides certified infrastructure and controls under a shared responsibility model: Google secures the platform; the customer configures services, data and access correctly. The exam asks which controls satisfy a stated rule and which evidence an auditor needs.
How it works
Laws and regulations
| Rule (examples) | Typical design response |
|---|---|
| Health record privacy (for example HIPAA in the US) | Sign Google's business associate agreement; use only services covered by it; encrypt, restrict access, keep audit logs |
| Children's privacy (for example COPPA) | Collect minimal data, get consent flows right, restrict and log access |
| Data privacy (for example GDPR) | Lawful processing, minimization, deletion on request, EU locations where required |
| Data sovereignty and residency | Region choice, resource locations organization policy, Assured Workloads, keys under customer control |
Under a healthcare BAA, check that each service is on Google's list of covered products before it handles protected health information. Regional availability or CMEK support does not make a service covered.
Sovereignty controls
| Control | What it enforces |
|---|---|
| Resource locations organization policy | Where resources can be created |
| Assured Workloads | Control packages (for example EU regions with EU-based support, or US regulatory regimes) that combine location rules, personnel access restrictions and other settings for a folder |
| CMEK, Cloud HSM, Cloud EKM | Customer control of keys |
| Access Transparency | Logs of actions Google staff take on your content |
| Access Approval | Google staff must get your explicit approval before accessing content |
| Key Access Justifications | Reasons for key access requests to external keys, with the option to deny |
Commercial data: cards and PII
- PCI DSS scope: isolate cardholder data in dedicated projects or perimeters, tokenize card numbers, restrict and log access, and keep scope as small as possible.
- PII: discover it with Sensitive Data Protection, mask or tokenize it, apply row and column controls in BigQuery, redact it in virtual agent logs.
Industry certifications
Google Cloud holds certifications and reports such as ISO/IEC 27001, SOC 1/2/3 and PCI DSS for in-scope services. Customers download reports from the Compliance Reports Manager to support their own audits. The certification covers Google's part; the customer's own configuration still needs evidence.
Audits and logs
| Log | Contents | Default |
|---|---|---|
| Admin Activity audit logs | Configuration and metadata changes, who made them | Always on, cannot be disabled |
| Data Access audit logs | Reads and writes of user data | Off for most services; enable per service (BigQuery is on) |
| System Event logs | Google system actions | Always on |
| Policy Denied logs | Calls denied by security policies such as VPC Service Controls | On |
| Access Transparency logs | Google staff access | Enable at the organization |
Route logs with aggregated sinks to a central project, keep them in log buckets or Cloud Storage with retention locks when they must not be altered, and analyze them in Log Analytics or BigQuery.
Security Command Center Premium adds compliance reports that map findings (public buckets, open firewall rules) to standards such as CIS, PCI DSS and NIST.
How the exam asks about this
- "Auditors want evidence of who read patient records in FHIR stores." Enable Data Access audit logs for the Cloud Healthcare API.
- "Google support access only by EU personnel; resources only in the EU." An Assured Workloads folder with an EU control package.
- "Before Google staff access content, we must approve." Access Approval, with Access Transparency for the record.
What to remember for the exam
- Shared responsibility: Google certifies the platform; you configure and prove your part.
- Healthcare data only in services covered by the BAA.
- Residency: resource locations policy; sovereignty with support controls: Assured Workloads.
- Access Transparency records Google access; Access Approval gates it.
- Admin Activity logs are always on; Data Access logs must usually be enabled.
Data Access audit logs are off by default for most services. "Show who read the data" requires enabling them first.
Common mistakes
Assuming a certification covers your configuration. It covers Google's controls.
Locking regions with VPC Service Controls. Perimeters govern API access, not where resources are created.
Admin Activity logs to prove data reads. They record configuration changes, not reads.
Check yourself
Which logs record who read data in a service?
Data Access audit logs, which must be enabled for most services.
Which control requires your approval before Google staff access content?
Access Approval.
What combines EU locations with EU-based Google support access for a folder?
Assured Workloads with an EU control package.
Topic 5 of 5 in Designing for security and compliance
Test yourself on Designing for security and compliance
The full Google Cloud Professional Cloud Architect question bank has 877 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.