Question

A financial services company must satisfy a regulator's requirement that any access to their data by the cloud provider's support and engineering staff be logged, justified, and subject to explicit customer approval before the access occurs. The compliance team also wants near-real-time visibility into these provider-initiated access events. Which combination of Google Cloud capabilities best satisfies this requirement?

Accepted Answer

Enable Access Transparency logs and configure Access Approval to require explicit customer approval for Google support access.

Answer

Enable Cloud Audit Logs (Admin Activity and Data Access) and rely on them to capture Google staff access.

Answer

Apply VPC Service Controls perimeters around all data resources and enable Access Context Manager policies.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud HSM so Google cannot access the data without customer keys.