Question

A US-based defense contractor is migrating a workload to Google Cloud that must comply with FedRAMP High and IL4 requirements. The security team mandates that the environment enforce data residency in US regions, restrict Google support personnel to US persons, and continuously monitor for configuration drift away from the compliance baseline. They want a Google-managed solution that packages these controls rather than assembling individual org policies and IAM constraints manually. Which approach best meets these requirements?

Accepted Answer

Deploy the workload into an Assured Workloads environment configured for the FedRAMP High / IL4 compliance regime

Answer

Create a folder and apply org policy constraints for resource location, plus custom monitoring scripts to detect drift

Answer

Enable VPC Service Controls perimeters around all projects and rely on Access Transparency logs for support personnel tracking

Answer

Purchase a dedicated Cloud Interconnect and host the workload in a Sovereign Controls partner region