Question

A financial services company stores sensitive customer records in BigQuery and Cloud Storage. A recent risk assessment found that although IAM permissions are tightly scoped, an insider with legitimate read access could copy data to a personal Google Cloud project or exfiltrate it to an external service. Leadership wants to guarantee that data cannot leave the organization's approved projects, even when accessed by users who hold valid IAM roles. Which control best addresses this requirement?

Accepted Answer

Configure VPC Service Controls to place the BigQuery and Cloud Storage projects inside a service perimeter that blocks data movement to resources outside the perimeter.

Answer

Enable customer-managed encryption keys (CMEK) on all BigQuery datasets and Cloud Storage buckets so exported data remains encrypted.

Answer

Apply an organization policy that restricts service account key creation and enforces uniform bucket-level access.

Answer

Enable Data Access audit logs and configure alerts in Cloud Logging when large read operations occur on the datasets.