Question

A financial services company must demonstrate to auditors that they have visibility into any actions Google Cloud support or engineering personnel take on their data, and that such access requires explicit organizational sign-off before it occurs. The compliance team has already enabled Access Transparency logs across the organization. During an audit rehearsal, they realize they cannot show evidence that Google personnel access was ever gated on their own approval. Which additional capability should they enable to meet the requirement that Google personnel access be explicitly authorized by the organization before it happens?

Accepted Answer

Access Approval, which requires the organization to grant explicit approval before Google personnel can access covered resources

Answer

Data Access audit logs, which record read and write operations performed on user data

Answer

Access Context Manager access levels that restrict console access to corporate IP ranges

Answer

Cloud Audit Logs Admin Activity logs, which capture configuration changes made by Google support