Question

A healthcare organization runs regulated workloads in an Assured Workloads folder configured for a US-based compliance regime. During a routine audit, the compliance team must demonstrate to regulators that Google support and engineering personnel cannot access customer content without a documented business justification, and that any such access is logged with a reason code. Which capability should the team point to as evidence of this control?

Accepted Answer

Access Transparency logs combined with Access Approval, which record and gate Google personnel access with justification reason codes

Answer

Key Access Justifications (KAJ), which requires an approved justification reason before Google can use a CMEK key to decrypt data

Answer

Cloud Audit Logs Admin Activity entries, which capture all administrative API calls made by customer identities

Answer

VPC Service Controls perimeters, which prevent data exfiltration by blocking API access from outside the perimeter