Question

A financial services company already runs several production projects in a Google Cloud organization. New regulations now require that a subset of these workloads meet a specific compliance regime with strict data residency and personnel access controls. The security team wants to bring these workloads under Assured Workloads with the least effort while ensuring compliance controls are actually enforced. What is the correct approach?

Accepted Answer

Create a new Assured Workloads folder for the required compliance regime and provision new projects within it, then migrate the regulated workloads into those projects.

Answer

Apply an organization policy constraint that restricts resource locations to the compliant regions on the existing projects, which retroactively converts them into Assured Workloads environments.

Answer

Enable the Assured Workloads API on each existing project so its current resources are automatically brought into scope for the compliance regime.

Answer

Move the existing projects unchanged into a standard folder and rely on Access Transparency logs to demonstrate compliance with the residency and personnel requirements.