Question

A U.S. federal contractor must run a new workload on Google Cloud under FedRAMP Moderate authorization. During planning, an engineer proposes using an Assured Workloads folder configured for the FedRAMP Moderate control package. A developer asks to deploy a Google Cloud service that is NOT on the list of products supported by that Assured Workloads compliance regime. What is the correct guidance for maintaining compliance within the Assured Workloads folder?

Accepted Answer

Only services in the Assured Workloads supported-products list for FedRAMP Moderate may be used in the folder; using an unsupported service risks violating the compliance controls and should be avoided or flagged by the org policy restrictions Assured Workloads applies.

Answer

Assured Workloads will automatically bring the unsupported service into scope, so it can be used freely once deployed inside the folder.

Answer

Enable Access Transparency on the project, which retroactively certifies any service for FedRAMP Moderate.

Answer

Grant the developer a custom IAM role scoped to the unsupported service, which satisfies FedRAMP Moderate personnel controls.