Question

A financial services company must provide external auditors with Google's third-party attestation documents (SOC 2 Type II, ISO 27001, PCI DSS) to demonstrate that the underlying cloud infrastructure meets shared-responsibility control requirements. The compliance team needs a self-service way to obtain these certifications and audit reports directly from Google Cloud without opening a support case. Which approach should they use?

Accepted Answer

Download the certifications and audit reports from Compliance Reports Manager in the Google Cloud console.

Answer

Enable Access Transparency logs and export them to the auditors as evidence of Google's control operation.

Answer

Create an Assured Workloads environment and reference its control package as the attestation document.

Answer

Query Cloud Audit Logs Admin Activity entries to generate a SOC 2 report for the auditors.