Question

A financial services company must retain evidence that all read and write operations on customer data across every project in their Google Cloud organization are logged for a regulatory audit. The compliance team discovers that while Admin Activity logs are captured everywhere, Data Access logs are inconsistently enabled — some project owners enabled them, others did not. Auditors require a consistent, organization-wide guarantee going forward without relying on individual project owners. What is the most effective way to meet this requirement?

Accepted Answer

Set an organization-level IAM audit configuration (default audit config) that enables DATA_READ and DATA_WRITE log types, so all current and future projects inherit the setting.

Answer

Create an aggregated log sink at the organization level to export all logs to BigQuery, which will automatically enable Data Access logs.

Answer

Apply an organization policy constraint that forces Data Access logging on for all services in every project.

Answer

Ask each project owner to enable Data Access logs manually and monitor compliance with a scheduled Cloud Function.