データ主権: データに対するサービス プロバイダによるアクセスを独立して制御するメカニズムを Google Cloud のお客様に提供し、お客様が適切かつ必要と見なす特定のプロバイダの行動に対してのみアクセスを承認します。
EU の主権管理のコントロール パッケージは、データ主権の重要な要素です。詳細については、EU の主権管理に関する制限事項をご覧ください。
属性に基づく担当者のデータアクセス制御: 物理的な場所でのサポートとバックグラウンド チェックの要件を満たす Google 担当者のみが、サポート業務を行う際に Google Cloud の顧客データにアクセスできるようにします。たとえば、影響レベル 4（IL4）では、データにアクセスするユーザーは、ADP-1 の単一スコープバックグラウンド調査（SSBI）を完了した US person であることが必要です。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-05-16 UTC。"],[[["\u003cp\u003eAssured Workloads allows Google Cloud users to apply specific controls to a folder to meet regulatory, regional, or sovereign requirements.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads helps users achieve compliance through controls like data residency, data sovereignty, and personnel data access controls, among others.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads includes data residency controls that ensure customer data is stored within a customer-selected Google Cloud region.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to only use Assured Workloads if your Google Cloud activities are actively subject to regulatory compliance, and to select only the control package that applies to your specific situation.\u003c/p\u003e\n"],["\u003cp\u003eTo use Assured Workloads, you must first create an organization after setting up Cloud Identity and verifying your domain, then you can proceed to create an Assured Workloads folder.\u003c/p\u003e\n"]]],[],null,["# Overview of Assured Workloads\n=============================\n\nAssured Workloads enables organizations in the private and public\nsectors to configure a sovereign data and access boundary with residency,\naccess, and personnel controls for sensitive workloads in the cloud. You can use\nAssured Workloads to simplify management and configuration of\nregulated workloads by [applying predefined control packages](#control-packages)\nto folders. Assured Workloads lets you run compliant workloads\nwhile maintaining the scale, cost, and service availability benefits of\ncommercial cloud infrastructure.\n\nUse cases for Assured Workloads\n-------------------------------\n\nUse Assured Workloads if your organization must ensure compliance\nwith specific regulatory, regional, or sovereignty requirements. For example,\nAssured Workloads lets the following organizations meet their\ncompliance obligations:\n\n- Organizations with strict regulations for data storage, key management, and access (such as financial services, healthcare, and governmental bodies).\n- Organizations that must store their data within certain regions or countries.\n- Organizations that must control Google Cloud personnel access to their data.\n\nAssured Workloads capabilities\n------------------------------\n\nAssured Workloads provides a variety of capabilities to help you\nmeet your compliance and regulatory requirements, including the following:\n\n- Regional data boundaries and regulatory data boundaries for compliance enforcement\n- Personnel data access controls\n- Encryption key management controls\n- Compliance updates\n- Monitoring for violations\n\nThe following sections describe these capabilities.\n\n### Control packages\n\nControl packages are the foundation for compliance enforcement for\nAssured Workloads. Assured Workloads control\npackages are available for the following control types: regional data\nboundaries, regulatory data boundaries, and\n[Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview).\nWhen you create an Assured Workloads folder for a specific\ncontrol package, the controls within the control package define guardrails for\nall projects and resources within the folder. These controls are enforced using\norganization policy constraints and other features.\n\nSupport for Google Cloud products and services varies by control package.\nFor more information, see\n[Supported products by control package](/assured-workloads/docs/supported-products).\n\n#### Regional data boundaries\n\nRegional data boundary control packages support data residency requirements by\nrestricting the geographic location where resources can be stored. Some data\nboundaries also let you exercise independent control over Google's access to\nyour data, such as by approving access only for specific provider behaviors that\nyou deem appropriate and necessary.\n\nThese data boundaries let you specify a Google Cloud region where your\ndata must reside and prevents data storage outside of that region. For example,\nif the EU Data Boundary control package is applied, data residency controls are\nimplemented to restrict resource usage to EU-only regions.\nAssured Workloads offers various\n[regional data boundaries](/assured-workloads/docs/control-packages#regional-data-boundaries)\nto enforce data residency restrictions and Google personnel support access\ncontrol.\n\nFor more information on Assured Workloads and data residency, see\n[Data residency](/assured-workloads/docs/data-residency).\n\n#### Regulatory data boundaries\n\nRegulatory data boundary control packages let you deploy a set of controls to\naddress a specific regulatory or compliance requirement. Google Cloud\nincludes regulatory data boundaries for the following:\n\n- [Criminal Justice Information Systems (CJIS)](/assured-workloads/docs/control-packages/cjis)\n- [FedRAMP Moderate and FedRAMP High](/security/compliance/fedramp)\n- [Healthcare and Life Sciences Controls (with or without US Support)](/assured-workloads/docs/control-packages/us-data-boundary-healthcare-life-sciences) for [Health Insurance Portability and Accountability Act (HIPAA)](/security/compliance/hipaa-compliance) and [Health Information Trust Alliance (HITRUST)](/security/compliance/hitrust)\n- [Impact Level 2 (IL2), Impact Level 4 (IL4), and Impact Level 5 (IL5)](/security/compliance/disa)\n- [International Traffic in Arms Regulations (ITAR)](/assured-workloads/docs/control-packages/itar)\n- [IRS Publication 1075](/assured-workloads/docs/control-packages/irs-1075)\n\nFor a complete list, see\n[Regulatory data boundaries](/assured-workloads/docs/control-packages#regulatory-data-boundaries).\n\n#### Sovereign Controls by Partners\n\nAssured Workloads also offers control packages that are operated and\nmanaged by partners through\n[Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview).\nSovereign Controls by Partners lets you use a local, trusted partner to\nmanage encryption keys, access justification, and audits. These control packages\nhelp enforce data residency and provide security configurations that encompass\ncritical aspects of cloud infrastructure, such as encryption and key management.\n\n### Control of Google personnel access to your data\n\nYou can control which Google personnel can access your data when fulfilling\nsupport tasks. Assured Support for Assured Workloads is an\nadditional Google Cloud Customer Care feature available with\n[Enhanced Support](/support/docs/enhanced#assured_support) or\n[Premium Support](/support/docs/premium#assured_support). When used, Google\nsupport personnel must adhere to certain geographical and personnel-based\nattributes requirements. Depending on the control package, personnel controls\nare implemented based on criteria such as their region or fulfilling certain\nbackground check requirements. For example, access controls that support FedRAMP\nHigh require all first-level and second-level Google support personnel and\n[subprocessors](/terms/subprocessors) to be located in the US and to meet\nenhanced background check requirements.\n\nFor more information on Assured Support for Assured Workloads,\nsee [Getting Support](/assured-workloads/docs/getting-support).\n\n### Key management\n\nDepending on the control package, various key management controls are available\nto support regulatory compliance. For example, the Data Boundary for ITAR\ncontrol package requires the use of\n[customer-managed encryption keys (CMEKs)](/kms/docs/cmek). To enable separation\nof duties, the Data Boundary for ITAR control package uses a key management\nproject that is separate from other deployed resources and creates a unique key\nring for storage within a compliance location.\nAssured Workloads also offers support for\nGoogle-owned and Google-managed encryption keys (FIPS-140-2 compliant), CMEKs,\n[Cloud External Key Manager (Cloud EKM)](/kms/docs/ekm), and\n[key import](/kms/docs/importing-a-key) for other control packages.\n\nFor more information on key management, see\n[Supporting compliance with key management](/assured-workloads/docs/key-management).\n\n### Workload updates\n\n[Workload updates](/assured-workloads/docs/apply-updates) lets you evaluate and\nmaintain control package configurations. As improvements are made to available\ncontrol packages, you can evaluate whether your deployed\nAssured Workloads folder configurations are the same as the most\nrecently available version. If a more recent configuration version is available,\nyou can apply updates to the Assured Workloads folder to upgrade\nto the latest version.\n\n### Violation monitoring\n\nAssured Workloads monitors for organization policy constraint\nviolations and resource violations to provide insights into compliance for a\ndeployed control package. You can enable email notifications for organization\npolicy violations or when a violation exception was added. These notifications\ninclude information about the Assured Workloads folder, audit\nlogs, and affected organization policies to enable informed review and\nremediation of the causes for non-compliance.\n\nFor more information on monitoring, see\n[Monitor an Assured Workloads folder for violations](/assured-workloads/docs/monitor-folder).\n\nServices for access control and visibility\n------------------------------------------\n\nThe following Google Cloud services provide options to control and provide\nvisibility into data access and encryption keys. You can use these services in\ncombination with Assured Workloads to help meet your\ncompliance-based needs.\n\nControl package renaming notice\n-------------------------------\n\nAssured Workloads uses *control packages* to refer to sets of controls\nthat support the baseline for a compliance framework, statute, or regulation.\nControl package names in the console and APIs have changed as of June 2025.\nThese new names are also reflected in the\n[`ComplianceRegime`](/assured-workloads/docs/reference/rest/Shared.Types/ComplianceRegime)\nenums that are used when creating a new workload using the\nAssured Workloads API. Only the names have changed; the underlying\nfunctionality has not changed.\n\nThe following table describes the new and previous for some of the control\npackages.\n\nWhat's next\n-----------\n\n- For information about pricing, see [Assured Workloads\n pricing](/assured-workloads/pricing).\n- See available [control packages](/assured-workloads/docs/control-packages) and [supported products](/assured-workloads/docs/supported-products).\n- To give Assured Workloads a try, sign up for the [free trial\n program](https://inthecloud.withgoogle.com/assured-workloads-60-day-trial-interest/sign-up.html).\n- Audit your Google Cloud environment with [Audit Manager](/audit-manager/docs/overview)."]]
