GCP Compliance Guide: SOC, ISO, FedRAMP, HIPAA (2026)

A complete walkthrough of GCP compliance coverage. We cover the major regulations — HIPAA, FedRAMP, PCI DSS, ISO, GDPR, Japan's 3-Ministry-2-Guideline — and how Assured Workloads automates them.

Major Certifications at a Glance

Category	Certification / Regulation
General security	ISO 27001 / 27017 / 27018 / 27701, SOC 2 / 3
BCP	ISO 22301
Quality	ISO 9001
Financial	PCI DSS Level 1
US government	FedRAMP High / Moderate, IL2 / IL4 / IL5, ITAR
Healthcare	HIPAA BAA, HITRUST CSF
Europe	GDPR, EU Cloud Code of Conduct, C5 (Germany)
Japan	FISC, 3-Ministry-2-Guideline, ISMAP
Other country-specific	HITRUST (US), PIPEDA (Canada), APRA CPS 234 (Australia)

Assured Workloads

A folder-level feature that delivers regulatory compliance in a single click. Allowed services, regions, Access Transparency, CMEK, and more are applied automatically.

Regime	Scope
FedRAMP High	US government (sensitive)
FedRAMP Moderate	US government (general)
CJIS	US law enforcement
IL2 / IL4 / IL5	US Department of Defense
HIPAA	Healthcare
HITRUST	Healthcare security
ITAR	US export controls
Canada Public Sector	Canadian government
EU Sovereign Controls	EU sovereignty
EU Regions and Support with Sovereignty Controls	EU regulations

Example HIPAA-Compliant Configuration

Sign the BAA via Google Workspace
Create a folder with Assured Workloads for HIPAA
Use only allowed services (Cloud Healthcare API, GCE, GCS, BQ, etc.)
Apply CMEK to all PHI data
Enable all Cloud Audit Logs and export to BQ (6-year retention)
Enable Access Transparency and Access Approvals
Prevent exfiltration with VPC Service Controls
Detect and mask PHI with Sensitive Data Protection

FedRAMP Coverage (US Federal)

FedRAMP High Authorization (Compute, GKE, Storage, BigQuery, etc.)
FedRAMP Moderate covers an even wider scope
Dedicated GovCloud regions (us-central-fedramp, etc.)
Automated via Assured Workloads for US Government

Japan-Specific: 3-Ministry-2-Guideline

Two guidelines from Japan's Ministry of Internal Affairs and Communications, Ministry of Economy, Trade and Industry, and Ministry of Health, Labour and Welfare that govern handling of medical information (the 3-Ministry-2-Guideline framework).

Keep everything in asia-northeast1 (Tokyo) with asia-northeast2 (Osaka) for DR
Cloud Healthcare API + CMEK
Enable all Cloud Audit Logs
Access Transparency for support-access visibility
PHI detection with Sensitive Data Protection
VPC Service Controls

ISMAP (Japanese Government Information Systems)

Japan's government cloud-usage standard (Information System Security Management and Assessment Program)
GCP is a registered ISMAP cloud service
Typically combined with asia-northeast1 / 2 regions and a Japanese SI partner

EU GDPR / Data Sovereignty

Keep data entirely within EU regions (europe-west1, etc.)
Data Residency Controls (Organization Policy)
Sovereign Cloud partners

T-Systems Sovereign Cloud (Germany)
S3NS Sovereign Cloud (France, Thales + Google)

EU GDPR Data Processing Addendum (DPA) provided

Access Transparency / Approvals

Access Transparency: Logs data access by Google Support / SRE to the Audit Log
Access Approvals: No access without prior customer approval
Key Access Justifications: Approval is required even for KMS key usage
Essential for accountability in regulated industries

Shared Responsibility Model

Item	Google	Customer
Physical security	Yes	—
Hardware	Yes	—
Network infrastructure	Yes	VPC / Firewall design
Hypervisor	Yes	—
OS	Managed only	Customer for GCE
Application	—	Yes
Data	—	Yes
IAM configuration	—	Yes

Compliance Information Sources

Compliance Reports Manager: download certification report PDFs from the GCP console
Trust Center (cloud.google.com/security/compliance)
Compliance Resource Center for regulation-specific details

Does GCP sign a HIPAA BAA?

Yes. Major services including Cloud Healthcare API, Compute Engine, Cloud Storage, BigQuery, and Vertex AI are covered under HIPAA BAA. Sign the BAA via Google Workspace before use.

Does GCP support FedRAMP?

Yes — FedRAMP High (Compute, Storage, BigQuery, etc.) and Moderate are both supported. Assured Workloads for US Government makes it easy to build a compliant environment.

What about EU GDPR and data sovereignty?

Sovereign Cloud (T-Systems / S3NS) handles sovereignty requirements for France and Germany. You can also stay entirely within EU regions and enforce Data Residency Controls.

What about PCI DSS Level 1?

The GCP infrastructure is certified to PCI DSS Level 1. Under the shared responsibility model, certifying your own customer-facing application against PCI DSS is a separate effort.

Which ISO certifications does GCP hold?

Many — ISO 27001, 27017 (cloud-specific), 27018 (PII), 27701 (privacy information management), 22301 (BCP), 9001, and more.

What is Assured Workloads?

A folder-level feature that delivers regulatory compliance (HIPAA, FedRAMP, IL5, EU Regions, etc.) in a single click. Allowed services, regions, and access policies are applied automatically.

What about Access Transparency and Customer Lockbox?

Access Transparency logs every time Google Support accesses customer data. Access Approvals lets you require prior approval. Both are essential for accountability in regulated industries.

What about Japan's medical information guidelines?

GCP supports Japan's 3-Ministry-2-Guideline framework (Guidelines for Safety Management of Medical Information Systems). The standard configuration is Healthcare API + asia-northeast1 + CMEK + Access Transparency.

Check what you learned with practice questions

Practice with certification-focused question sets

Visit the GCP exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

GCP Compliance Complete Guide: HIPAA, FedRAMP, ISO, PCI DSS, Japan 3-Ministry-2-Guideline