CARVIEW |
Google Cloud compliance
As part of your migration to the cloud, you may need to validate our compliance documentation, certifications, and controls. Google Cloud creates and shares mappings of our industry-leading security, privacy, and compliance controls to standards from around the world. We also regularly undergo independent verification—achieving certifications, attestations, and audit reports to help demonstrate compliance.
AI trust paper
Customers interested in Google Cloud’s approach to AI can reference Google Cloud’s Approach to Trust in Artificial Intelligence for a view into our security, privacy, governance, and responsible AI posture.
Compliance offerings by region
Compliance offerings by industry
Industry spotlight: telecommunications
Expert insights into an industry with a significant history and diverse regulatory landscape. Explore our regional compliance papers on the telecommunications industry.
United States: Regulatory themes in the telecommunications industry
Europe: Insights into telecom regulations
Middle East: Insights into telecom regulations
Latin America: Telecoms regulatory themes
India: Regulatory themes in the telecommunications industry
Compliance offerings by category
Auditor-validated certifications and attestations
An independent third-party auditor has granted a formal certification, attestation, or audit report based on an assessment that affirms our compliance with these offerings.
Global
Cloud Computing Compliance Controls Catalog (C5) | CSA | GSMA SAS-SM | Higher Education Cloud Vendor Assessment Tool (HECVAT) | ISO 9001:2015 | ISO 22301:2019 & BS EN ISO 22301:2019 | ISO 50001:2018 | ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3 | SWIFT on Google Cloud | Uptime Institute's Tier Standards | VPAT (WCAG, U.S. Section 508, EN 301 549)
The Americas
FedRAMP | FIPS 140-2 Validated | HITRUST CSF | Independent Security Evaluators (ISE) Audit | Minimum Acceptable Risk Standards for Exchanges (MARS-E) | Protected B (Canada) | StateRAMP | TruSight | U.S. Cybersecurity Maturity Model Certification (CMMC) | U.S. Defense Information Systems Agency Provisional Authorization
EMEA
Spain Esquema Nacional de Seguridad (ENS) | EU Cloud Code of Conduct | HDS | ISAE 3000 Type 2 Report (FINMA) | ISO 14001 | Microfin | NCSC - Cyber Essentials Plus (UK) | Police Assured Secure Facilities (PASF) | Qatar National Information Assurance (NIA) | SWIPO Data Portability Code of Conduct | TISAX
Asia Pacific
Australia Hosting Certification Framework (HCF) | Cloud Security Assurance Program (CSAP) "Low Level" for Group C | Information System Security Management and Assessment Program (ISMAP) | IRAP (Information Security Registered Assessors Program) | JIIMA | K-ISMS (Korea) | MTCS (Singapore) Tier 3 | OSPAR | SNI 27001 | ETDA (Thailand)
Laws and regulations
Cloud service providers can’t provide formal certification of our customers compliance with these laws and regulations. To help support our customers, we review these laws and regulations and where possible provide guidance documents, mappings, and papers that outline our technical capabilities and legal commitments.
Global and North America
GxP | California Consumer Privacy Act (CCPA) | COPPA (U.S.) | Export Administration Regulations (EAR) | FERPA (U.S.) | FINRA (US) | Google Cloud Data Processing Addendum Mapping - U.S. State Privacy Laws | HIPAA | IRS 1075 | International Traffic in Arms Regulations (ITAR) | GLBA | OSFI (Canada) | FG16/5 - FCA | NERC CIP | PHIPA (Canada) | StateRAMP | PIPEDA (Canada) | Québec (Canada) Law 25 / la Loi 25 | US Federal Banking Agencies | U.S. Defense Federal Acquisition Regulation Supplement (DFARS)
EMEA
ACPR (France) | BaFin Cloud Outsourcing Guidance | Banco de España | Banco de Portugal | Bank of Italy | BRSA (Turkey) | BSI Critical Infrastructure (KRITIS) |BWG (Austria) | Central Bank of Ireland (Ireland) | CSSF (Luxembourg) | De Nederlandsche Bank (the Netherlands) | EU AI Act | EU DORA | European Union’s Digital Markets Act | EU Solvency II | EU Standard Contractual Clauses | FINMA (Switzerland) | FSA (Denmark) | GDPR | Google Cloud & the EU Network and Information Systems Directive (NIS2) | ISO 14001 | Israel’s Privacy Protection Authority | KNF (Poland) | MaRisk AT 9 Outsourcing | PRA (UK) | revFADP (Switzerland) | South Africa POPI | SFSA (Sweden) | Telecoms Security Act (UK) | VAG (Austria)| SYSC 8 Outsourcing - FCA Handbook | UK CHECK
Latin America
PDPL (Argentina) | BCRA (Argentina) | Central Bank of Brazil (Brazil) | CNBV (Mexico) | CNSF (Mexico) | CMF (Chile) | Superintendencia de Banca (Peru) | Financial Superintendence of Colombia | Lei Geral de Proteção de Dados (LGPD) | ASFI (Bolivia)
Asia Pacific
Act on the Protection of Personal Information (Japan) | APRA Prudential Standard CPS 234 | APPs (Australia) | APRA (Australia) | Bank Negara (Malaysia) | Bank of Thailand (BOT) | BI Regulation | BSP (Philippines) | DSA (Bangladesh) | FSC Insurance Outsourcing Directions | FSC Banking Outsourcing Regulations | GR 95/2018 guidelines | IA (Hong Kong) | HKMA (Hong Kong) | MAMPU (Malaysia) | PDPO (Hong Kong) | Indonesia Government Regulation No. 71 (GR 71) | IRDAI (India) | FSC (Korea) | Korean Financial Supervisory Service (FSS) | MAS TRM Guidelines | OIC (Thailand) | OJK Regulation | PDP Law (Indonesia) | PDPA (Malaysia) | PDPA (Philippines) | PDPA (Taiwan) | PDPA (Thailand) | PDPD (Vietnam) | PIPA (Korea) | RBI (India) | Reserve Bank of New Zealand (New Zealand) | Securities and Exchange Board of India (SEBI) | PDPA (Singapore) | State Bank of Vietnam | The Privacy Act (New Zealand)
Alignments and frameworks
Our products, technical capabilities, guidance documents, and legal commitments help our customers map to these frameworks and alignments. These offerings may not require formal certification or attestation, though we may rely on our certifications, attestations, and reports to help our customers map to these frameworks and alignments.
Global
Bitsight | Center for Internet Security (CIS) Benchmarks | CyberGRX | ISO/IEC 27110 | Know Your Third Party (KY3P) Report | MVSP | ProcessUnity Global Risk Exchange | Standardized Information Gathering (SIG) Questionnaire | USDM Life Sciences | Whistic
EMEA
EBA (EU) | European Cloud User Coalition (ECUC) | EIOPA (EU) | NCSC - Cloud Security (UK) | NEN (Netherlands) | NHS (UK) | PiTuKri | Qualifying license (Kingdom of Saudi Arabia)
North America
Criminal Justice Information Services (CJIS) | FFIEC (US) | MPA | NIST 800-53 | NIST 800-171 | NIST 800-34 - Contingency Planning | StateRAMP | US Federal Banking Agencies
Asia Pacific
ABS (Singapore) | PMDA (Japan) | FISC (Japan) | MeitY (India) | Monetary Authority of Singapore (MAS) Guidelines | NISC (Japan) | 2G3M (Japan)
Take the next step
Tell us what you’re solving for. A Google Cloud expert will help you find the best solution.
Learn security best practices
See our best practicesSolve common problems
Watch security use-case videosWork with a partner
See our security partners
- Accelerate your digital transformation
- Whether your business is early in its journey or well on its way to digital transformation, Google Cloud can help solve your toughest challenges.
- Key benefits
- Featured Products
- AI and Machine Learning
- Business Intelligence
- Compute
- Containers
- Data Analytics
- Databases
- Developer Tools
- Distributed Cloud
- Hybrid and Multicloud
- Industry Specific
- Integration Services
- Management Tools
- Maps and Geospatial
- Media Services
- Migration
- Mixed Reality
- Networking
- Operations
- Productivity and Collaboration
- Security and Identity
- Serverless
- Storage
- Web3
- Featured Products
- Not seeing what you're looking for?
- See all products (100+)
- Not seeing what you're looking for?
- See all AI and machine learning products
- Business Intelligence
- Not seeing what you're looking for?
- See all compute products
- Not seeing what you're looking for?
- See all data analytics products
- Not seeing what you're looking for?
- See all developer tools
- Hybrid and Multicloud
- Industry Specific
- Not seeing what you're looking for?
- See all management tools
- Media Services
- Not seeing what you're looking for?
- See all networking products
- Productivity and Collaboration
- Not seeing what you're looking for?
- See all security and identity products
- Save money with our transparent approach to pricing
- Google Cloud's pay-as-you-go pricing offers automatic savings based on monthly usage and discounted rates for prepaid resources. Contact us today to get a quote.
- Pricing overview and tools
- Learn & build
- Connect
- Accelerate your digital transformation
- Learn more
- Key benefits
- Why Google Cloud
- AI and ML
- Multicloud
- Global infrastructure
- Data Cloud
- Modern Infrastructure Cloud
- Security
- Productivity and collaboration
- Reports and insights
- Executive insights
- Analyst reports
- Whitepapers
- Customer stories
- Industry Solutions
- Retail
- Consumer Packaged Goods
- Financial Services
- Healthcare and Life Sciences
- Media and Entertainment
- Telecommunications
- Games
- Manufacturing
- Supply Chain and Logistics
- Government
- Education
- See all industry solutions
- See all solutions
- Application Modernization
- CAMP
- Modernize Traditional Applications
- Migrate from PaaS: Cloud Foundry, Openshift
- Migrate from Mainframe
- Modernize Software Delivery
- DevOps Best Practices
- SRE Principles
- Platform Engineering
- Run Applications at the Edge
- Architect for Multicloud
- Go Serverless
- Artificial Intelligence
- Customer Engagement Suite with Google AI
- Document AI
- Vertex AI Search for commerce
- Google Cloud with Gemini
- Generative AI on Google Cloud
- APIs and Applications
- New Business Channels Using APIs
- Unlocking Legacy Applications Using APIs
- Open Banking APIx
- Data Analytics
- Data Migration
- Data Lakehouse
- Real-time Analytics
- Marketing Analytics
- Datasets
- Business Intelligence
- AI for Data Analytics
- Geospatial Analytics
- Databases
- Database Migration
- Database Modernization
- Databases for Games
- Google Cloud Databases
- Migrate Oracle workloads to Google Cloud
- Open Source Databases
- SQL Server on Google Cloud
- Gemini for Databases
- Infrastructure Modernization
- Application Migration
- SAP on Google Cloud
- High Performance Computing
- Windows on Google Cloud
- Data Center Migration
- Active Assist
- Virtual Desktops
- Rapid Migration and Modernization Program
- Backup and Disaster Recovery
- Red Hat on Google Cloud
- Cross-Cloud Network
- Observability
- Productivity and Collaboration
- Google Workspace
- Google Workspace Essentials
- Cloud Identity
- Chrome Enterprise
- Security
- Agentic SOC
- Web App and API Protection
- Security and Resilience Framework
- Risk and compliance as code (RCaC)
- Software Supply Chain Security
- Security Foundation
- Google Cloud Cybershield™
- Startups and SMB
- Startup Program
- Small and Medium Business
- Software as a Service
- Featured Products
- Compute Engine
- Cloud Storage
- BigQuery
- Cloud Run
- Google Kubernetes Engine
- Vertex AI
- Looker
- Apigee API Management
- Cloud SQL
- Gemini
- Cloud CDN
- See all products (100+)
- AI and Machine Learning
- Vertex AI Platform
- Vertex AI Studio
- Vertex AI Agent Builder
- Conversational Agents
- Vertex AI Search
- Speech-to-Text
- Text-to-Speech
- Translation AI
- Google Agentspace
- Vision AI
- Contact Center as a Service
- See all AI and machine learning products
- Business Intelligence
- Looker
- Looker Studio
- Compute
- Compute Engine
- App Engine
- Cloud GPUs
- Migrate to Virtual Machines
- Spot VMs
- Batch
- Sole-Tenant Nodes
- Bare Metal
- Recommender
- VMware Engine
- Cloud Run
- See all compute products
- Containers
- Google Kubernetes Engine
- Cloud Run
- Cloud Build
- Artifact Registry
- Cloud Code
- Cloud Deploy
- Migrate to Containers
- Deep Learning Containers
- Knative
- Data Analytics
- BigQuery
- Looker
- Dataflow
- Pub/Sub
- Dataproc
- Google Cloud Serverless for Apache Spark
- Cloud Composer
- BigLake
- Dataplex Universal Catalog
- BigQuery Migration Services
- Managed Service for Apache Kafka
- See all data analytics products
- Databases
- AlloyDB for PostgreSQL
- Cloud SQL
- Firestore
- Spanner
- Bigtable
- Datastream
- Database Migration Service
- Bare Metal Solution
- Memorystore
- Developer Tools
- Artifact Registry
- Cloud Code
- Cloud Build
- Cloud Deploy
- Cloud Deployment Manager
- Cloud SDK
- Cloud Scheduler
- Cloud Source Repositories
- Infrastructure Manager
- Cloud Workstations
- Gemini Code Assist
- See all developer tools
- Distributed Cloud
- Google Distributed Cloud Connected
- Google Distributed Cloud Air-gapped
- Hybrid and Multicloud
- Google Kubernetes Engine
- Apigee API Management
- Migrate to Containers
- Cloud Build
- Observability
- Cloud Service Mesh
- Google Distributed Cloud
- Industry Specific
- Anti Money Laundering AI
- Cloud Healthcare API
- Device Connect for Fitbit
- Telecom Network Automation
- Telecom Data Fabric
- Telecom Subscriber Insights
- Spectrum Access System (SAS)
- Integration Services
- Application Integration
- Workflows
- Apigee API Management
- Cloud Tasks
- Cloud Scheduler
- Dataproc
- Cloud Data Fusion
- Cloud Composer
- Pub/Sub
- Eventarc
- Management Tools
- Cloud Shell
- Cloud console
- Cloud Endpoints
- Cloud IAM
- Cloud APIs
- Service Catalog
- Cost Management
- Observability
- Carbon Footprint
- Config Connector
- Active Assist
- See all management tools
- Maps and Geospatial
- Earth Engine
- Google Maps Platform
- Media Services
- Cloud CDN
- Live Stream API
- OpenCue
- Transcoder API
- Video Stitcher API
- Migration
- Migration Center
- Application Migration
- Migrate to Virtual Machines
- Cloud Foundation Toolkit
- Database Migration Service
- Migrate to Containers
- BigQuery Migration Services
- Rapid Migration and Modernization Program
- Transfer Appliance
- Storage Transfer Service
- VMware Engine
- Mixed Reality
- Immersive Stream for XR
- Networking
- Cloud Armor
- Cloud CDN and Media CDN
- Cloud DNS
- Cloud Load Balancing
- Cloud NAT
- Cloud Connectivity
- Network Connectivity Center
- Network Intelligence Center
- Network Service Tiers
- Virtual Private Cloud
- Private Service Connect
- See all networking products
- Operations
- Cloud Logging
- Cloud Monitoring
- Error Reporting
- Managed Service for Prometheus
- Cloud Trace
- Cloud Profiler
- Cloud Quotas
- Productivity and Collaboration
- AppSheet
- Google Agentspace
- Google Workspace
- Google Workspace Essentials
- Cloud Identity
- Chrome Enterprise
- Security and Identity
- Cloud IAM
- Sensitive Data Protection
- Mandiant Managed Defense
- Google Threat Intelligence
- Security Command Center
- Cloud Key Management
- Mandiant Incident Response
- Chrome Enterprise Premium
- Assured Workloads
- Google Security Operations
- Mandiant Consulting
- See all security and identity products
- Serverless
- Cloud Run
- Cloud Functions
- App Engine
- Workflows
- API Gateway
- Storage
- Cloud Storage
- Block Storage
- Filestore
- Persistent Disk
- Cloud Storage for Firebase
- Local SSD
- Storage Transfer Service
- Google Cloud Managed Lustre
- Google Cloud NetApp Volumes
- Backup and DR Service
- Web3
- Blockchain Node Engine
- Blockchain RPC
- Save money with our transparent approach to pricing
- Request a quote
- Pricing overview and tools
- Google Cloud pricing
- Pricing calculator
- Google Cloud free tier
- Cost optimization framework
- Cost management tools
- Product-specific Pricing
- Compute Engine
- Cloud SQL
- Google Kubernetes Engine
- Cloud Storage
- BigQuery
- See full price list with 100+ products
- Learn & build
- Google Cloud Free Program
- Solution Generator
- Quickstarts
- Blog
- Learning Hub
- Google Cloud certification
- Cloud computing basics
- Cloud Architecture Center
- Connect
- Innovators
- Developer Center
- Events and webinars
- Google Cloud Community
- Consulting and Partners
- Google Cloud Consulting
- Google Cloud Marketplace
- Find a partner
- Google Cloud partners