对 Google Cloud 产品和服务的支持因控制包而异。如需了解详情，请参阅按控制包查看支持的产品。
区域数据边界
区域数据边界控制软件包通过限制资源的存储地理位置来支持数据驻留要求。借助某些数据边界，您还可以独立控制 Google 对您数据的访问权限，例如仅在您认为必要且适当的情况下批准提供商访问您的数据。
借助这些数据边界，您可以指定 Google Cloud 数据必须驻留的区域，并防止数据存储在该区域之外。例如，如果应用了“欧盟数据边界”控制套件，系统会实现数据驻留控制措施，以将资源使用限制在仅限欧盟的区域。Assured Workloads 提供各种区域数据边界，以强制执行数据驻留限制和 Google 人员支持访问权限控制。
Assured Workloads 还提供由合作伙伴通过 Sovereign Controls by Partners 运营和管理的控制套件。借助“由合作伙伴提供的主权控制”，您可以使用本地可信合作伙伴来管理加密密钥、访问权限证明和审核。这些控制包有助于强制执行数据驻留，并提供涵盖云基础架构关键方面（例如加密和密钥管理）的安全配置。
控制 Google 人员对您数据的访问
您可以控制哪些 Google 人员可以在执行支持任务时访问您的数据。适用于 Assured Workloads 的安心支持服务是 Google Cloud Customer Care 的一项额外功能，需要搭配增强型支持服务或高级支持服务才能使用。使用此服务时，Google 支持人员必须遵守特定的地理位置和基于人员的属性要求。人员控制措施的实施依据取决于控制套件，例如人员所在的区域或是否满足特定的背景调查要求。例如，支持 FedRAMP High 的访问权限控制要求所有第一级和第二级 Google 支持人员和子处理方都位于美国境内，并且符合增强型背景调查要求。
借助 Access Approval，您可以控制 Google 员工对您数据的访问。贵组织中的授权客户管理员必须先批准请求，然后 Google 管理员才能获得访问权限。已获批准的访问权限请求会记录在与批准请求关联的 Access Transparency 日志中。请求获得批准后，必须先在 Google 中获得适当的权限，然后才能获得访问权限。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eAssured Workloads allows Google Cloud users to apply specific controls to a folder to meet regulatory, regional, or sovereign requirements.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads helps users achieve compliance through controls like data residency, data sovereignty, and personnel data access controls, among others.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads includes data residency controls that ensure customer data is stored within a customer-selected Google Cloud region.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to only use Assured Workloads if your Google Cloud activities are actively subject to regulatory compliance, and to select only the control package that applies to your specific situation.\u003c/p\u003e\n"],["\u003cp\u003eTo use Assured Workloads, you must first create an organization after setting up Cloud Identity and verifying your domain, then you can proceed to create an Assured Workloads folder.\u003c/p\u003e\n"]]],[],null,["# Overview of Assured Workloads\n=============================\n\nAssured Workloads enables organizations in the private and public\nsectors to configure a sovereign data and access boundary with residency,\naccess, and personnel controls for sensitive workloads in the cloud. You can use\nAssured Workloads to simplify management and configuration of\nregulated workloads by [applying predefined control packages](#control-packages)\nto folders. Assured Workloads lets you run compliant workloads\nwhile maintaining the scale, cost, and service availability benefits of\ncommercial cloud infrastructure.\n\nUse cases for Assured Workloads\n-------------------------------\n\nUse Assured Workloads if your organization must ensure compliance\nwith specific regulatory, regional, or sovereignty requirements. For example,\nAssured Workloads lets the following organizations meet their\ncompliance obligations:\n\n- Organizations with strict regulations for data storage, key management, and access (such as financial services, healthcare, and governmental bodies).\n- Organizations that must store their data within certain regions or countries.\n- Organizations that must control Google Cloud personnel access to their data.\n\nAssured Workloads capabilities\n------------------------------\n\nAssured Workloads provides a variety of capabilities to help you\nmeet your compliance and regulatory requirements, including the following:\n\n- Regional data boundaries and regulatory data boundaries for compliance enforcement\n- Personnel data access controls\n- Encryption key management controls\n- Compliance updates\n- Monitoring for violations\n\nThe following sections describe these capabilities.\n\n### Control packages\n\nControl packages are the foundation for compliance enforcement for\nAssured Workloads. Assured Workloads control\npackages are available for the following control types: regional data\nboundaries, regulatory data boundaries, and\n[Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview).\nWhen you create an Assured Workloads folder for a specific\ncontrol package, the controls within the control package define guardrails for\nall projects and resources within the folder. These controls are enforced using\norganization policy constraints and other features.\n\nSupport for Google Cloud products and services varies by control package.\nFor more information, see\n[Supported products by control package](/assured-workloads/docs/supported-products).\n\n#### Regional data boundaries\n\nRegional data boundary control packages support data residency requirements by\nrestricting the geographic location where resources can be stored. Some data\nboundaries also let you exercise independent control over Google's access to\nyour data, such as by approving access only for specific provider behaviors that\nyou deem appropriate and necessary.\n\nThese data boundaries let you specify a Google Cloud region where your\ndata must reside and prevents data storage outside of that region. For example,\nif the EU Data Boundary control package is applied, data residency controls are\nimplemented to restrict resource usage to EU-only regions.\nAssured Workloads offers various\n[regional data boundaries](/assured-workloads/docs/control-packages#regional-data-boundaries)\nto enforce data residency restrictions and Google personnel support access\ncontrol.\n\nFor more information on Assured Workloads and data residency, see\n[Data residency](/assured-workloads/docs/data-residency).\n\n#### Regulatory data boundaries\n\nRegulatory data boundary control packages let you deploy a set of controls to\naddress a specific regulatory or compliance requirement. Google Cloud\nincludes regulatory data boundaries for the following:\n\n- [Criminal Justice Information Systems (CJIS)](/assured-workloads/docs/control-packages/cjis)\n- [FedRAMP Moderate and FedRAMP High](/security/compliance/fedramp)\n- [Healthcare and Life Sciences Controls (with or without US Support)](/assured-workloads/docs/control-packages/us-data-boundary-healthcare-life-sciences) for [Health Insurance Portability and Accountability Act (HIPAA)](/security/compliance/hipaa-compliance) and [Health Information Trust Alliance (HITRUST)](/security/compliance/hitrust)\n- [Impact Level 2 (IL2), Impact Level 4 (IL4), and Impact Level 5 (IL5)](/security/compliance/disa)\n- [International Traffic in Arms Regulations (ITAR)](/assured-workloads/docs/control-packages/itar)\n- [IRS Publication 1075](/assured-workloads/docs/control-packages/irs-1075)\n\nFor a complete list, see\n[Regulatory data boundaries](/assured-workloads/docs/control-packages#regulatory-data-boundaries).\n\n#### Sovereign Controls by Partners\n\nAssured Workloads also offers control packages that are operated and\nmanaged by partners through\n[Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview).\nSovereign Controls by Partners lets you use a local, trusted partner to\nmanage encryption keys, access justification, and audits. These control packages\nhelp enforce data residency and provide security configurations that encompass\ncritical aspects of cloud infrastructure, such as encryption and key management.\n\n### Control of Google personnel access to your data\n\nYou can control which Google personnel can access your data when fulfilling\nsupport tasks. Assured Support for Assured Workloads is an\nadditional Google Cloud Customer Care feature available with\n[Enhanced Support](/support/docs/enhanced#assured_support) or\n[Premium Support](/support/docs/premium#assured_support). When used, Google\nsupport personnel must adhere to certain geographical and personnel-based\nattributes requirements. Depending on the control package, personnel controls\nare implemented based on criteria such as their region or fulfilling certain\nbackground check requirements. For example, access controls that support FedRAMP\nHigh require all first-level and second-level Google support personnel and\n[subprocessors](/terms/subprocessors) to be located in the US and to meet\nenhanced background check requirements.\n\nFor more information on Assured Support for Assured Workloads,\nsee [Getting Support](/assured-workloads/docs/getting-support).\n\n### Key management\n\nDepending on the control package, various key management controls are available\nto support regulatory compliance. For example, the Data Boundary for ITAR\ncontrol package requires the use of\n[customer-managed encryption keys (CMEKs)](/kms/docs/cmek). To enable separation\nof duties, the Data Boundary for ITAR control package uses a key management\nproject that is separate from other deployed resources and creates a unique key\nring for storage within a compliance location.\nAssured Workloads also offers support for\nGoogle-owned and Google-managed encryption keys (FIPS-140-2 compliant), CMEKs,\n[Cloud External Key Manager (Cloud EKM)](/kms/docs/ekm), and\n[key import](/kms/docs/importing-a-key) for other control packages.\n\nFor more information on key management, see\n[Supporting compliance with key management](/assured-workloads/docs/key-management).\n\n### Workload updates\n\n[Workload updates](/assured-workloads/docs/apply-updates) lets you evaluate and\nmaintain control package configurations. As improvements are made to available\ncontrol packages, you can evaluate whether your deployed\nAssured Workloads folder configurations are the same as the most\nrecently available version. If a more recent configuration version is available,\nyou can apply updates to the Assured Workloads folder to upgrade\nto the latest version.\n\n### Violation monitoring\n\nAssured Workloads monitors for organization policy constraint\nviolations and resource violations to provide insights into compliance for a\ndeployed control package. You can enable email notifications for organization\npolicy violations or when a violation exception was added. These notifications\ninclude information about the Assured Workloads folder, audit\nlogs, and affected organization policies to enable informed review and\nremediation of the causes for non-compliance.\n\nFor more information on monitoring, see\n[Monitor an Assured Workloads folder for violations](/assured-workloads/docs/monitor-folder).\n\nServices for access control and visibility\n------------------------------------------\n\nThe following Google Cloud services provide options to control and provide\nvisibility into data access and encryption keys. You can use these services in\ncombination with Assured Workloads to help meet your\ncompliance-based needs.\n\nControl package renaming notice\n-------------------------------\n\nAssured Workloads uses *control packages* to refer to sets of controls\nthat support the baseline for a compliance framework, statute, or regulation.\nControl package names in the console and APIs have changed as of June 2025.\nThese new names are also reflected in the\n[`ComplianceRegime`](/assured-workloads/docs/reference/rest/Shared.Types/ComplianceRegime)\nenums that are used when creating a new workload using the\nAssured Workloads API. Only the names have changed; the underlying\nfunctionality has not changed.\n\nThe following table describes the new and previous for some of the control\npackages.\n\nWhat's next\n-----------\n\n- For information about pricing, see [Assured Workloads\n pricing](/assured-workloads/pricing).\n- See available [control packages](/assured-workloads/docs/control-packages) and [supported products](/assured-workloads/docs/supported-products).\n- To give Assured Workloads a try, sign up for the [free trial\n program](https://inthecloud.withgoogle.com/assured-workloads-60-day-trial-interest/sign-up.html).\n- Audit your Google Cloud environment with [Audit Manager](/audit-manager/docs/overview)."]]
