Last modified: February 24, 2022

Capitalized terms have the meaning stated in the applicable agreement between Customer and Google.

The following Services fall within the scope of one or more of: Google's ISO 27001 Certification, ISO 27017 Certification, ISO 27018 Certification, PCI DSS Certification, SOC 1 Report, SOC 2 Report and SOC 3 Report and Penetration Testing Report. A done in the table below indicates that the Service (row) is in scope for the specified certification or report (column).

Service	ISO 27001, 27017, 27018 Certifications	SOC 1, 2, 3 Reports	PCI DSS Certification	Penetration Testing
Access Approval	done	done	done	done
Access Context Manager	done	done	done	done
Access Transparency	done	done	done	done
AI Platform	done	done
AI Platform Data Labeling	done	done	done	done
AI Platform Notebooks	done	done	done	done
AI Platform Training and Prediction	done	done	done	done
Anthos Config Management	done	done	done	done
Anthos Service Mesh (ASM)	done	done	done
API Gateway	done	done	done
Apigee	done	done		done
App Engine	done	done	done	done
Artifact Registry	done	done	done
Assured Workloads for Government	done	done	done
AutoML Natural Language	done	done	done	done
AutoML Tables	done	done	done	done
AutoML Translation	done	done	done	done
AutoML Video	done	done	done	done
AutoML Vision	done	done	done	done
BeyondCorp Enterprise	done	done	done
BigQuery	done	done	done	done
BigQuery Data Transfer Service	done	done	done	done
BigQuery Omni
Binary Authorization	done	done	done	done
Certificate Authority Service	done	done	done	done
Cloud Asset Inventory	done	done	done	done
Cloud Bigtable	done	done	done	done
Cloud Billing	done	done	done	done
Cloud Build	done	done	done	done
Cloud CDN	done	done	done	done
Cloud Composer	done	done	done	done
Cloud console	done	done	done	done
Cloud console App	done	done	done
Cloud Data Fusion	done	done	done	done
Cloud Data Loss Prevention	done	done	done	done
Cloud Debugger	done	done	done	done
Cloud Deployment Manager	done	done	done	done
Cloud DNS	done	done	done	done
Cloud Endpoints	done	done	done	done
Cloud External Key Manager (Cloud EKM)	done	done	done	done
Cloud Filestore	done	done	done	done
Cloud Functions	done	done	done	done
Cloud Functions for Firebase	done	done	done	done
Cloud Healthcare	done	done	done	done
Cloud HSM	done	done	done	done
Cloud Interconnect	done	done	done	done
Cloud Key Management Service	done	done	done	done
Cloud Life Sciences (formerly Google Genomics)	done	done	done	done
Cloud Load Balancing	done	done	done	done
Cloud Logging	done	done	done	done
Cloud Monitoring	done	done	done	done
Cloud NAT (Network Address Translation)	done	done	done	done
Cloud Natural Language API	done	done	done	done
Cloud Profiler	done	done	done	done
Cloud Router	done	done	done	done
Cloud Run (fully managed)	done	done	done	done
Cloud Run for Anthos	done	done	done
Cloud Scheduler	done	done	done	done
Cloud Shell	done	done	done	done
Cloud Source Repositories	done	done	done	done
Cloud Spanner	done	done	done	done
Cloud SQL	done	done	done	done
Cloud Storage	done	done	done	done
Cloud Storage for Firebase	done	done	done	done
Cloud Tasks	done	done	done	done
Cloud Trace	done	done	done	done
Cloud Translation	done	done	done	done
Cloud Vision	done	done	done	done
Cloud VPN	done	done	done	done
Compute Engine	done	done	done	done
Connect	done	done	done	done
Container Registry	done	done	done	done
Data Catalog	done	done	done	done
Database Migration Service	done	done	done
Dataflow	done	done	done	done
Datalab	done	done	done	done
Dataproc	done	done	done	done
Datastore	done	done	done	done
Datastream	done	done	done
Dialogflow	done	done	done	done
Document AI	done	done	done	done
Firebase Authentication	done	done	done	done
Firebase Test Lab	done	done		done
Firestore	done	done	done	done
Game Servers	done	done	done	done
GCP Marketplace	done	done	done	done
Google Cloud Armor	done	done	done	done
Google Cloud CLI	done	done	done	done
Google Cloud Identity-Aware Proxy	done	done	done	done
Google Kubernetes Engine	done	done	done	done
Hub	done	done	done	done
Identity & Access Management (IAM)	done	done	done	done
Identity Platform	done	done	done	done
Insights	done(ISO 27001 only)	done
IoT Core	done	done	done	done
Key Access Justification (Access Sovereignty)	done	done	done
Managed Service for Microsoft Active Directory (AD)	done	done	done	done
Memorystore	done	done	done	done
Network Intelligence Center	done	done	done
Network Service Tiers	done	done	done	done
Persistent Disk	done	done	done	done
Pub/Sub	done	done	done	done
reCAPTCHA Enterprise	done	done	done
Resource Manager API	done	done	done	done
Risk Manager	done(ISO 27001 only)	done
Secret Manager	done	done	done	done
Security Command Center	done	done	done	done
Service Consumer Management	done	done	done	done
Service Control	done	done	done	done
Service Directory	done	done	done	done
Service Management	done	done	done	done
Speech-to-Text	done	done	done	done
Storage Transfer Service	done	done	done	done
Talent Solution	done	done	done	done
Text-to-Speech	done	done	done	done
Traffic Director	done	done	done	done
Transfer Appliance	done(ISO 27001 only)		done	done
Video Intelligence API	done	done	done	done
Virtual Private Cloud	done	done	done	done
VPC Service Controls	done	done	done	done

Google Workspace and/or Complementary Products in Scope by Compliance Program

Capitalized terms have the meaning stated in the applicable agreement between Customer and Google.

The following Google Workspace Services and/or Complementary Products fall within the scope of one or more of: Google's ISO 27001 Certification, ISO 27017 Certification, ISO 27018 Certification, SOC 1 Report, SOC 2 Report and SOC 3 Report and Penetration Testing Report. A done in the table below indicates that the Service (row) is in scope for the specified certification or report (column).

Service	ISO 27001, 27017, 27018 Certifications	SOC 1, 2, 3 Reports	Penetration Testing
Cloud Identity Management	done	done	done
Currents	done	done	done
Gmail	done	done	done
Google Calendar	done	done	done
Google Chat	done	done	done
Google Cloud Search	done	done	done
Google Contacts	done	done	done
Google Docs	done	done	done
Google Drive	done	done	done
Google Forms	done	done	done
Google Groups for Business	done	done	done
Google Hangouts	done	done	done
Google Jamboard	done	done	done
Google Keep	done	done	done
Google Meet	done	done	done
Google Sheets	done	done	done
Google Sites	done	done	done
Google Slides	done	done	done
Google Tasks	done	done	done
Google Vault	done	done	done
Google Voice	done	done	done
Google Workspace Migrate	done(ISO 27001 only)	done