Home

Published

- 5 min read

Audit Manager: Google Cloud New Controls Feature

By William OGOU
google cloud ai controls framework audit manager generative ai ai governance risk and compliance security command center nist ai GCP
img of Audit Manager: Google Cloud New Controls Feature

As organizations race to build generative AI applications and autonomous agents, security and risk management leaders face a daunting new frontier. The often-opaque nature of AI models, combined with their reliance on vast datasets and their potential for independent action, creates an urgent need for better governance, risk, and compliance (GRC) controls. Manual checklists and traditional audit processes simply cannot keep pace with the complexity and scale of modern AI workloads.

Questions that were once challenging are now critical:

  • How do we prove our AI systems operate in line with internal policies and evolving regulations?
  • How can we verify that data access controls are consistently enforced across the entire AI lifecycle?
  • What is the mechanism for demonstrating the integrity of our models and the sensitive data they handle?

To answer these questions, Google Cloud has launched a powerful, automated, and evidence-based solution: the Recommended AI Controls framework, available now as part of Audit Manager in Security Command Center.

audit-manager

The Challenge of Auditing a Modern AI Workload

A typical generative AI application is a complex ecosystem. It integrates AI-specific platforms like Vertex AI with a host of foundational services, including Cloud Storage for datasets, Identity and Access Management (IAM), Secret Manager, Cloud Logging, and VPC Networks. Securing and auditing this entire lifecycle, from development and training to runtime and large-scale production, requires a holistic approach.

Manual audits are slow, resource-intensive, and provide only a point-in-time snapshot, quickly becoming outdated. A new approach is needed to provide continuous assurance.

The Solution: Automated, Evidence-Based Auditing

Developed by Google Cloud Security experts and validated by the Office of the CISO, the Recommended AI Controls framework provides a direct path for organizations to assess, monitor, and audit the security and compliance posture of their generative AI workloads.

This prebuilt framework is based on industry best practices and leading standards, including the NIST AI Risk Management Framework and the Cyber Risk Institute (CRI) profile, giving you a clear and traceable directive for your audits.

How the Framework Helps Audit AI Workloads:

Audit Manager, powered by this new framework, transforms your audit process from manual checklists to automated, continuous assurance.

  • Establish a Security Baseline: The framework provides a robust baseline of controls specifically designed for auditing generative AI workloads.
  • Automate Evidence Collection: Audit Manager automatically collects evidence from relevant services (including Vertex AI, IAM, and Cloud Storage) against the defined controls. This drastically reduces manual audit preparation and ensures data is objective and current.
  • Assess Findings and Remediate Quickly: The audit report clearly highlights control violations and deviations from best practices. With direct links to the collected evidence, your teams can perform timely remediation before minor issues escalate into significant risks.
  • Enable Continuous Monitoring: Move beyond point-in-time snapshots. The framework allows you to schedule regular assessments, continuously monitoring your AI model usage, permissions, and configurations against best practices to maintain a strong, evidence-backed GRC posture over time.

A Look Inside the Framework: Examples of AI-Specific Controls

The framework’s high-level principles are backed by auditable, technical checks linked directly to your GCP services. Examples include:

Access Control:

  • Disable automatic IAM grants for default service accounts: Restricts default service accounts that often have excessive permissions.
  • Disable root access on new Vertex AI Workbench instances: Enforces a critical security constraint, preventing a common privilege escalation path.

Data Controls:

  • Enforce Customer-Managed Encryption Keys (CMEK): Ensures you retain ownership and control of the keys protecting your data at rest in Google Cloud.

System and Information Integrity:

  • Vulnerability Scanning: Leverages Google Cloud’s Artifact Analysis service to scan for vulnerabilities in images and packages within Artifact Registry.

Configuration Management:

  • Restrict Resource Service Usage: Ensures only customer-approved Google Cloud services are used in specific environments (e.g., production), preventing data exfiltration or use of unsanctioned services.

Get Started with AI Assurance Today

Security and compliance teams can immediately use this framework to automate their AI governance and assurance processes. You can access the Recommended AI Controls framework directly from your Google Cloud console:

  1. Navigate to the Compliance tab.
  2. Select Audit Manager.
  3. Choose the Google Recommended AI Controls framework from the library to begin your automated assessment.

By providing a scalable, evidence-based, and automated approach, this new framework empowers organizations to build and deploy generative AI with confidence, ensuring security and compliance are integral parts of the AI lifecycle, not an afterthought.

To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [email protected].

Google Cloud AI Controls Framework FAQ:

  • What is the Recommended AI Controls framework? It is a prebuilt framework within Google Cloud’s Audit Manager, designed to provide an automated, evidence-based way for organizations to assess, monitor, and audit the security and compliance posture of their generative AI workloads.
  • Why is this framework needed for AI workloads? AI workloads are complex, often opaque, and rely on vast datasets, making them difficult to audit with traditional manual checklists. This framework provides automated evidence collection and continuous monitoring to manage these modern governance, risk, and compliance (GRC) challenges.
  • What standards is the framework based on? It incorporates best practices from Google Cloud Security experts and is aligned with industry standards like the NIST AI Risk Management Framework and the Cyber Risk Institute (CRI) profile.
  • Who should use this framework? Security teams, risk management leaders, and compliance and audit professionals responsible for the governance of generative AI applications and agents built on or using Google Cloud.
  • Where can I access the Recommended AI Controls framework? You can access it directly within the Google Cloud console by navigating to the “Compliance” tab and selecting “Audit Manager.”

Relevant Resource List: