RANI URBAS: Hi, everyone.
Welcome to the session on Google Trust.
We are part of the Google Cloud Trust Team,
and we work closely with our customers
to ensure that you can confidently use our products
and our technologies from a trust perspective.
Specifically, today will focus on privacy, security,
and compliance--
both industry best practices and regulatory mandates--
data integrity, operational transparency and user control.
In this session, we'll walk you through how
our Trust Team engages with customers to achieve this.
We have a very simple agenda for you today.
The introduction is really focused on trust in the Cloud
and how that manifests in everything that we do.
We'll then delve into the three C's.
And you're probably wondering what the three C's are.
Without giving too much away, we hope that we've
piqued your curiosity.
And then we'll wrap by sharing some resources
on where you can find more information about Google Cloud
compliance, privacy and security.
By way of introduction, my name is Rani Urbas.
I lead the Enterprise Trust team at Google Cloud.
And as a team, we're responsible for helping our Enterprise
customers in highly regulated industries
with their compliance and privacy and trust
related assessments and implementations.
We work closely with our customers globally.
And additionally, we assist with customer-led audits,
regulator audits--
which includes data center audits.
I am here with my colleague Ruchi Khurana.
And Ruchi leads the Google [INAUDIBLE] Security Risk
program.
And this program is focused on ensuring the ongoing privacy
and security of our customer data.
She collaborates with many of our highly regulated Cloud
Enterprise customers on engagements
related to trust security, audit and compliance.
As I mentioned, I am part of the Trust team at Google,
and our house is built on four pillars.
The first pillar is around protection.
Data security is the foremost in everything that we do.
It is part of our DNA.
You've already heard, probably, about our layers
of security controls.
Our firewall, VPSC-- our Virtual Private Cloud Service
Controls--
Cloud Armor, IAM--
Identity and Access Management-- with policy intelligence.
And now, the Cloud Security Command Center
Premium, with security health analytics
to help with compliance and misconfiguration detection.
We've delivered additional security functionality
with reCAPTCHA, Enterprise, and Web
Risk, where we prevent ad attacks, fake account creation,
fraud, malware, phishing--
all that could impact our customers
and our customers' end uses.
Our second pillar, really, is around transparency.
The road to trust has to be built through transparency.
And that transparency has to be based on accurate and on-demand
information.
And we have built and delivered features to our customers like
access transparency, access approvals,
third-party key management specifically for that reason--
products that enforce customer control.
Which leads us to our third point--
control.
We live by the principle that our customers own their data,
we don't.
You can access it, take it out at any time.
We have built and equipped our customers
with tools and technology to manage access and protect
their data.
And last, but not least, is Enterprise compliance.
We've built world-class capabilities
to enable and facilitate our customers'
compliance with a vast range of regulatory bodies
around the world.
We invest in achieving and maintaining
our regulatory certifications and attestations
for all of our products across all of our data centers
globally.
So for the purpose of today's presentation,
we'll be looking at trust through the lens
of our Enterprise customer engagements.
And for ease of discussion, let's talk about it from,
one, a compliance perspective.
two, a commitment perspective.
And 3, the collaboration angle.
Starting with compliance, our customer-centric approach
to compliance has really enabled us to view compliance
with a much wider perspective.
So if you look at the pyramid in front of you,
compliance of Google Cloud.
We deliver foundational certifications, as well as
industry-specific certifications,
that addresses multiple industry segments,
such as public sector, health care, financial services--
to name a few.
Over the foundation is compliance in Google Cloud.
We deliver a comprehensive set of capabilities
to help customers ensure that their Google Cloud
workloads are always compliant.
Compliance toolkits, where we deliver a very diverse range
of self-service compliance tools to help our customers assess,
act and comply with their regulatory requirements.
So our customers and regulators expect, as they should,
independent verification of our security, privacy,
and compliance controls.
And Google undergoes independent, third-party audits
on a regular basis to provide this assurance.
This means that an independent auditor
has examined the controls present
in our data centers, our infrastructure
and in operations.
Our certifications include widely recognized
and internationally-accepted independent security standards,
including ISO 27001 for security controls,
27017 for Cloud security, 27018 for Cloud privacy--
as well as SOC 1, SOC 2 and SOC 3.
And these certifications help us meet the demands of industry
standards also, such as CSA Star, PCI DSS,
and many other regional standards as well.
And we continue to expand the list of our certifications
globally to assist our customers with their very dynamic
compliance landscape.
Here's a list of some of the regulatory authorities
that we've engaged, both unilaterally,
and with our industry peers, and with our customers.
We're also working on more compliance products and tool
links to help our customers streamline and automate
their compliance process with their regulators.
So moving on, I'm going to hand this over
to Ruchi, who's going to talk about the second C in the trust
journey that we're taking you on.
Over to Ruchi.
RUCHI KHURANA: Thanks, Rani, for the wonderful introduction
and the summary on the compliance piece.
Now let's talk about commitments.
A major part of the commitments is transparency.
A Cloud providers should detail how it operates.
At Google, we are committed towards providing
full transparency of our security design
choices via multiple artifacts.
A few recent examples include our overall infrastructure
security, encryption addressed and encryption
in transit across our platforms.
When you have these types of detailed documentations,
you can make the decision yourself
to determine if what we are doing for security and privacy
is adequate.
Next, a Cloud provider should provide binding commitments
on how it will operate and handle your data internally.
These areas of commitment should include things
like processing restrictions, business continuity, data
deletion, data incident notification process,
subprocessor list, and other security measures.
At Google, we are transparent and committed
towards all of these ideas.
You can easily find these commitments
on our data processing security page.
Now let's talk about the third C--
that is collaboration, and it's one of the most important
C's of the Trust.
Talking about collaboration, at Google,
we offer a suite of services when
it comes to collaborations.
To start with, we have a huge team
of specialists who will help you to understand
Google's GRC [? posture. ?] We offer workshops and one-to-one
sessions with GRC gurus.
An example would be understanding
compliance lifecycle at Google.
Secondly, we offer free access to Google's third-party audit
reports--
which Rani mentioned earlier--
such as ISO, SOC, FedRAMP, and others.
Thirdly, our teams work on a multitude
of security and compliance collaterals
to help you understand and address common security risks.
Last, but not the least, we are dedicated
toward supporting your due diligence
on our third-party risk efforts in the form of facilitating
your cybersecurity risk assessments.
Next, let me talk through collaboration
through audit rights.
At Google, we are committed to meet
your regulatory and contractual requirements of right to audit.
We offer all regulated customers right
to assess us on security controls.
Moreover, we also offer your customers, or any users,
transitive right to audit Google's services
and organization controls.
Secondly, we understand that your operations may
extend beyond a certain region.
So we offer the right to inspect a Google data center
for physical and environmental security controls in whichever
region you are operating.
Thirdly, we are committed to support any audits that may
be requested by our regulators.
What we have found is that transparency
is the key when it comes to working with regulators.
And our teams will work with you and support any request
with the utmost transparency.
And finally, we also offer pooled audits,
where multiple institutions can pull together as one group
to audit Google services an organization controls.
This approach benefits both Google and Google customers
in terms of time, resources, level of effort and audit
depths.
To give an example of pooled audits,
Google is committed toward supporting
CCAG pooled audits for European financial institutions.
These financial institutions are required
to conduct a comprehensive risk assessment of their Cloud
providers, to comply with their regulatory obligations
from regulatory bodies such as EBA or BaFin.
To optimize on time and cost of the effort,
these European financial institutions
work together as a team.
In 2019, we supported Google's first CCAG audit.
Audit planning and execution took over six months
from both sides.
Auditors collected over 800=plus documents.
And 175+ Google-ers from from 24 different teams were involved
in supporting this audit.
This shows how committed we are to pooled audits.
And 2020 pooled audits is also coming soon.
Now, when we talk about Auditable Cloud Universe,
or any security program firstly, there
are many areas of responsibility.
Starting from the base layer of securing infrastructure
to going up in the stack of securing the network,
securing data, securing applications
or managing identities and access.
There are also ongoing processes for security operations,
governance, risk and compliance management.
At Google, we provide capabilities
to audit all of the domains that are relevant for your business
operations.
We have a global team who can support you in any region--
be it Americas, Europe, Japan, Asia-Pacific.
We collaborate with local teams on board policy and industry
to better understand the regulations
that you are subjected to so that we can provide the highest
level of services when it comes to facilitating these audit
requests.
Now here are some additional resources for you
to learn more about Google's security compliance and trust
posture.
Thank you so much for listening to us today.
Hope you learned about how Google Cloud is building trust
through compliance, commitment and customer collaborations.
Thank you.
RANI URBAS: Thank you so much.