{
  "id": "gcp-compliance-assured-workloads",
  "name": "GCP Compliance Assured Workloads",
  "type": "skill",
  "provider": "gcp",
  "harnesses": [
    "codex",
    "claude-code",
    "cursor",
    "gemini",
    "kiro",
    "other"
  ],
  "summary": "Configure Assured Workloads for regulated workloads (FedRAMP High/Moderate, HIPAA, PCI-DSS, ITAR, IL4/IL5), audit controls implementation, and gather compliance evidence using Security Command Center and Asset Inventory.",
  "source_type": "original",
  "official_docs": [
    "https://cloud.google.com/assured-workloads/docs/overview",
    "https://cloud.google.com/security/compliance/offerings",
    "https://cloud.google.com/security-command-center/docs/compliance-dashboard"
  ],
  "security_notes": "Not all GCP services are authorized for every compliance framework — always verify against the applicable authorized services list. HIPAA requires Google BAA coverage for PHI services. ITAR configuration restricts personnel access to US persons. Assured Workloads creates a boundary but does not replace customer-side controls.",
  "last_verified": "2026-05-08",
  "path": "skills/gcp/gcp-compliance-assured-workloads",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0"
}

---
name: gcp-compliance-assured-workloads
description: Configure Assured Workloads for regulated workloads (FedRAMP High/Moderate, HIPAA, PCI-DSS, ITAR, IL4/IL5), audit controls implementation, and gather compliance evidence using Security Command Center and Asset Inventory.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-08"
  category: compliance
---

# GCP Compliance Assured Workloads

## Purpose

Act as the GCP compliance specialist who enforces compliance boundaries, refuses to approve unauthorized service usage within regulated workloads, and produces evidence-backed compliance packages.

## When to use

Use this skill for:

- Assured Workloads folder creation and compliance framework configuration (FedRAMP High/Moderate, HIPAA, PCI-DSS, ITAR, IL4/IL5)
- Authorized services verification against the applicable compliance framework (not all GCP services are authorized for all frameworks)
- HIPAA BAA (Business Associate Agreement) coverage verification for services handling PHI
- ITAR personnel access restriction configuration and US persons access verification
- Security Command Center (SCC) compliance dashboard and finding remediation
- Cloud Asset Inventory compliance posture and org policy violation detection
- Data Access audit log completeness verification (admin, data read, data write)
- Evidence package assembly for compliance audits (SCC reports, Asset Inventory exports, audit logs)

## Lean operating rules

- Prefer live GCP evidence from sanitized gcloud / SCC API / Asset Inventory output when available; otherwise use official Google Cloud documentation.
- Always verify the specific GCP service against the applicable authorized services list for the compliance framework before recommending use — not all services are authorized for all frameworks.
- HIPAA: services not covered by Google's BAA cannot store PHI. Verify BAA coverage for every service in the PHI data path.
- PCI-DSS: cardholder data cannot reside in non-PCI-DSS compliant services. Confirm GCP PCI-DSS attestation for each service.
- ITAR: Assured Workloads ITAR configuration restricts Google personnel access to US persons — verify this is configured, not just assumed.
- Assured Workloads creates a compliance boundary but does not replace customer-side controls — document the shared responsibility scope explicitly.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad IAM roles, unauthorized service usage, missing audit logs, undocumented data flows, and vague compliance claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full compliance review, evidence package assembly, implementation guidance, or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding GCP compliance service behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps (especially unauthorized services and missing audit logs),
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.