You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

The company's concern is specifically about access to their data by internal Google employees. Access Transparency and Access Approval are the services designed to address this. Access Transparency provides near real-time logs of actions taken by Google staff when they access customer content. Access Approval allows you to require explicit approval from your organization before Google employees can access your data for support purposes. This combination provides both visibility and direct control over access by Google personnel, directly mitigating the stated risk.

A. Customer-managed encryption keys (CMEK) provide control over encryption keys but do not prevent justified access by Google support staff, as services can still use the key on your behalf.
B. IAM is used to manage access for your own organization's users and service accounts, not for Google employees performing administrative or support duties.
C. Admin Activity logs record actions taken by members of your organization within your Google Cloud projects, not actions taken by Google staff.

- Google Cloud Documentation, "Access Approval overview." It states, "Access Approval allows you to approve eligible access requests from Google employees before they can access your Google Cloud project's data and configurations."

- Google Cloud Documentation, "Access Transparency overview." It states, "Access Transparency provides you with logs of actions taken by Google staff when accessing your Google Cloud content."

- Google Cloud Whitepaper, "Trusting your cloud provider," section "Operational transparency and control." This section details how Access Transparency and Access Approval provide customers with control and visibility.