You can use Google Cloud security best practices and guidelines for generative AI to discover and implement security features for your generative AI workloads and supporting services on Google Cloud.
The security best practices are a Google-driven supplementary guide to existing regulatory and security practices in industries such as the financial services sector. The Google Cloud best practices and guidelines focus on foundational workload security controls and unique considerations that are specific to generative AI workloads.
These security best practices are intended to help chief information security officers (CISO), security practitioners, and risk and compliance officers adopt and deploy workloads in Google Cloud, while focusing on safety, security, and compliance. We align our recommendations with the requirements of the National Institute of Standards and Technology (NIST) 800-53 and Cyber Risk Institute (CRI) frameworks.
These best practices also support the shared fate model, where we strive to collaborate with industries to build a more secure and resilient cloud infrastructure for various workloads. The shared fate model includes deployment, operations, and risk transfer. Therefore, these recommendations focus on workload deployment and operations, particularly in relation to compliance.
We understand that implementing compliance and security isn't a simple exercise. For additional help, contact Google Cloud Security.
Structure for security best practices
The security best practices are structured as controls that you can review and implement. The controls are as follows:
Recommended IAM roles: Recommendations for IAM roles to assign to user groups in your organization.
Common controls: These best practices apply to all generative AI workloads in Google Cloud.
Service-specific controls: These best practices apply to generative AI workloads that make use of the following Google Cloud services:
- Vertex AI controls
- Artifact Registry controls
- BigQuery controls
- Cloud Billing controls
- Cloud Build controls
- Cloud DNS controls
- Cloud Identity controls
- Cloud Run functions controls
- Cloud Storage controls
- Dataflow controls
- Identity and Access Management controls
- Organization Policy Service controls
- Pub/Sub controls
- Resource Manager controls
- Secret Manager controls
- Security Command Center controls
- Virtual Private Cloud controls
Each recommendation is auditable and ensures a baseline of security controls are met.
Control categories
Control categories are Required, Recommended, or Optional. The categories help identify key activities that we highly recommend you do, activities that we highly advise you consider, and activities that you might consider based on your specific requirements and goals.
The following table describes these categories.
| Category | Description |
|---|---|
Required |
Implement these guidelines for your Google Cloud environment. |
Recommended |
Implement these guidelines based on use cases such as monitoring sensitive data inside the generative AI workloads if your environment includes that type of data. |
Optional |
Consider additional guidelines based on your use case and risk appetite. |
Sample generative AI architecture
The following diagram shows the Google Cloud services that are present in a typical generative AI architecture that uses Vertex AI.
What's next
- Review Recommended IAM roles.