Audit Manager supports compliance audits in Google Cloud: automated assessments against built-in or custom frameworks, evidence collection, and gap analysis.
What is Audit Manager?
Audit Manager is a compliance audit solution that helps simplify your compliance audit process on Google Cloud. You can run audits against built-in frameworks or against custom frameworks that you define using Compliance Manager or Assured Workloads frameworks (Preview).
Per the documentation, assessments can be created for a Google Cloud organization (Preview), a folder, or a project.
Core Features
- Shared responsibilities matrix: Shows separation of duties with recommendations for managing your own responsibilities
- Compliance documents: Compliance documentation for Google Cloud
- Automated assessments: Evaluates compliance controls on workloads to determine their state of compliance
- Evidence collection: Gathers evidence for compliance audits
- Gap identification: Surfaces the generated violations as a basis for remediation
- Scheduled audits: Runs at regular intervals (Preview)
Typical Use Cases
Preparing for external audits
Collecting evidence and evaluating controls ahead of a SOC2 or ISO 27001 audit, without assembling records by hand.
Ongoing compliance monitoring
Recurring, scheduled audits (Preview) at folder or project level, so deviations surface early.
Assessment against industry benchmarks
Evaluating workloads against CIS benchmarks, the CSA Cloud Controls Matrix, NIST catalogues, or PCI DSS, provided the corresponding licence tier is in place.
Custom control catalogues
Defining company-specific frameworks through Compliance Manager or Assured Workloads frameworks (Preview) and assessing against them.
Benefits
- Less manual effort: Automated assessment instead of manual evidence collection
- Broad framework coverage: From SOC2 in the free tier through CIS, ISO 27001, NIST, and PCI DSS in the higher tiers
- Clear division of responsibility: The shared responsibilities matrix shows which controls sit with Google and which sit with you
- Entry at no additional cost: The free tier covers unlimited audits for SOC2 and the Google-recommended AI controls
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you with Audit Manager: selecting suitable frameworks, setting up assessments at folder and project level, and preparing the results for your audit and compliance processes.
Contact us for a consultation on Audit Manager.
Available Tiers & Options
Free tier
- Core product features included
- Unlimited audits for SOC2 and the Google-recommended AI controls
- Only a limited selection of compliance standards
Security Command Center Enterprise
- All frameworks across the premium compliance packages at no additional cost
- Billed exclusively through the SCC Enterprise SKUs
- Requires Security Command Center Enterprise to be enabled
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Audit Manager?
Audit Manager is a compliance audit solution that helps simplify your compliance audit process on Google Cloud. You run audits against built-in frameworks or against custom frameworks that you define using Compliance Manager or Assured Workloads frameworks (Preview).
Which frameworks does Audit Manager support?
Security Essentials and SOC2 2017 are built in. With Security Command Center Premium or Enterprise, or with Assured Workloads enabled, the documentation lists additional frameworks including CIS GCP Foundations Benchmark v3.0, CIS GKE 1.7, CIS Critical Security Controls v8, CSA Cloud Controls Matrix v4.0.11, ISO 27001:2022, NIST 800-53 Revision 5, NIST AI 600-1 Privacy Controls, NIST Cybersecurity Framework 1.1, PCI DSS v4.0.1, and the Qatar National Information Assurance Standard v2.1.
What does Audit Manager cost?
Google describes three tiers: a free tier with core product features and a limited selection of compliance standards, a tier included at no additional cost for Security Command Center Enterprise customers, and a premium offering for which you request a quote from Google Cloud sales. The free tier includes unlimited audits for SOC2 and the Google-recommended AI controls.
What results does an audit produce?
Audit Manager provides a shared responsibilities matrix, supplies compliance documents for Google Cloud, runs automated assessments of controls on your workloads, collects evidence for compliance audits, and identifies gaps so that the generated violations can be remediated.
What about older frameworks from earlier audits?
Frameworks used for audits before June 30, 2026 are no longer available per the documentation. The documentation includes a mapping table from those older frameworks to their equivalents in Audit Manager, Compliance Manager, and Assured Workloads frameworks.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
