How to Get Permission to Share GCP SOC-2 with our Customer?

[Maybs]

Hey all,

We're a GCP customer and have access to Google's Compliance Manager to download the latest SOC-2 reports.  But, our customer (not a GCP customer) is asking to see a copy of Google's SOC-2 as part of a security audit.  How do we secure permission from Google to share this document with them?  I've been in a bermuda triangle of sales chats and calls, but no one I can get ahold of can help or even route me further. 

Thanks for any and all help!

M

[glen_yu]

You can get a request/get a copy via their Compliance Reports Manager site

[Maybs]

Thanks Glen.  I assumed those reports were for our internal use since they come out watermarked  Are we free to share those with customers?  (Our team is currently under the impression that we are not free to share).

[glen_yu]

It's my understanding that this is something that is available to anyone.  There's nothing sensitive about them -- whether I download it or you download it, it only differs in the watermark.

I would direct your client to the link and let them know that Google publishes all their compliance reports (SOC-1, 2, 3, etc.) is is free to access -- although they will need to log in.  This is the norm I think for all cloud providers (AWS calls theirs AWS Artifact, it's free, but also requires an AWS account to access). 

[Nick_Troutini]

Hey @Maybs thanks for reaching out on this! This is a great question!

I apologize for the Bermuda Triangle of frustration you've been stuck in, my goal is to change that. I am reviewing this question internally with our security team to get you an official answer on this.

[Maybs]

@Nick_Troutini We would SO appreciate that.   Please let me know if there is a process we should go through, or if we are clear to share.

[Nick_Troutini]

Hey @Maybs I am going to send you a DM regarding our next steps for this. Thank you for your patience! 🙂 

[SJ]

Hi @Nick_Troutini, a general response here on the solution for this might be useful for those of us following this thread (or others who get here by searching in the future) 🙂

Thanks.

[Nick_Troutini]

Hey @SJ thanks for the feedback. With this specific instance we need to get some account information in order for us to submit a ticket on your behalf. Once that ticket is approved it will give you access to the system that allows you to send those reports out to your customers. Feel free to DM me with any more questions! 

[SJ]

Hi @Nick_Troutini , I also now have the need to share Google's SOC-2 and other compliance docs with a third party. I've sent you a DM already, can you please let me know how? Thanks!

[Nick_Troutini]

Hey @SJ check your DM's! 🙂 

[skamins]

Hi @Nick_Troutini we have the same situation, we need to give our partner the relevant GCP SOC 2.  Can you let me know how to make that request?

[Xenon]

Hi Nick! 

I am also in the same situation where I have a customer requesting the SOC 2 report for GCP; what avenue would I take to create a request for this? 

Thanks so much! 

[Nick_Troutini]

Hey folks, we are working on an official form that can be filled out to ensure you're in compliance with Google Cloud and, therefore, able to send out the audit reports. 

I will update this thread as soon as that becomes available! We're estimating some time next week. 

Cheers!

-Nick

[Xenon]

Thank you!! ❤️

[Xenon]

Hi @Nick_Troutini! I was wondering if there was an update for the form... My client is getting a little antsy. 

Thank you!

[Nick_Troutini]

Hey @Xenon I certainly haven't forgotten about you. I will have an update for you by EOD today. 

-Nick

[Nick_Troutini]

Hey everyone! 

Thanks for your patience as we worked through the best process to ensure you can share these reports externally. If you already know that you have an NDA to share our SOC reports externally, then head over to Compliance Reports Manager to get a copy of the latest report you're looking for.

If you're unsure or do not have an NDA in place, we ask that you reach out to your Google sales representative and they can assist you in getting one in place. Of course, if you have any questions, please let me know! 

Thanks,

Nick

[Xenon]

Thank you for the follow up, Nick! 

I'm a relatively new admin, so how would I be able to find out who the Google Representative is for my organization? 

Thank you again! 

[Nick_Troutini]

I would ask internally to see if anyone in your org knows. If that doesn't work, shoot me a DM and we can figure it out! 

[apetrik]

Hey Nick.

Thank you for all your support here. We're a heavy customer of GCP. Our customers are also asking for ISO 27001 and SOC 2. I wrote a direct message to you a few days ago with no reply yet. I'm not sure how to find a sales rep from Google side. Could you please help with that?

Andrei

[apetrik]

Anyone can help here? We have a customer waiting for the docs. I'm not sure if I can share the docs or not. I contacted Google sales support with their promise to return back with the feedback but no response yet from their side either.

[Xenon]

Hi Apetrik, 

I got in contact with SADA and they stated to me that if I have access to the Compliance reports I'm ok to share them out. Not sure if you have a third party supplier who might be able to get an answer for you. 

[apetrik]

Hey, Xenon.

Thank you for the hint on this. As Nick previously stated, it seems like we need an NDA signed with Google to move forward with sharing. I also think that we can share as soon as we have access to the documents and the portal itself doesn't provide any requirements on the NDA. I would still like to have a final word from Google representative on this.

Andrei

[Xenon]

Hi Andrei, 

I understand. I tried to do it last year, as you see my previous message and the representatives never got back to me. SADA is a supplier that works closely with Google support, so that may be a possible advantage if you don't hear back from Google.

[LarryNic]

I'm really surprised Nick stated you need an NDA for something like this. I didn't see that in the thread. This could be a new business opportunity for Google Cloud to obtain new customers by sharing the reports. 

[attathomeguy]

Does anybody know why it says bridge letters will be posted but when I search for them they are not found?

[LarryNic]

Hello,

You can request additional bridge letters by submitting a support case (existing customer), or by contacting sales (new customer). 

https://cloud.google.com/support-hub

I hope this helps.

[attathomeguy]

I wish it did but support has no clue what I am talking about. I have attached a screenshot showing no bridge letters available 

[LarryNic]

Thanks for the screenshot. Which SOC are you using? 

1. Try selecting the drop down "Report Type" and choose Audit Report. 

2. Type "SOC" in the search field, instead of "bridge". 

3. Find the bridge letter for either SOC 1, 2, or 3 audit report. 

I hope this helps. 

[attathomeguy]

yeah they are not there. I hope someone from Google sees thiss and can help me out cause both GCP support and Workspace support don't know where to get it

[rtsconsulting]

We're in the same boat. The host we use is on GCP, so they sent us to the reports manager, but there's no bridge letter and I technically don't have a GCP account, so I haven't even been able to connect with anyone to ask for a bridge letter. Why is the bridge letter so hard to get when everything else is downloadable? 

Anyone from GCP listening? We need help with this. My client is also getting frustrated that I cannot provide this letter.

[chief7]

Anyone ever figure out where to get a current SOC 2 Bridge letter from. Please let me know if someone managed to get a copy!