Compliance team requires regular reporting on compliance with standard control frameworks for a regulated business unit that continuously adds projects. You need a report including evidence of non-compliant resources. How should you generate this?

• A. Audit Manager with compliance framework; export evaluation.
• B. BigQuery CAI queries scheduled regularly.
• C. Implement control framework using Rego in Workload Manager and schedule report.
• D. Implement the built-in posture for the compliance framework within SCC posture.

Answer: (D)

Continuous compliance monitoring with automatic evidence collection across all resources is the key. Security Command Center Posture provides built-in support for standard compliance frameworks and evaluates every resource as new projects are added, continuously updating the posture. This means you get up-to-date findings and explicit evidence of non-compliant resources, all in one place, and you can schedule reports or export the findings for regular review by the compliance team. It scales with a growing environment without needing to script custom queries or policy checks, which makes it the most efficient and reliable way to generate regular compliance reports.

Using Audit Manager would focus more on audits and attestations rather than ongoing posture with live evidence. Custom CAI queries would require building and maintaining complex queries and dashboards yourself. Implementing Rego policies in a workload manager adds a lot of custom policy work and maintenance, and still wouldn’t automatically provide the centralized, ongoing compliance posture and reports you need.