The higher education information security community, EDUCAUSE, Internet2, and the Research & Education Networks Information Sharing & Analysis Center (REN-ISAC) created the Higher Education Cloud Vendor Assessment Toolkit (HECVAT), a self-assessment that attempts to standardize higher education information security and data protection requirements around cloud service providers. The assessment helps higher education institutions ensure that cloud services are appropriately assessed for security and privacy needs, and allows a consistent, easily-adopted methodology for those who want to use cloud services.
Google Cloud has completed a HECVAT self-assessment for GCP and for Google Workspace. These assessments detail our compliance with industry standards and the security protocols built into our infrastructure.
You can find Google's HECVAT self-assessments on REN-ISAC's Cloud Broker Index.