Configure organization-level personnel controls (OLPC)

Organization-level personnel control (OLPC) mode is an organization-wide setting in Assured Workloads that lets you configure personnel support and administrative access controls for organization-level resources to support Data Boundary for Impact Level 5 (IL5) workloads.

Department of Defense (DoD) Impact Level 5 (IL5) requires that support and administrative access be handled by US Persons located in the US. While Assured Workloads folders and Assured Workloads frameworks enforce controls on folders and projects, certain Google Cloud services store security metadata or session data directly at the organization root and can't be partitioned across folders, such as Security Command Center and Workforce Identity Federation. Configuring an OLPC mode lets you apply IL5 personnel controls to these organization-level resources and define which workloads can be created in your organization.

OLPC mode configuration and enforcement are included with Assured Workloads at no additional charge.

OLPC modes

Before you can create a Data Boundary for IL5 folder or deploy the Data Boundary for IL5 framework in Monitor and prevent mode, an administrator must configure an OLPC mode for your organization.

The following table describes each OLPC mode, whether it enables IL5 personnel controls on organization-level resources, and which workloads it lets you create or deploy:

OLPC mode Organization-level IL5 personnel controls Allowed new workloads and preventive frameworks When to use
Not set Not enabled In the Google Cloud console, non-IL5 only. Using the API, the Google Cloud CLI, or Terraform, both Data Boundary for IL5 and non-IL5 workloads are allowed. Default state before an administrator configures OLPC mode.
Strict IL5 Enabled for US Persons in the US Data Boundary for IL5 folders and preventive frameworks, custom frameworks in Monitor or Monitor and prevent mode, and built-in non-IL5 frameworks in Monitor mode. Blocks new non-IL5 folders, built-in non-IL5 frameworks in Monitor and prevent mode, and moving built-in non-IL5 frameworks from Monitor mode to Monitor and prevent mode. Dedicated IL5 organizations that have no existing non-IL5 folders or built-in preventive frameworks. You can't select this mode if your organization already has active non-IL5 folders or built-in preventive frameworks.
Strict IL5 (forward migration) Enabled for US Persons in the US Data Boundary for IL5 folders and preventive frameworks going forward, custom frameworks in Monitor or Monitor and prevent mode, and built-in non-IL5 frameworks in Monitor mode. Existing non-IL5 workloads remain unchanged. Blocks new non-IL5 folders, built-in non-IL5 frameworks in Monitor and prevent mode, and moving built-in non-IL5 frameworks from Monitor mode to Monitor and prevent mode. Organizations with existing non-IL5 workloads that want to create only IL5 folders and preventive frameworks going forward without deleting existing non-IL5 folders, removing non-IL5 framework resource assignments, or migrating existing workloads.
Allow multiple workloads with IL5 support routing Enabled for US Persons in the US Both Data Boundary for IL5 and non-IL5 workloads. Organizations that run both IL5 and non-IL5 workloads, such as FedRAMP High, CJIS, or regional data boundaries, in the same organization.

Note: Choosing this mode restricts access to organization-level resources to US Persons located in the US. If a non-IL5 project support case, such as an EU Data Boundary and Support case, requires access to organization-level resources, the assigned support representative must collaborate with a US Person support representative or engineer. This collaboration can cause support delays and might result in accesses by a US Person engineer associated with the case.
Opt-out Turned off Both Data Boundary for IL5 and non-IL5 workloads. Displays a non-blocking warning banner when you create or enforce an IL5 workload. Organizations that choose to turn off IL5 personnel controls for organization-level resources while keeping folder-level controls on IL5 folders.

How OLPC mode works

OLPC mode governs both organization-level support routing and workload creation guardrails:

  • Non-recursive organization scope: OLPC applies only to organization-level resources at the Google Cloud organization root. Child folders and projects don't inherit organization-level personnel controls from OLPC mode. Instead, they follow the controls configured on their own Assured Workloads folder or framework deployment.
  • Organization-level support routing: When OLPC mode is set to Strict IL5, Strict IL5 (forward migration), or Allow multiple workloads with IL5 support routing, access to organization-level resources is restricted to US Persons located in the US. Cloud Customer Care cases opened at the organization root node, rather than for a specific project, are routed to US Persons located in the US. For more information about support subscriptions and routing, see Getting support.
  • Project-level support routing in mixed organizations: When you open a support case for a specific project, the case always receives project-level support routing based on that project's data boundary or framework settings. In organizations that use Strict IL5 (forward migration) or Allow multiple workloads with IL5 support routing, if a support case is routed to non-IL5 support personnel and resolving the issue requires access to organization-level resources, the assigned support representative must collaborate with a US Person support representative or engineer. For example, if an EU Data Boundary and Support case requires access to organization-level resources, this collaboration can cause support delays and might result in accesses by a US Person engineer associated with the support case, regardless of the project's data boundary settings.
  • Custom and detective framework deployments: Organization-level personnel controls apply to organization-level resources regardless of which frameworks you deploy. When OLPC mode is set to Strict IL5 or Strict IL5 (forward migration), only built-in non-IL5 Assured Workloads frameworks are blocked in Monitor and prevent mode, and you can't move an existing built-in non-IL5 framework deployment from Monitor mode to Monitor and prevent mode. Deploying custom frameworks in either Monitor or Monitor and prevent mode, or deploying built-in non-IL5 frameworks in Monitor mode, isn't blocked. If a custom framework includes the builtin-restrict-technical-support-services cloud control for a non-IL5 regime, support cases for projects using that framework follow the same collaboration behavior with US Persons when resolving an issue requires access to organization-level resources.
  • Retention after workload removal: If you delete the last active Data Boundary for IL5 folder or remove the last preventive Data Boundary for IL5 framework resource assignment in your organization, your selected OLPC mode and its organization-level personnel controls remain active until an administrator changes the mode.

Before you begin

To view or update OLPC mode, you must have the required Identity and Access Management (IAM) role granted at the organization level. Roles granted only at the folder or project level aren't sufficient to view or modify organization settings.

To get the permissions that you need to view or update OLPC mode, ask your administrator to grant you the following IAM roles on your organization:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

View or update OLPC mode

You can view and update your organization's OLPC mode on the Assured Workloads settings page in the Google Cloud console:

  1. In the Google Cloud console, go to the Assured Workloads settings page.

    Go to Assured Workloads settings

    You can also open Assured Workloads settings from either of the following pages after selecting your organization:

    • On the Assured Workloads page under Compliance > Assured Workloads, click Settings in the top action bar.
    • On the Frameworks page under Compliance > Configure, click Settings in the top action bar.

  2. Under OLPC mode, view the current setting next to Active mode.

  3. To change the mode, click Edit OLPC mode.

  4. In the Choose OLPC mode panel, select the OLPC mode that matches your organization's requirements, and then click Save.

Configure OLPC mode for existing IL5 workloads

If your organization already has an active Data Boundary for IL5 folder or a preventive Data Boundary for IL5 framework deployment while OLPC mode is Not set, an Action required warning banner appears on the Assured Workloads and Frameworks pages. Click Set OLPC mode in the banner to open Assured Workloads settings, select an OLPC mode, and click Save.

Resolve OLPC banners during workload creation

When you create an Assured Workloads folder or deploy a built-in framework in Monitor and prevent mode, the Google Cloud console checks your selected data boundary against your organization's active OLPC mode:

  • OLPC mode required: Appears when you select Data Boundary for IL5 while your organization's OLPC mode is Not set. Creation or enforcement is unavailable until a mode is configured. Click Choose OLPC mode in the banner to select and save an OLPC mode in the side panel without leaving the workflow.
  • Blocked by OLPC mode: Appears when you select a non-IL5 control package, deploy a built-in non-IL5 framework in Monitor and prevent mode, or try to change an existing built-in non-IL5 framework deployment from Monitor mode to Monitor and prevent mode while your organization uses Strict IL5 or Strict IL5 (forward migration). If your organization needs to enforce preventive controls for non-IL5 workloads alongside IL5 workloads, an administrator can click Update OLPC mode in the banner and select Allow multiple workloads with IL5 support routing or Opt-out.
  • OLPC opt-out active: Appears when you select Data Boundary for IL5 while your organization's OLPC mode is set to Opt-out. This warning doesn't block workload creation, and folder-level IL5 controls still apply to the folder. If you want US Persons personnel controls applied to organization-level resources, click Update OLPC mode and select Strict IL5, Strict IL5 (forward migration), or Allow multiple workloads with IL5 support routing.

Troubleshoot OLPC mode

The following table describes common errors when viewing or updating OLPC mode or creating workloads, along with steps to resolve them:

Error message Cause Resolution
Can't set Strict IL5 because this organization has existing non-IL5 workloads. Choose "Strict IL5 (forward migration)" or "Allow multiple workloads with IL5 support routing" instead. You selected Strict IL5, which is reserved for IL5-only organizations, while the organization already has at least one active non-IL5 folder or built-in preventive framework deployment. Select Strict IL5 (forward migration) to keep existing non-IL5 workloads while blocking new ones, or select Allow multiple workloads with IL5 support routing. To use Strict IL5 instead, remove all existing non-IL5 workloads first by deleting non-IL5 Assured Workloads folders and removing resource assignments from built-in non-IL5 preventive Assured Workloads frameworks. Removing a framework resource assignment takes effect immediately without deleting the folder or project.
You don't have permission to view Assured Workloads settings. or You don't have permission to update Assured Workloads settings., or the Edit OLPC mode button is unavailable Your account doesn't have the required IAM role granted at the organization level. Ask your organization administrator to grant you roles/assuredworkloads.viewer to view settings, or roles/assuredworkloads.admin to view and update settings, on the organization resource rather than on a folder or project.
This organization's OLPC mode doesn't allow the selected regime. Choose an allowed regime or update the OLPC mode in Assured Workloads settings. A non-IL5 folder or built-in preventive framework deployment was submitted while Strict IL5 or Strict IL5 (forward migration) was active, such as after an administrator changed the mode in another session. Select Data Boundary for IL5, or ask an administrator to update the OLPC mode to Allow multiple workloads with IL5 support routing in Assured Workloads settings.
Couldn't update OLPC mode. Try again. Another administrator updated the organization's settings at the same time, or a transient error occurred. Refresh the Assured Workloads settings page and try saving your selection again. If the error persists, contact Customer Care.

What's next