LEARN. PRACTICE. GROW.Follow data across the service
A fictional payments service maintains an operational table, JSON logs, support-ticket attachments and reconciliation exports. The table has known columns; JSON can gain fields without changing the central schema; an attachment may contain text, images or content requiring extraction. Start with an inventory of location, owner, purpose, format, access and derived copies. Include backups, caches and observability destinations within scope. A network diagram alone does not show that an identifier reaches a diagnostic field or temporary file. At handover, ask development for synthetic examples of success and error flows. An error path may log the entire payload while the normal path records only an identifier.
Separate finding a pattern from deciding classification
A numeric sequence may be a public reference, a customer identifier or synthetic test data. The detector supplies a signal; the owner applies policy to content and use. Information may require protection without names: unpublished fund positions can carry commercial value. Record criteria, accountable owner, date and a way to challenge a label. If two sources carry different classifications, examine the combined result and linkage opportunities before lowering protection. A tag changes access only when a control interprets it. Test the link between label and authorization with an allowed and a denied identity; catalog appearance does not establish enforcement.
Measure coverage before interpreting absent findings
The worksheet contains four resources: the table was sampled, logs returned permission denied, attachments were out of scope and an export awaits an owner. Zero findings in logs does not mean zero sensitive data because reading failed. Record planned, eligible, attempted, read and partially processed resources, together with time range and configuration version. Google documentation recommends starting with limited scope and confirming permissions; that strategy does not justify declaring the whole inventory inspected. Assess the sample against older partitions, error paths and rare formats. Text extraction that ignores images must also appear in the limitations. Prioritize unknown widely accessible data, assigning owners and deadlines to close gaps.
Interpret a review with known denominators
In the fictional population of 100 fully reviewed records, there are 18 true positives, 12 false positives, 6 false negatives and 64 true negatives. Precision is 18/30, or 60%; recall is 18/24, or 75%. Reviewing alerts alone can estimate the first measure for that sample, but not the second without knowing missed cases. A stricter threshold in this exercise yields 15 true positives, 3 false positives, 9 false negatives and 73 true negatives: precision around 83.3% and recall 62.5%. Reduced noise has a coverage cost. These numbers form a calculation worksheet, not cloud-scanner results. Also compare consequences and handling time before choosing the rule.
Hand over a plan RUN can use
The handover includes inventory, owner-validated classification, coverage evidence, exceptions and repeat criteria. A changed log format or new export destination should trigger appropriate review. Keep findings and sensitive examples under restricted access; copying everything into a widely visible ticket creates another destination to protect. Define who responds to an out-of-hours detection and how evidence is preserved without widening exposure. Before project closure, demonstrate an authorized synthetic flow, an expected block and a scanner failure condition that produces an operational alert. Summary: discovery locates signals, classification determines treatment and control validation establishes behavior. Connect this lesson with retention, IAM, observability and change management.
FICTIONAL WORKSHEET, NO SCANNER EXECUTION
Fully reviewed population: 100
TP=18 FP=12 FN=6 TN=64
Precision=18/30=60%; recall=18/24=75%
New threshold: TP=15 FP=3 FN=9 TN=73
Precision=15/18=83.33%; recall=15/24=62.5%
Inventory:
- payments-table: structured, sampled
- support-logs: semi-structured, permission denied
- case-attachments: unstructured, out of scope
- archive-export: structured, pending, unassigned owner
Record: scope, formats, permissions, sampling, date, version, exceptions and owner.Of 100 fictional records: precision 18/(18+12)=60%; recall 18/(18+6)=75%. Logs without read permission remain uninspected.
Common pitfalls
Confusing zero findings with successful reading; a label with a control; a higher threshold with complete coverage; reviewed alerts with the whole population.
Related topics: Retention, copies and data lineage · IAM, observability and changes
Distinguish detection evidence, classification decisions and actual inventory coverage.
Reference: Inspect Google Cloud storage and databases for sensitive data · CCSP examination outline effective 2026-08-01; January2026 V2 PDF