Ensure Snapshots are encrypted using Customer Managed or Supplied Keys.
GCP compute disk snapshots are encrypted with the encryption type of source disk. By default, the compute disks are encrypted using the Google-managed encryption keys. However, to have better control on the encryption process and adhere to compliance requirements, use either customer-managed keys or customer-supplied keys for encryption.
Ensure that all disk snapshots are encrypted using desired protection level.