An organization operates their entire IT infrastructure from Google Cloud. What should they do to prepare for data breaches?

Reducing multi-factor authentication weakens identity security controls and directly increases the risk of unauthorized access, making it counterproductive to breach prevention.

Under the shared responsibility model, Google secures the underlying infrastructure but the customer is responsible for data classification, IAM configuration, application security, and incident response - preparation cannot be minimal.

Creating an incident response plan is a security best practice required regardless of cloud provider because the shared responsibility model places data classification, access control, and breach response squarely on the customer. A documented plan defines roles, communication procedures, containment steps, and recovery actions, enabling the organization to minimize the impact and duration of a breach when it occurs.

If the entire IT infrastructure runs on Google Cloud there is no physical on-premises data center perimeter to strengthen, making this control irrelevant to the described environment.