Obtaining and upholding certifications such as ISO 27001 and PCI DSS is the best indicator of a company's organizational commitment to security and enterprise risk management.

These certifications require the organization to implement documented policies procedures and controls and to operate a formal management system that is subject to independent third party assessment.

ISO 27001 drives enterprise level governance through risk assessment and continual improvement and PCI DSS enforces specific controls for payment card data and regular assessments. Maintaining these certifications shows sustained management support documented processes and external validation rather than a single technical control.

Google Cloud Security Command Center is a valuable cloud security product that helps with monitoring and finding risks. It does not by itself demonstrate enterprise wide governance or a company level risk management program because it is a tool rather than an organizational certification or management system.

Publishing SOC audit reports for external stakeholders improves transparency and provides audit evidence for particular services or controls. SOC reports are not equivalent to an organization wide management system or mandatory certification and they may only cover specific services or timeframes.

Performing only automated vulnerability scans every three months is a limited technical activity that can help find weaknesses. It is insufficient as proof of organizational commitment because it is narrow in scope and infrequent and it lacks the policy people and continuous governance that certifications require.

Full AWS Practitioner Certification Question