https://cloud.google.com/security-command-center/docs/compliance-management For each supported security standard, Security Command Center checks a subset of the controls.
For the controls checked, Security Command Center shows you how many are passing. For the controls that are not passing, Security Command Center shows you a list of findings that describe the control failures.

"Isolate VMs using service accounts when possible"
"even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instanceAdmin role while VMs are in service. Service accounts are access- controlled, meaning that a specific user must be explicitly authorized to use a service account.
There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped."
https://cloud.google.com/solutions/best-practices-vpc-design#isolate-vms-service-accounts

Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources.
https://forsetisecurity.org/about/

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy- constraints#constraints-for-specific-services

You need a SIEM to actually analyse the configurations of the environments.