To organize GCP projects based on different business units and manage IAM permissions, you should create an organization node and assign folders for each business unit. This approach allows you to logically separate projects under folders and apply IAM policies at the folder level.
Step-by-Step:
Create Organization Node: Ensure that your GCP account is linked to an organization.
Create Folders for Business Units:
Navigate to the GCP Console > IAM & Admin > Resource Manager.
Create a folder for each business unit under the organization node.
Move Projects to Folders:
Move existing projects into the respective folders according to the business unit.
Set IAM Policies:
Assign IAM roles and permissions at the folder level to manage access for each business unit independently.
Monitor and Manage: Use Cloud Audit Logs and other GCP tools to monitor the activities and ensure compliance with the organization's policies.
Reference:
Creating and Managing Folders
Managing IAM Policies

https://gsuite.google.com/learn-more/security/security-whitepaper/page-1.html Shared responsibility "Security of the Cloud" - GCP is responsible for protecting the infrastructure that runs all of the services offered in the GCP Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run GCP Cloud services.

SSO/SAML Integration: Implement SSO (Single Sign-On) with SAML integration through Cloud Identity to streamline user authentication and lifecycle management. This ensures centralized management of user identities and access.
Predefined Roles: Use predefined roles to provide granular access control. These roles are designed to follow the principle of least privilege, ensuring that users have the minimum necessary permissions to perform their tasks.
User Management: By leveraging SSO/SAML, user provisioning and de-provisioning become more efficient and secure. This integration helps maintain consistent access policies across your organization.
Access Control: Predefined roles reduce the risk of over-permission by offering well-defined access levels, enhancing security and compliance. Reference::
Google Cloud - SSO with SAML
Google Cloud - IAM Best Practices

"Your team needs to obtain a unified log view of all development cloud projects in your SIEM" - This means we are ONLY interested in development projects. "The development projects are under the NONPROD organization folder with the test and pre-production projects" - We will need to filter out development from others i.e test and pre-prod. "The development projects share the ABC-BILLING billing account with the rest of the organization." - This is unnecessary information.

Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors: Cloud EKM allows you to use encryption keys that are managed externally to Google Cloud. This means you can generate and store your keys in an on-premises HSM or another supported external HSM service, and integrate these keys with various Google Cloud services.
Integration with Google Services: Cloud EKM integrates seamlessly with many Google Cloud services, including BigQuery, Cloud Storage, Compute Engine, and more. This provides you with full control over your encryption keys while still taking advantage of Google Cloud's powerful services.
Reference:
Cloud External Key Management (EKM) documentation
External Key Management overview