CIS Google Workspace Benchmark

This setting ensures that Super Admin Accounts Are Limited to Two or Fewer on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# List all super admin users
gam print admins role "_SEED_ADMIN_ROLE"

# Count super admin accounts — should be 2 or fewer
gam print admins | grep -c "Super Admin"

# Remove super admin from unnecessary accounts
gam update user excessadmin@domain.com admin off

# Reassign to a scoped delegated admin role
gam create admin excessadmin@domain.com "Help Desk Admin"

This recommendation verifies that Admin Roles Follow Least Privilege on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all admin roles and their privileges
gam print adminroles

# Show privileges for a specific role
gam info adminrole "User Management Admin"

# Create a custom admin role with least-privilege
gam create adminrole "Tier1 Support" privileges USERS_RETRIEVE,USERS_UPDATE

# Assign the scoped role instead of Super Admin
gam create admin user@domain.com "Tier1 Support" org "/Sales"

This recommendation verifies that Delegated Admin for Organizational Units Is Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List delegated admin assignments scoped to OUs
gam print admins | grep -i "orgunit"

# Verify admins are scoped, not domain-wide
gam print admins role "User Management Admin"

# Assign admin role scoped to a specific OU
gam create admin helpdesk@domain.com "User Management Admin" org "/Regional/EMEA"

# Remove domain-wide assignment if present
gam delete admin helpdesk@domain.com "User Management Admin"

This recommendation verifies that Inactive User Accounts Are Suspended After 90 Days on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List users who have not logged in within 90 days
gam print users lastlogintime | awk -F, 'NR>1 {if ($2 < "2025-12-01") print $1}'

# Or use the Admin Console:
# Admin Console > Directory > Users > Filter: Last sign-in > 90 days ago

# Suspend inactive users
gam update user inactive@domain.com suspended on

# Bulk suspend users inactive >90 days (from CSV)
gam csv inactive_users.csv gam update user ~email suspended on

This recommendation verifies that All Users Have a Recovery Phone and Email Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check recovery info for all users
gam print users recoveryemail recoveryphone

# Find users missing recovery info
gam print users recoveryemail recoveryphone | awk -F, 'NR>1 && ($2=="" || $3=="")' 

# Notify users to set recovery info (via GAM email)
gam sendemail ~email subject "Action Required: Set Recovery Info" message "Please add a recovery phone and email in your Google Account settings."

# Admin Console > Account > Account recovery > Require recovery info

This setting ensures that External Group Access Is Restricted on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# List groups that allow external members
gam print groups settings allowExternalMembers | grep -i true

# Admin Console > Directory > Groups > Settings > Sharing > Who can join

# Disable external access on a group
gam update group team@domain.com settings allowExternalMembers false

# Apply to all groups
gam all groups update settings allowExternalMembers false

This setting ensures that Who Can Create Groups Is Restricted on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Check who can create groups
# Admin Console > Directory > Groups > Sharing settings
# Verify "Who can create groups" is set to "Admins only"
gam print groups whoCanCreate

# Restrict group creation to admins only
# Admin Console > Apps > Google Workspace > Groups for Business > Sharing
# Set "Who can create groups" to "Only organization admins"
gam update org "/" groupCreationEnabled false

This recommendation verifies that Group Owners Cannot Allow External Members on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if group owners can allow external members
gam print groups settings whoCanModifyMembers

# Verify the org-level setting restricts owners
# Admin Console > Directory > Groups > Sharing > External members: Off

# Prevent group owners from adding external members
gam update group team@domain.com settings whoCanModifyMembers ALL_MANAGERS_CAN_MODIFY
gam update group team@domain.com settings allowExternalMembers false

# Admin Console > Apps > Groups for Business > Sharing > External members: Off

This recommendation verifies that Organizational Units Reflect Security Boundaries on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all organizational units
gam print orgs

# Review OU hierarchy for alignment with security boundaries
gam print orgs name description parentOrgUnitPath

# Create OUs that reflect security boundaries
gam create org "/Contractors" description "External contractors with restricted access"
gam create org "/Executives" description "C-suite with enhanced security"

# Move users to appropriate OUs
gam update user contractor@domain.com org "/Contractors"

This recommendation ensures that 2-Step Verification Is Enforced for All Users on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check 2SV enforcement status
gam print users isEnforcedIn2Sv isEnrolledIn2Sv

# Find users not enrolled in 2SV
gam print users isEnrolledIn2Sv | grep -i false

# Admin Console > Security > Authentication > 2-Step verification > Enforcement

# Enforce 2SV for all users
# Admin Console > Security > Authentication > 2-Step verification
# Set "Enforcement" to "On" and "New user enrollment period" to 1 week

gam update org "/" 2svPolicy enforced
gam update org "/" 2svEnrollmentGracePeriod 7d

This recommendation ensures that Security Keys Are Required for Admin Accounts on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check if security keys are required for admins
gam print users isEnforcedIn2Sv isEnrolledIn2Sv query "isAdmin=true"

# Verify security key enforcement for admin OU
# Admin Console > Security > Authentication > 2-Step verification
# Select Admin OU > Allowed methods: Security key only

# Enforce security keys for admin OU
# Admin Console > Security > Authentication > 2-Step verification
# Select "/Admins" OU > Enforcement: On > Methods: Security key only

gam update org "/Admins" 2svPolicy enforced
gam update org "/Admins" allowedMethods SECURITY_KEY

This recommendation verifies that Session Length Is Set to 12 Hours or Less on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check current session length
# Admin Console > Security > Google session control
# Verify "Web session duration" is 12 hours or less
gam info org "/" | grep -i session

# Set session length to 12 hours
# Admin Console > Security > Access and data control > Google session control
# Set "Web session duration" to 12 hours

gam update org "/" sessionDuration 12h

This recommendation verifies that Password Length Is Set to 12 Characters or More on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check password policy settings
# Admin Console > Security > Authentication > Password management
# Verify minimum length >= 12
gam print org "/" | grep -i password

# Set minimum password length to 12
# Admin Console > Security > Authentication > Password management
# Set "Minimum length" to 12, enforce on next sign-in

gam update org "/" passwordMinLength 12
gam update org "/" passwordEnforceAtNextLogin true

This recommendation verifies that Password Reuse Is Prohibited on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check password reuse policy
# Admin Console > Security > Authentication > Password management
# Verify "Allow password reuse" is NOT enabled
gam print org "/" | grep -i reuse

# Disable password reuse
# Admin Console > Security > Authentication > Password management
# Uncheck "Allow password reuse"

gam update org "/" passwordAllowReuse false

This setting ensures that Third-Party App Access Is Restricted on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# List all third-party apps with access
gam print tokens

# Check app access control settings
# Admin Console > Security > Access and data control > API controls
# Verify "Third-party app access" is restricted

# Restrict third-party app access
# Admin Console > Security > Access and data control > API controls
# Set to "Block all third-party API access" or "Limited"

# Revoke access for specific unneeded apps
gam user user@domain.com deprovision token clientid APP_CLIENT_ID

This recommendation verifies that OAuth App Allowlisting Is Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List configured OAuth app allowlist
# Admin Console > Security > Access and data control > API controls > App access control
# Review the list of trusted/configured apps
gam print appaccess

# Add trusted apps to allowlist
# Admin Console > Security > Access and data control > API controls
# Click "Manage third-party app access" > Configure new app

# Set unconfigured apps to "Blocked" or "Limited"
gam update appaccess clientid TRUSTED_APP_ID access trusted

This setting ensures that API Access Is Controlled by Admin on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Check API access control settings
# Admin Console > Security > Access and data control > API controls
# Verify "Manage API client access" is configured
gam print apicontrols

# Admin Console > Security > Access and data control > API controls
# Click "Manage API client access"
# Add authorized client IDs and their scopes

gam update apicontrol clientid CLIENT_ID scopes "https://www.googleapis.com/auth/admin.directory.user.readonly"

This recommendation verifies that SAML SSO Is Configured for Enterprise IdP Integration on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if SAML SSO is configured
# Admin Console > Security > Authentication > SSO with third-party IdP
# Verify SSO profile is configured and assigned
gam info domain | grep -i sso

# Configure SAML SSO with enterprise IdP
# Admin Console > Security > Authentication > SSO with third-party IdP
# 1. Click "Add SSO profile"
# 2. Enter Sign-in page URL, Sign-out page URL
# 3. Upload IdP certificate
# 4. Assign profile to organizational units

This setting ensures that Less Secure Apps Access Is Blocked on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Check Less Secure Apps status
# Admin Console > Security > Authentication > Less secure apps
# Verify it is set to disable

gam print users isLessSecureAppsAccessAllowed | grep -i true

# Block less secure apps access
# Admin Console > Security > Authentication > Less secure apps
# Select "Disable access to less secure apps (Recommended)"

gam update org "/" lessSecureApps disabled

This recommendation verifies that Advanced Phishing and Malware Protection Is Enabled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Verify "Phishing protection" is enabled with these settings:
#   - Protect against domain spoofing from similar domains: ON
#   - Protect against spoofing of employee names: ON
#   - Protect against inbound emails spoofing your domain: ON
gam info domain | grep -i phishing

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Phishing protection":
# 1. Check "Protect against domain spoofing based on similar domain names"
# 2. Check "Protect against spoofing of employee names"
# 3. Check "Protect against inbound emails spoofing your domain"
# 4. Set action to "Move email to spam" or "Show warning"

This recommendation verifies that Attachments Protection Is Enabled for Encrypted and Anomalous File Types on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Attachments":
# Verify protection is ON for:
#   - Encrypted attachments from untrusted senders
#   - Attachments with scripts from untrusted senders
#   - Anomalous attachment types in emails

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Attachments":
# 1. Enable "Protect against encrypted attachments from untrusted senders"
# 2. Enable "Protect against attachments with scripts from untrusted senders"
# 3. Enable "Protect against anomalous attachment types in emails"
# 4. Set actions to "Move email to spam"

This recommendation verifies that Links and External Images Protection Is Enabled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Links and external images":
# Verify all protections are enabled:
#   - Identify links behind shortened URLs: ON
#   - Scan linked images: ON
#   - Show warning prompt for any click on links to untrusted domains: ON

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Links and external images":
# 1. Enable "Identify links behind shortened URLs"
# 2. Enable "Scan linked images"
# 3. Enable "Show warning prompt for any click on links to untrusted domains"
# 4. Enable "Apply future recommended settings automatically"

This recommendation verifies that Spoofing and Authentication Protection Is Enabled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Spoofing and authentication":
# Verify these are enabled:
#   - Protect against domain spoofing using similar domain names
#   - Protect against spoofing of employee names
#   - Protect against inbound emails spoofing your domain
#   - Protect any unauthenticated emails from Gmail

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Spoofing and authentication":
# 1. Enable all spoofing and authentication protections
# 2. Set action for domain spoofing to "Move to spam" or "Quarantine"
# 3. Enable "Protect against any unauthenticated emails"
# 4. Enable "Protect groups against inbound emails spoofing your domain"

This recommendation verifies that Security Sandbox Is Enabled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Security sandbox":
# Verify "Enable virtual execution of attachments in a sandbox" is ON
# Verify rule coverage includes all organizational units

# Admin Console > Apps > Google Workspace > Gmail > Safety
# Under "Security sandbox":
# 1. Enable "Enable virtual execution of attachments in a sandbox environment"
# 2. Select "Enable for all file types" or configure specific rules
# 3. Apply to all organizational units

This recommendation verifies that SPF Record Is Configured for All Domains on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SPF record for all domains
dig TXT domain.com +short | grep "v=spf1"

# Verify SPF record uses -all (hard fail)
# Expected: "v=spf1 include:_spf.google.com -all"

# Check all domains in the org
gam print domains | while read d; do echo "$d:"; dig TXT $d +short | grep spf; done

# Add SPF record to DNS
# Type: TXT
# Host: @
# Value: v=spf1 include:_spf.google.com -all
# TTL: 3600

# If using additional senders, include them:
# v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

This recommendation verifies that DKIM Signing Is Enabled for All Domains on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DKIM signing status in Admin Console
# Admin Console > Apps > Google Workspace > Gmail > Authenticate email
# Verify DKIM is "Authenticating email"

# Verify DKIM DNS record
dig TXT google._domainkey.domain.com +short

# Admin Console > Apps > Google Workspace > Gmail > Authenticate email
# 1. Select your domain
# 2. Click "Generate new record"
# 3. Select 2048-bit key length
# 4. Add the CNAME/TXT record to DNS
# 5. Click "Start authentication"

# Verify: dig TXT google._domainkey.domain.com +short

This recommendation verifies that DMARC Policy Is Set to Quarantine or Reject on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DMARC record
dig TXT _dmarc.domain.com +short

# Verify policy is p=quarantine or p=reject
# Expected: "v=DMARC1; p=reject; rua=mailto:dmarc@domain.com; ruf=mailto:dmarc@domain.com; pct=100"

# Add DMARC DNS record
# Type: TXT
# Host: _dmarc
# Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@domain.com; pct=100

# Once monitoring confirms alignment, upgrade to reject:
# v=DMARC1; p=reject; rua=mailto:dmarc-reports@domain.com; ruf=mailto:dmarc-forensic@domain.com; pct=100

This recommendation verifies that MTA-STS Policy Is Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check MTA-STS policy
dig TXT _mta-sts.domain.com +short
# Expected: "v=STSv1; id=20250101T000000"

# Check the MTA-STS policy file
curl -s https://mta-sts.domain.com/.well-known/mta-sts.txt
# Should show: mode: enforce, mx: *.google.com

# 1. Create MTA-STS policy file at https://mta-sts.domain.com/.well-known/mta-sts.txt:
#    version: STSv1
#    mode: enforce
#    mx: *.google.com
#    max_age: 604800

# 2. Add DNS TXT record:
# Host: _mta-sts
# Value: v=STSv1; id=20250301T000000

# 3. Add TLSRPT DNS TXT record:
# Host: _smtp._tls
# Value: v=TLSRPTv1; rua=mailto:tls-reports@domain.com

This recommendation ensures that TLS Compliance Is Enforced for Sensitive Domains on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Admin Console > Apps > Google Workspace > Gmail > Compliance
# Check "Secure transport (TLS) compliance"
# Verify TLS rules exist for sensitive partner domains

# Or via API:
gam print smtptls

# Admin Console > Apps > Google Workspace > Gmail > Compliance
# 1. Click "Secure transport (TLS) compliance" > Configure
# 2. Add trusted partner domains (e.g., partner.com)
# 3. Select "Require TLS" for these domains
# 4. Enable "Require CA-signed certificate"
# 5. Save and apply to organizational unit

This recommendation verifies that S/MIME Is Enabled for Message Encryption on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > User settings
# Verify S/MIME is enabled for the organization
# Check: "Enable S/MIME encryption for sending and receiving emails"

# Admin Console > Apps > Google Workspace > Gmail > User settings
# 1. Scroll to "S/MIME" section
# 2. Check "Enable S/MIME encryption for sending and receiving emails"
# 3. Optionally check "Allow users to upload their own certificates"
# 4. Save changes

This recommendation verifies that Email Allowlists Are Not Used to Bypass Spam Filters on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Gmail > Spam, phishing and malware
# Check "Email allowlist" section
# Verify no IP addresses or domains are allowlisted that bypass spam filters

# Review existing allowlist:
gam print emailallowlist

# Admin Console > Apps > Google Workspace > Gmail > Spam, phishing and malware
# 1. Under "Email allowlist", remove any entries bypassing spam filters
# 2. Use "Approved senders" lists with caution
# 3. If entries are required, use authentication-based rules instead
# 4. Save changes

This recommendation verifies that POP and IMAP Access Is Disabled Unless Required on the Google Workspace cloud collaboration platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Google Workspace cloud collaboration platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Admin Console > Apps > Google Workspace > Gmail > End User Access
# Verify POP and IMAP access settings:
#   POP access: Disabled
#   IMAP access: Disabled

gam print users pop imap | grep -i enabled

# Admin Console > Apps > Google Workspace > Gmail > End User Access
# 1. Set "POP access" to "Disable POP access for all users"
# 2. Set "IMAP access" to "Disable IMAP access for all users"
# 3. Save

# Or disable per-user:
gam update user user@domain.com pop off imap off

This setting ensures that External Sharing Is Restricted to Allowlisted Domains on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# Verify "Sharing outside of your organization" is set to:
#   "Allowlisted domains" (not "Anyone")

gam print orgs sharing | grep -i external

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# 1. Under "Sharing outside of your organization":
#    Select "Allowlisted domains only"
# 2. Add trusted partner domains to the allowlist:
#    Admin Console > Account > Domains > Allowlisted domains
# 3. Save

This recommendation verifies that Files Cannot Be Shared Outside the Organization via Link Sharing on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# Verify link sharing defaults:
#   "When users create items, the default access should be": Restricted
#   "Access checker": Recipients only

gam print orgs driveSharing | grep -i link

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# 1. Set "When users create items, the default access should be":
#    "Restricted" (not "Anyone with the link")
# 2. Uncheck "Allow users to share files with anyone via link sharing"
# 3. Save

This recommendation verifies that Access Checker Default Is Set to Recipients Only on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# Verify "Access checker" is set to "Recipients only"
# This ensures only explicitly shared users can access files

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# 1. Under "Access checker":
#    Set to "Recipients only"
# 2. This prevents users from changing access to "Anyone with the link"
# 3. Save

This setting ensures that Shared Drive Creation Is Restricted to Specific Groups on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# Verify "Creating shared drives" is set to specific users or groups
# Not "All members of the organization"

gam print shareddrive

# Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings
# 1. Under "Shared drive creation":
#    Set to "Only specific users and groups can create shared drives"
# 2. Specify the allowed groups (e.g., shared-drive-creators@domain.com)
# 3. Save

This recommendation verifies that DLP Rules Are Configured for Sensitive Data on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Security > Access and data control > Data protection
# Verify DLP rules exist for sensitive data patterns:
#   - Credit card numbers
#   - Social Security numbers
#   - Custom patterns for org-specific data

# List DLP rules via API:
gam print dlp rules

# Admin Console > Security > Access and data control > Data protection
# 1. Click "Manage rules" > "Add rule"
# 2. Select trigger: "Drive - File modified/created/uploaded"
# 3. Add conditions: select PII detectors (SSN, Credit Card, etc.)
# 4. Set action: "Block external sharing" or "Warn user"
# 5. Assign to organizational units and save

This recommendation verifies that Google Vault Retention Rules Are Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Google Vault retention rules
# Google Vault > Retention > Custom rules
# Verify retention rules cover:
#   - Gmail messages
#   - Drive files
#   - Chat messages

# Verify default retention rule exists:
# Google Vault > Retention > Default retention rules

# Google Vault > Retention
# 1. Click "Default retention rules" > Set default for all services
# 2. Set retention period (e.g., 7 years for compliance)
# 3. Click "Custom rules" > "Create" for specific policies:
#    - Name: "Financial Records Retention"
#    - Service: Gmail + Drive
#    - Condition: Label contains "Financial"
#    - Duration: 7 years
# 4. Save

This setting ensures that Drive for Desktop Is Restricted or Controlled on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications
# Verify "Drive for desktop" settings:
#   - Disabled or restricted to managed devices only

# Check current setting:
# Admin Console > Devices > Settings > Drive for desktop

# Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications
# 1. Under "Drive for desktop":
#    Uncheck "Allow Drive for desktop in your organization"
#    Or set to "Allow only on managed devices"
# 2. Save

# If allowing on managed devices:
# Admin Console > Devices > Settings > Drive for desktop
# Enable "Require device management"

This setting ensures that Add-Ons for Docs Sheets and Slides Are Restricted on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications
# Under "Add-ons":
# Verify "Allow users to install Google Docs add-ons from add-ons store"
# is unchecked or restricted to allowlisted add-ons

# Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications
# 1. Under "Add-ons":
#    Uncheck "Allow users to install Google Docs add-ons from add-ons store"
# 2. If add-ons are needed, use Marketplace allowlisting:
#    Admin Console > Apps > Google Workspace Marketplace apps > Settings
#    Set to "Allow users to install only selected apps"
# 3. Save

This recommendation verifies that Advanced Mobile Management Is Enabled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# Verify "Mobile management" is set to "Advanced"
# (not "Basic" or "Off")

gam print mobile | head -20

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# 1. Under "Mobile management":
#    Select "Advanced" (requires Workspace Business Plus or Enterprise)
# 2. Apply to all organizational units
# 3. Save

This recommendation ensures that Device Approval Is Required Before Accessing Data on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# Verify "Device approval" is enabled
# Setting: "Require admin approval for device access" = ON

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# 1. Enable "Require admin approval before a device can access data"
# 2. Configure auto-approval rules if needed:
#    Admin Console > Devices > Approval
# 3. Save

This recommendation ensures that Screen Lock Is Required on Managed Devices on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# Under "Screen lock":
# Verify "Require users to set a screen lock" is ON
# Verify minimum password type is set (PIN, Password, or Pattern)

gam print mobile | grep -i screen

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# 1. Under "Screen lock":
#    Enable "Require users to set a screen lock"
# 2. Set minimum password requirements:
#    Type: Password (not Pattern or None)
#    Minimum length: 6 characters
# 3. Save and apply to all OUs

This recommendation ensures that Device Encryption Is Required on the Google Workspace cloud collaboration platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Google Workspace cloud collaboration platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# Under "Encryption":
# Verify "Require device encryption" is ON for all managed devices

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# 1. Under "Encryption":
#    Enable "Require device encryption"
# 2. Set device compliance action for unencrypted devices:
#    "Block device" or "Wipe account after 24 hours"
# 3. Save and apply to all OUs

This recommendation verifies that Auto Account Wipe Is Enabled After 30 Days of Inactivity on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# Under "Inactive devices":
# Verify auto-wipe is configured for inactive devices
# Check threshold period (should be 30 days or less)

# Admin Console > Devices > Mobile and endpoints > Settings > Universal
# 1. Under "Account wipe":
#    Enable "Wipe account from inactive device"
#    Set period to 30 days
# 2. Save

# Manually wipe inactive devices:
gam print mobile query "status:inactiveOver30Days" | gam csv - gam update mobile ~deviceId action account_wipe

This recommendation verifies that Chrome Browser Cloud Management Is Enrolled on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Devices > Chrome > Managed browsers
# Verify Chrome Browser Cloud Management is active
# Check enrollment token is deployed

# Verify enrolled browser count:
# Admin Console > Devices > Chrome > Managed browsers > Browser list

# 1. Admin Console > Devices > Chrome > Managed browsers > Setup
# 2. Copy the enrollment token
# 3. Deploy token via Group Policy (Windows):
#    HKLM\SOFTWARE\Policies\Google\Chrome\CloudManagementEnrollmentToken
# 4. Or deploy via MDM profile (macOS):
#    com.google.Chrome > CloudManagementEnrollmentToken
# 5. Verify enrollment in Admin Console

This recommendation verifies that Safe Browsing Is Set to Enhanced Protection on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Devices > Chrome > Settings > Users & browsers
# Under "Safe Browsing":
# Verify level is set to "Enhanced protection"
# (not "Standard protection" or "No protection")

# Admin Console > Devices > Chrome > Settings > Users & browsers
# 1. Search for "Safe Browsing"
# 2. Set "Safe Browsing protection level" to:
#    "Enhanced protection" (not Standard)
# 3. Save and apply to target OUs

# Via Chrome policy (Windows registry):
# HKLM\SOFTWARE\Policies\Google\Chrome\SafeBrowsingProtectionLevel = 2

This recommendation verifies that Password Manager Is Configured per Policy on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Devices > Chrome > Settings > Users & browsers
# Search for "Password Manager"
# Verify settings align with organizational policy:
#   - Password Manager enabled/disabled per policy
#   - Password leak detection: ON

# Admin Console > Devices > Chrome > Settings > Users & browsers
# 1. Search for "Password Manager"
# 2. Configure per organizational policy:
#    - Enable or disable built-in password manager
#    - Enable "Password leak detection"
#    - Set "Password alert" to protect against phishing
# 3. Save

This setting ensures that Extensions Are Restricted to Allowlisted Only on the Google Workspace cloud collaboration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Workspace cloud collaboration platform is essential for defense in depth.

# Admin Console > Devices > Chrome > Apps & extensions
# Check extension management policy:
#   - Verify "Allow/Block mode" is set to allowlist
#   - Review approved extensions list

# Check for force-installed extensions:
# Admin Console > Devices > Chrome > Apps & extensions > Users & browsers

# Admin Console > Devices > Chrome > Apps & extensions > Users & browsers
# 1. Set "Allow/Block mode" to "Block all apps, admin manages allowlist"
# 2. Add approved extensions by ID
# 3. Configure force-install for required extensions:
#    Click "+" > Enter extension ID > Set to "Force install"
# 4. Save and apply to target OUs

This recommendation verifies that Admin Audit Log Events Are Monitored on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Reporting > Audit and investigation > Admin log events
# Verify admin activity logs are being captured
# Check for recent events (last 24h)

# Or via API:
gam report admin start -7d | head -20

# Admin audit logging is ON by default in Google Workspace
# To configure monitoring alerts:
# Admin Console > Security > Alert center > Alert rules
# 1. Create rule: "Super admin activity"
# 2. Trigger: Admin log event where action = any
# 3. Set notification: Email to security@domain.com
# 4. Save

This recommendation verifies that Login Audit Events Are Monitored on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Reporting > Audit and investigation > Login log events
# Verify login events are being captured
# Check for suspicious events (failed logins, unusual locations)

# Or via API:
gam report login start -7d | grep -i "login_failure" | head -20

# Login audit logging is ON by default
# Configure alerts for suspicious logins:
# Admin Console > Security > Alert center > Alert rules
# 1. Create rule: "Suspicious login activity"
# 2. Trigger: Login events with suspicious or government-backed attack warning
# 3. Set notification: Email + mobile to security team
# 4. Save

This recommendation verifies that Drive Audit Log Events Are Monitored on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Reporting > Audit and investigation > Drive log events
# Verify Drive sharing events are being logged
# Check for external sharing events

# Or via API:
gam report drive start -7d parameters shared_externally | head -20

# Drive audit logging is ON by default
# Configure alerts for sensitive sharing:
# Admin Console > Security > Alert center > Alert rules
# 1. Create rule: "External file sharing detected"
# 2. Trigger: Drive log event where visibility = shared_externally
# 3. Set notification: Email to data-security@domain.com
# 4. Save

This recommendation verifies that Alert Center Is Configured for Critical Events on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Security > Alert center
# Verify the following alert types are active:
#   - Suspicious login activity
#   - Government-backed attack warning
#   - Device compromised
#   - Data export initiated
#   - Admin password reset

# Admin Console > Security > Alert center
# 1. Review all system-defined alerts and enable notifications
# 2. For each critical alert type, click and configure:
#    - Notification recipients: security-team@domain.com
#    - Notification method: Email
# 3. Create custom rules for additional events as needed
# 4. Test alert delivery via the "Send test alert" option

This recommendation verifies that BigQuery Export of Audit Logs Is Configured on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Reporting > BigQuery Export
# Verify BigQuery export is enabled
# Check Google Cloud project ID and dataset name

# Verify data is flowing:
# Go to BigQuery console > Navigate to the dataset > Check recent tables

# Admin Console > Reporting > BigQuery Export
# 1. Click "Enable BigQuery export"
# 2. Enter Google Cloud project ID
# 3. Select or create a dataset
# 4. Enable all log types (Admin, Login, Drive, etc.)
# 5. Save

# Verify in BigQuery console:
# SELECT * FROM `project.dataset.activity`
# WHERE time > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 DAY)
# LIMIT 10

This recommendation verifies that Security Investigation Tool Is Used for Incident Response on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Security > Investigation tool
# Verify access to the Security investigation tool
# Check that admins can query across log sources
# Verify recent investigations have been run

# Admin Console > Security > Investigation tool
# 1. Ensure admins with appropriate roles can access the tool
# 2. Create saved queries for common investigation scenarios:
#    - Suspicious login patterns across users
#    - Mass file downloads from Drive
#    - Admin role changes
# 3. Assign investigation roles to security team members:
#    Admin Console > Admin roles > Create role with "Investigation" privileges

This recommendation verifies that Data Regions Policy Is Configured for Compliance on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Admin Console > Account > Account settings > Data regions
# Verify data region policy is configured if required by compliance
# Check assigned regions for covered services (Gmail, Drive, etc.)

# Admin Console > Account > Account settings > Data regions
# 1. Click "Data regions" > Select a policy:
#    - "United States" for US data residency
#    - "Europe" for EU/GDPR compliance
#    - "No preference" (not recommended for compliance)
# 2. Select covered data types (at rest only)
# 3. Apply to organizational units as needed
# 4. Save (changes may take 24-48 hours)

This recommendation verifies that Workspace Audit Logs Are Forwarded to SIEM on the Google Workspace cloud collaboration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Google Workspace cloud collaboration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify audit log forwarding to SIEM
# Option 1: BigQuery export + SIEM connector
# Option 2: Google Workspace Activity API polling
# Option 3: Cloud Pub/Sub push subscription

# Test API access:
gam report admin start -1d | wc -l

# Method 1: BigQuery Export + SIEM
# 1. Enable BigQuery Export (see 6.2.1)
# 2. Configure SIEM to ingest from BigQuery

# Method 2: Pub/Sub Push
# 1. Create Cloud Pub/Sub topic: workspace-audit-logs
# 2. Create push subscription to SIEM endpoint
# 3. Configure workspace event routing to Pub/Sub

# Method 3: API Polling
# 1. Use Reports API with service account
# 2. Schedule polling every 5-15 minutes
# 3. Forward events to SIEM ingestion endpoint