Google Workspace: ten checks for your admin.

Ten checks to complete with your administrator.

Use this with the administrator responsible for your Google Workspace tenant. The boxes are a session checklist, not a security score or a saved audit. Record evidence, exceptions, owners, and dates in your team's own tracker.

1. 1. Protect sign-in

   Review 2-Step Verification enrollment and enforcement. Choose strong methods appropriate to the users, and prepare account recovery before enforcing a new policy.

2. 2. Protect administrative identities

   Review super administrators and delegated roles. Use the minimum privileges needed and separate routine work from administrative activity.

3. 3. Prepare recovery

   Document who can recover an administrator account and how. Protect recovery methods, avoid reliance on one employee or device, and test the process safely.

4. 4. Review connected applications

   Inspect third-party application access, OAuth scopes, and ownership. Restrict access where appropriate and provide a documented approval route for needed tools.

5. 5. Check mail authentication

   Review SPF, DKIM, and DMARC across all legitimate senders. Test and monitor changes so an enforcement policy does not unexpectedly block approved mail.

6. 6. Review Drive sharing

   Inspect external sharing, link access, shared drives, and sensitive folders. Check existing files as well as defaults for new ones. Notify users about changed collaboration rules.

7. 7. Review devices

   Identify managed and unmanaged devices, patch ownership, encryption expectations, and lost-device procedures. Confirm which controls your edition supports.

8. 8. Review mail access

   Check forwarding, delegation, routing rules, and recovery information. Investigate unfamiliar settings with the security owner.

9. 9. Review logs and alerts

   Confirm available events, retention, administrator access, and alert delivery. Assign an investigator and verify that a test event can be found.

10. 10. Test retention, recovery, and departures

    Use a test account and file to establish what an administrator can restore. Plan data transfer before deleting an employee account, and distinguish Vault retention from your recovery requirements.

Before changing a setting, verify its availability in your edition and test the effect on a small group. Document any exception and the person authorized to accept it.

References: Google's small-business security checklist · CISA ScubaGoggles. Use the provider's current instructions for your edition.