Google Workspace Security: A Practical Admin Checklist

Google Workspace security depends on how the Admin console is configured. Google supplies the platform defenses. Your administrators decide who can sign in, how mail is authenticated, what can be shared outside the company and which apps can reach company data. This guide covers the settings to change first, a checklist you can work through, and a routine for keeping those settings correct over time.

TL;DR

• Enforce 2-Step Verification for every user, and require hardware security keys for administrators and other high-value accounts.
• Configure SPF, DKIM and DMARC, disable POP and IMAP for users who do not need them, and block automatic forwarding to outside addresses.
• Restrict external sharing, review third-party app access, and add data loss prevention rules for sensitive content.
• Use the Security Center and audit logs on a schedule, and keep a written plan for a suspected compromised account.
• Regulated organizations such as healthcare providers, law firms and lenders should have their configuration reviewed against the rules that apply to them.

Table of Contents

• How secure is Google Workspace out of the box?
• Start with accounts and administrator access
• Protect email: authentication, forwarding and filtering
• Control sharing and sensitive data in Drive
• Review third-party apps and context-aware access
• Monitor with the Security Center and audit logs
• A Google Workspace security checklist you can work through
• Use CISA's free baselines to check your work
• Keep it secure over time
• Our perspective on Workspace security
• Get Workspace security managed for you
• FAQ
• Sources

How secure is Google Workspace out of the box?

Google Workspace includes built-in threat defenses and security controls that help prevent phishing and malware. Google also states that data at rest is encrypted on disks and backup media, and data in transit is encrypted over the internet and between its data centers. Google describes its architecture as built on a zero-trust model designed to protect information against threats such as ransomware and supply chain attacks.

That is the provider side. The customer side is where most small and mid-size businesses are exposed: weak sign-in rules, permissive sharing, unreviewed apps and nobody watching the alerts. A platform that encrypts everything still cannot stop an employee from approving a malicious app or an administrator account from being protected by a password alone.

Gmail adds a useful layer for attachments. It can scan or run attachments in the Security Sandbox, a virtual environment, and place attachments identified as threats in users' Spam folders or quarantine them. These protections need to be reviewed in your own console, because the setting that applies to your organization is the one an administrator chose.

Start with accounts and administrator access

Account takeover is the most common way a Workspace tenant is compromised, so sign-in controls come first. Google's checklist for larger organizations tells administrators to enforce 2-Step Verification for all users and mandate hardware security keys for high-value accounts. It also lists strong, unique password policies among the first steps.

In practice, work through these in order:

1. Turn on 2-Step Verification and set an enforcement date. Announce it, give users a short window to enroll, then enforce it. Do not leave it as an option.
2. Issue security keys to administrators. Super administrators, finance staff, executives and anyone who approves payments are the accounts an attacker wants most.
3. Create more than one administrator account, and keep them separate from daily use. Google's guidance for small businesses without a dedicated IT administrator includes redundant admin accounts, so that losing one login does not lock the company out of its own tenant.
4. Limit the number of super administrators. Give delegated roles to people who only need to reset passwords or manage groups.
5. Remove accounts of departed staff the same day. Suspend, transfer data, then delete according to your retention needs.

The same discipline applies to any cloud tenant. If your company also runs Microsoft, our Microsoft 365 global admin best practices follow the same principles of few, protected and separated privileged accounts.

Protect email: authentication, forwarding and filtering

Email is where phishing arrives and where data quietly leaves. Three areas deserve attention.

Authenticate your domain

Google lists email authentication with SPF, DKIM and DMARC among the critical first steps. In plain terms:

• SPF publishes which servers may send mail for your domain.
• DKIM adds a cryptographic signature so receivers can confirm a message was not altered and came from your domain.
• DMARC tells receiving servers what to do when SPF or DKIM checks fail, and sends you reports.

Start DMARC in monitoring mode, read the reports to find legitimate senders you forgot (billing platforms, marketing tools, ticketing systems), then move toward quarantine and reject. Skipping the monitoring stage is how companies end up blocking their own invoices.

Close legacy access and silent forwarding

Google advises disabling POP and IMAP for users who do not explicitly need them and preventing users from automatically forwarding incoming mail to another address. Attackers who gain access to a mailbox often create a forwarding rule so they keep receiving copies after the password is reset. Blocking automatic forwarding at the domain level removes that option.

Filter inbound and outbound content

Gmail data loss prevention rules can scan inbound or outbound email for sensitive data using predefined detectors and automatically quarantine, reject or modify messages based on content. A mortgage company might flag Social Security numbers leaving the domain. A medical practice might flag patient identifiers. Start with a small number of rules in a quarantine action, tune them for a few weeks, then tighten.

Filtering also protects your domain's reputation. If you want a deeper look at how spam filtering decisions work, this overview of email spam filtering is a good companion to the settings above.

Control sharing and sensitive data in Drive

Shared files are the second major leak path. The Admin console lets administrators set up DLP rules for content filtering and establish Drive trust rules for sharing. A sensible baseline for a small business:

• Set the default so files are shared only inside the organization, and allow outside sharing only with named domains you trust.
• Require a warning when a user shares a file outside the company.
• Disable "anyone with the link" sharing for shared drives that hold finance, HR or client records.
• Assign shared drive ownership to the company, not to individual employees, so files remain when people leave.
• Review the Security Center's external sharing view regularly. It provides a dashboard for external file sharing alongside spam and malware metrics.

CISA's guidance also notes that organizations should carefully craft and review data governance policies so that data lifecycle security is enforced across the enterprise. For a small business, that means writing down what data you hold, where it lives and how long you keep it, then configuring retention to match.

Review third-party apps and context-aware access

Every app a user connects with "Sign in with Google" can receive a token that reaches company mail or files. Google's checklist directs administrators to manage third-party app access. The practical steps:

1. Open the app access controls in the Admin console and list every connected app.
2. Block unverified apps by default, and approve specific apps through an allowlist.
3. Remove tokens for apps nobody recognizes or that no longer have a business purpose.
4. Repeat the review every quarter, and whenever someone reports a strange consent prompt.

For tighter control, administrators can use Context-Aware Access to create app security policies based on user identity, location, device security status and IP address. A common small business policy allows access to Gmail and Drive only from devices that are enrolled and meet your screen lock and encryption requirements, and requires more checks from unmanaged devices.

Monitor with the Security Center and audit logs

Settings drift, and attacks leave traces. Google tells administrators to visit the Security Center regularly to review their security posture, investigate incidents and take action, to review the Admin audit log, and to audit Vault activity on a regular basis.

The Security Center brings together external sharing, spam and malware metrics, and lets administrators take organization-wide actions such as deleting malicious email. Its investigation tool supports organization-wide searches across Gmail, Drive and device logs and lets you pivot from one search to the next. If a user reports a phishing message, you can find every other mailbox that received it and remove it.

Set up alert emails for the events you cannot afford to miss: suspicious sign-ins, new administrator roles, changes to mail routing, and disabled 2-Step Verification. An alert nobody reads is the same as no alert, so assign a named person and a backup.

If an account may be compromised

Google's guidance is to suspend the account, investigate it for malicious activity, review associated mobile devices and take action if necessary. A short written runbook helps when the pressure is on:

1. Suspend the account and reset the password.
2. Check mail forwarding rules, delegated access and connected apps.
3. Search the audit log and investigation tool for what the account accessed or sent.
4. Review and, if needed, wipe the associated mobile devices.
5. Notify affected people and, for regulated data, your compliance contact or counsel.

A Google Workspace security checklist you can work through

Use this table as a first pass. It follows the areas Google's own checklists cover: accounts, email authentication, data governance, device management and continuous monitoring.

Use CISA's free baselines to check your work

CISA created the SCuBA project in 2022 to address cybersecurity and visibility gaps exposed by SaaS intrusions, and it provides secure configuration baselines for Google Workspace and Microsoft 365. Any organization can use them, not only agencies. CISA's ScubaGoggles tool is a no-cost way to verify whether a Workspace configuration conforms to those baselines and to highlight areas for improvement.

For healthcare, legal and financial organizations, a baseline is a starting point and not a compliance finding. Which controls are available can depend on your Workspace edition, so confirm in Google's documentation what your plan includes, and have the configuration mapped to the regulation that applies to you, such as HIPAA for patient data. Our compliance and security audits are built for that mapping.

Keep it secure over time

A one-time hardening project fades. Small organizations without a dedicated administrator do better with a short, repeating routine:

• Weekly: read Security Center alerts and the sign-in anomalies. Confirm that no one disabled 2-Step Verification.
• Monthly: review new administrator roles, new shared drives, external sharing reports and offboarded accounts.
• Quarterly: audit connected apps, DMARC reports, Context-Aware Access rules and DLP matches. Re-run ScubaGoggles.
• Yearly: test the compromised-account runbook with a drill and review retention rules.

Two gaps often sit outside the security settings. The first is people: phishing that gets past filters depends on what employees do next, and employee security awareness training reduces that human risk. The second is recovery. Google's own retention does not replace a separate backup, and our guide on closing Google's data gap with Workspace backup explains how to cover it.

If you want a measured view of where the whole business stands, beyond Workspace, the cybersecurity risk assessment gives a score, and the small business cybersecurity checklist lists the next priorities. Your public site belongs in the picture too, and these website security basics show how brand trust and site protection connect.

Our perspective on Workspace security

Most Workspace incidents we see in small and mid-size organizations do not come from a flaw in Google. They come from a setting nobody owned: an administrator without a security key, a forwarding rule nobody checked, an app approved years ago by someone who has since left.

Our approach is proactive and preventative. We would rather harden the tenant, watch it around the clock and fix a drifting setting than respond after a mailbox has been emptied. For healthcare practices, law firms and lenders in Southern California, that also means configuration decisions are documented, so a compliance review is a conversation and not a scramble.

The right model is shared responsibility with a named owner. Google protects the platform. Someone has to be accountable for the console, and for most growing businesses a managed IT partner is a more dependable owner than a task added to an office manager's list.

Alex

Get Workspace security managed for you

Secure Techies provides managed IT services and managed cybersecurity for small and mid-size businesses in Southern California, including Microsoft 365 and Google Workspace administration, 24/7 monitoring and compliance audits for HIPAA, SEC and other standards. We can review your tenant against the checklist above and then keep it that way.

Explore our managed IT services or our cybersecurity solutions to see how we work.

FAQ

How secure is Google Workspace email?

Google states that Workspace includes built-in defenses against phishing and malware and encrypts data at rest and in transit. Gmail can also sandbox suspicious attachments. The result for your company still depends on your configuration, including 2-Step Verification, email authentication and forwarding rules.

What should I configure first in the Google Admin console?

Start with 2-Step Verification for all users and security keys for administrators. Then publish SPF, DKIM and DMARC, turn off POP and IMAP where they are not needed, and block automatic forwarding. These are the first steps in Google's own checklist for larger businesses.

Can a small business without an IT person secure Workspace?

Yes, to a baseline. Google publishes checklists for small businesses covering redundant admin accounts, protection against phishing and spoofing, and sharing permissions. Ongoing monitoring, app reviews and incident response are where many small teams benefit from outside help.

Is Google Workspace enough for HIPAA or SEC-aligned security?

Not on its own. Compliance depends on your edition, your configuration, your agreements and your policies. Have the setup reviewed against the specific regulation that applies to your organization before relying on it for regulated data.

How often should I review Workspace security settings?

Check alerts weekly, review roles and sharing monthly, and audit connected apps and email authentication reports quarterly. Run a compromised-account drill once a year so the team knows the steps before they are needed.

Sources

• Advanced Security & Threat Prevention, Google Workspace
• Zero Trust Whitepaper, Google
• Overview: Choose Gmail content filtering and data protection options
• How Google Workspace helps protect your org
• Security checklist for medium and large businesses
• Security checklists, Google Workspace Admin Help
• Admin Security Dashboard & Analytics, Google Workspace
• Secure Cloud Business Applications (SCuBA) Project, CISA

Recommended

• SMBs: Close Google’s 20–30 Day Data Gap With Workspace Backup
• Remote Work Security: One Checklist for Employees and IT