Google Workspace hardening: a security checklist for businesses

By the QuantumSec team

Google Workspace's default configuration prioritizes ease of use, not maximum security. This checklist, aligned with the CIS Google Workspace Benchmark, walks through the admin console settings that most reduce your attack surface, ordered by impact. Start with admin accounts and authentication: that's where an attacker looks first.

Limit and protect admin accounts

Reduce the number of super admins to two or fewer (the CIS Benchmark recommends this explicitly). Protect every admin account with 2-step verification based on security keys or passkeys, not SMS. Use admin accounts separate from day-to-day accounts, so that phishing a normal employee account doesn't compromise admin privileges.

Enforce 2-step verification (2SV) across the organization

Enable mandatory 2SV for all users, not just admins. Prioritize phishing-resistant methods (physical security keys or passkeys) over SMS codes, which are vulnerable to SIM swapping and interception. Set an enrollment period and monitor that no users are left without 2SV.

Review and restrict third-party (OAuth) apps

Switch Google API access control to a restricted access model: block third-party apps by default and allow only trusted applications through an allowlist. Block apps not verified by Google. Pay special attention to apps with access to Gmail and Drive, which carry the highest risk.

Control sharing in Google Drive

Disable the ability to create public anyone-with-the-link files by default. Limit external sharing to trusted domains or, at minimum, enable warnings when sharing outside the organization. Periodically review which files are shared externally and apply DLP rules to prevent sensitive data from leaving.

Secure Gmail against spoofing and persistence

Configure SPF, DKIM and DMARC to protect your domain from spoofing. Enable advanced anti-phishing and anti-spoofing protection and attachment sandboxing. Audit automatic forwarding rules and filters: a rule that forwards email to an external address is a common persistence mechanism after a compromise.

Set up contextual access and device management

Use Context-Aware Access to condition access on location, device posture or network. Enable endpoint management to inventory the devices that access the Workspace and to be able to block or wipe compromised ones remotely. Restrict or limit access from unmanaged devices.

Enable logging, alerts and retention

Configure alert rules for critical events (privilege changes, suspicious sign-ins, new forwarding rules) and get familiar with the investigation tool. If you have a SIEM, export the audit logs to correlate them. Configure Google Vault for retention and eDiscovery according to your legal obligations.

Audit domain-wide delegation and service accounts

Inventory all service accounts with domain-wide delegation (DWD) and the scopes granted to them: broad delegation allows impersonating any user in the domain. Apply the minimum scopes necessary, rotate service account keys and remove delegations that are no longer in use.

FAQ

Is applying the CIS checklist enough?

The CIS Benchmark is the best configuration baseline, but it doesn't replace an offensive audit: it reviews settings one by one, but it doesn't chain vectors or reproduce what a real attacker would do (OAuth abuse, persistence, escalation). The ideal is to harden with CIS and validate the result with an audit.

How many super admins should I have?

Two or fewer, per the CIS Benchmark recommendation. Having few super admins reduces the attack surface of the most valuable accounts and makes it easier to protect them with security keys and enhanced monitoring.