Checks

The Additional Google services configuration disables access to external Google Groups for all users. This setting controls whether users can access groups created outside the organization from their Google Workspace account.

The domain-wide Google Calendar configuration warns users when they invite guests from outside the organization to an event. This prompt gives users a chance to reconsider before sharing meeting details with external parties, reducing the likelihood of accidental information disclosure through calendar invitations.

The domain-wide default for primary calendars shares only free/busy information with external users. When external sharing is set to share full event details, sensitive information such as meeting titles, attendees, locations, and descriptions is exposed to users outside the organization.

The domain-wide default for secondary calendars shares only free/busy information with external users. Secondary calendars are additional calendars users create beyond their primary calendar (e.g., for projects, teams, or personal events), and are commonly used to organize sensitive or focused activities that should not be visible to external parties.

Google Chat apps connect to external services to look up information, schedule meetings, or complete tasks. Apps are accounts created by Google, users in the organization, or third parties that can access user data including email addresses, conversation content, and organizational information.

Google Chat external file sharing controls whether users can share files with people outside the organization via Chat conversations. Files often contain confidential information, and organizations in regulated industries need to control the flow of this information outside their boundaries.

Google Chat external messaging controls whether users can send messages to people outside the organization. If external messaging is allowed, it can optionally be restricted to only allowlisted domains to limit the scope of external communication.

Google Chat external spaces allow users to create or join collaborative spaces that include people outside the organization. If external spaces are allowed, they can optionally be restricted to only allowlisted domains to limit external participation.

Incoming webhooks let external applications post asynchronous messages into Google Chat spaces without being a Chat app. When enabled, users can configure webhooks and developers can call them to send content from external applications.

Google Chat internal file sharing controls whether users can share files with other people inside the organization via Chat conversations. Organizations in regulated industries may need to control and audit all file sharing, even between internal users.

Google Workspace domain has between 2 and 4 super administrators.

Having too few super admins creates a single point of failure and administrative access issues if the only admin is unavailable. Having too many super admins increases the attack surface and the risk of unauthorized access to critical administrative functions.

Super admin accounts do not also hold additional admin roles such as Groups Admin, User Management Admin, etc. Each super administrator has a separate, non-admin account for daily activities, following the principle of least privilege.

The domain-wide Access Checker configuration ensures that when a user shares a Drive file via a Google product other than Drive itself (e.g. by pasting a link in Gmail), the suggestions never expand sharing to a wider audience or to anyone with the link. Access Checker is set to recipients only.

The domain-wide default disables Google Drive for desktop for the organization. The Drive for desktop client synchronizes Drive content to local devices and uses its own "offline" mechanism that does not respect the central offline-access device policy, so disabling it closes a synchronization channel that would otherwise place organizational content on potentially unmanaged endpoints.

The domain-wide Drive and Docs configuration warns users when they attempt to share a file with users outside the organization. This prompt gives users an opportunity to reconsider before exposing organizational content to external parties, reducing the likelihood of accidental data disclosure through everyday sharing actions.

The domain-wide default restricts distributing organizational content to shared drives owned by another organization to eligible internal users only. This prevents external collaborators with manager access to internal shared drives from moving content out of the organization.

The domain-wide Drive and Docs default prevents users from publishing files to the web or making them visible to the world as public or unlisted. Publishing a file to the web exposes its content to anyone on the internet, often without any audit trail, making it one of the highest-impact misconfigurations available to end users.

The domain-wide default allows users to create new shared drives. Shared drives are owned by the organization (not the individual user), so content stored in them survives the deletion of the original creator's account, supporting data continuity and reducing the risk of accidental data loss.

The domain-wide default prevents viewers and commenters of files stored in shared drives from downloading, printing, or copying the file contents. They can only read and comment on the existing content, preventing bulk extraction of sensitive material from shared drives.

The domain-wide default prevents members with manager access to a shared drive from overriding the shared drive settings established by administrators. This ensures that security controls — such as external access, member-only access, and download restrictions — cannot be relaxed at the individual shared drive level.

The domain-wide default restricts shared drive file access to explicit members only. Non-members cannot be added to individual files inside the drive, preserving the shared drive's membership boundary as the authoritative access control surface.

The domain-wide default restricts external sharing of Drive and Docs files to a curated list of allowlisted domains, rather than allowing sharing with arbitrary external recipients. This converts external sharing from an open default into a controlled allow-list that aligns with documented business relationships.

At the domain level, even when external sharing is restricted to allowlisted domains, Google Drive warns users before they share a file with a user in an allowlisted domain. This second-step prompt helps users recognize when they are crossing the organizational boundary, even within permitted destinations.

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when emails contain anomalous attachment types. Unusual file types that are uncommon for the sender or organization may indicate an attempt to deliver malware through less-scrutinized formats.