Checks

The User's password changed system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to Medium or higher. This ensures administrators are promptly notified when user passwords are changed.

The User suspended due to suspicious activity system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to High or higher. This ensures administrators are notified when Google suspends an account due to a potential compromise.

The Suspicious login system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to Low or higher. This ensures administrators are notified when Google detects a sign-in attempt that does not match a user's normal behavior.

The Suspicious programmatic login system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to Low or higher. This ensures administrators are notified when Google detects suspicious login attempts from applications or programs.

The domain-level policy enforces 2-Step Verification for all users, allows users to turn it on, keeps the new user enrollment period at two weeks or less, disables device trust and excludes verification codes via text or phone call from the accepted methods.

The domain-level 2-Step Verification policy requires hardware security keys only as the allowed sign-in factor, with enforcement on or scheduled and a policy suspension grace period of at most one day. Note: the Policy API returns domain-wide policies only and cannot verify admin role-specific enforcement.

The domain-level policy enables the Advanced Protection Program with user self-enrollment and blocks the use of security codes. The Advanced Protection Program is Google's strongest account security offering, requiring hardware security keys and applying a curated set of high-security policies.

The domain-level API controls configuration restricts third-party app access to at least one Google service. This check verifies that the administrator has configured API access controls rather than leaving all services at the unrestricted default. The CIS benchmark recommends restricting access to all applicable services, particularly high-risk scopes like Drive and Gmail.

At least one active Data Loss Prevention (DLP) rule targeting Google Drive file sharing is configured. DLP policies detect and prevent users from sharing sensitive information such as credit card numbers, identity numbers, and other regulated data through Drive.

The domain-level API controls configuration trusts internal domain-owned apps to access restricted Google Workspace APIs. This avoids the need to individually trust each internal app.

The domain-level policy disables access to less secure apps that do not use modern security standards such as OAuth. Blocking these apps helps keep user accounts and organizational data safe.

The domain-level login challenges configuration has the employee ID challenge disabled. This check is not mapped to CIS 4.1.4.1 because that recommendation also requires Post-SSO verification, a setting not exposed by the Cloud Identity Policy API, so the requirement cannot be evaluated end to end.

The domain-level password policy is configured with enhanced security settings: minimum length of 14 characters, strong passwords enforced, password reuse disallowed, enforcement at next sign-in enabled, and password expiration set to 365 days.

The domain-level Google session control limits web session duration to 12 hours or less. When a session expires, users must re-authenticate, reducing the window of opportunity for session hijacking.

The domain-level policy disables self-service account recovery for Super Admin accounts. When disabled, Super Admins cannot use recovery options (phone, email) to regain access, reducing the risk of account takeover through compromised recovery channels.

The domain-level policy enables self-service account recovery for non-Super Admin users. When enabled, users can recover access to their accounts if their password is forgotten, reducing helpdesk burden and downtime.

The domain-wide Google Sites configuration has the service disabled for all users. Google Sites allows users to create internal and external websites, which may expose sensitive information or create unmanaged content outside the organization's control.