CISA Secure Cloud Business Applications (SCuBA) Google Workspace Baselines
The CISA Secure Cloud Business Applications (SCuBA) project provides security configuration baselines for Google Workspace. These baselines define minimum security requirements using RFC 2119 requirement levels (SHALL/SHOULD/SHALL NOT) and include mappings to NIST SP 800-53 Rev 5 and MITRE ATT&CK.
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler googleworkspace --compliance cisa_scuba_0.6_googleworkspaceRequirements (133)
Common Controls4223
GWS.COMMONCONTROLS.1.1Phishing-resistant MFA SHALL be required for all users1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
1 Phishing-Resistant MFA
GWS.COMMONCONTROLS.1.2If phishing-resistant MFA is not yet tenable, an MFA method from the list of acceptable MFA methods SHALL be used as an interim solution1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
1 Phishing-Resistant MFA
GWS.COMMONCONTROLS.1.3If phishing-resistant MFA is not yet tenable, SMS or Voice as the MFA method SHALL NOT be used0
Attributes
- Type
SHALL NOT
- Section
Common Controls
- Service
commoncontrols
- Sub Section
1 Phishing-Resistant MFA
GWS.COMMONCONTROLS.1.4The 2SV enrollment period for new users SHALL be set to 1 day to 1 week0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
1 Phishing-Resistant MFA
GWS.COMMONCONTROLS.1.5Allow user to trust the device SHALL be disabled0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
1 Phishing-Resistant MFA
GWS.COMMONCONTROLS.2.1Context-Aware Access device-based policies SHOULD be implemented0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
2 Context-Aware Access
GWS.COMMONCONTROLS.3.1Post-SSO verification for corporate SSO profile SHOULD be enabled0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
3 Login Challenges
GWS.COMMONCONTROLS.3.2Post-SSO verification for other SSO profiles SHOULD be enabled0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
3 Login Challenges
GWS.COMMONCONTROLS.4.1Google Workspace sessions SHALL re-authenticate after 12 hours1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
4 User Session Duration
GWS.COMMONCONTROLS.5.1Password strength SHALL be enforced1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.5.2Minimum password length SHALL be at least 12 characters1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.5.3Minimum password length SHOULD be at least 15 characters1
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.5.4Password policy SHALL be enforced at next sign-in1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.5.5Password reuse SHALL be restricted1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.5.6Password expiration period SHALL NOT be set0
Attributes
- Type
SHALL NOT
- Section
Common Controls
- Service
commoncontrols
- Sub Section
5 Secure Passwords
GWS.COMMONCONTROLS.6.1All admin accounts SHALL be cloud-only and not federated0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
6 Privileged Accounts
GWS.COMMONCONTROLS.6.2Between 2 and 8 super admin users SHALL be configured1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
6 Privileged Accounts
GWS.COMMONCONTROLS.7.1Unmanaged conflicting accounts SHOULD be replaced with managed ones0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
7 Conflicting Account Management
GWS.COMMONCONTROLS.8.1Account recovery for super admins SHALL be disabled1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
8 Account Recovery
GWS.COMMONCONTROLS.8.2Account recovery for non-super admin users SHALL be disabled0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
8 Account Recovery
GWS.COMMONCONTROLS.8.3Adding a recovery phone number and email address SHOULD be disabled0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
8 Account Recovery
GWS.COMMONCONTROLS.9.1Privileged accounts SHALL be enrolled in the Advanced Protection Program1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
9 Advanced Protection Program
GWS.COMMONCONTROLS.9.2Sensitive user accounts SHOULD be enrolled in the Advanced Protection Program1
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
9 Advanced Protection Program
GWS.COMMONCONTROLS.10.1Unconfigured third-party apps SHALL be restricted from accessing GWS services0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
10 App Access to Google APIs
GWS.COMMONCONTROLS.10.2Third-party apps that do not meet minimum access requirements SHALL be blocked0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
10 App Access to Google APIs
GWS.COMMONCONTROLS.10.3Access to high-risk scopes SHALL be blocked unless explicitly trusted0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
10 App Access to Google APIs
GWS.COMMONCONTROLS.10.4OAuth apps with domain-wide delegation SHALL be reviewed periodically0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
10 App Access to Google APIs
GWS.COMMONCONTROLS.10.5Internal apps SHALL be allowed to access restricted Google Workspace APIs1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
10 App Access to Google APIs
GWS.COMMONCONTROLS.11.1Only approved Marketplace apps SHALL be allowed for installation1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
11 Authorized Marketplace Apps
GWS.COMMONCONTROLS.12.1Google Takeout SHALL be disabled for users0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
12 Google Takeout
GWS.COMMONCONTROLS.13.1All system-defined alerting rules SHALL be enabled with alerts sent to admin email addresses8
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
13 System-Defined Rules
GWS.COMMONCONTROLS.14.1Google Workspace logs SHALL be sent to the organization's SIEM0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
14 Google Workspace Logs
GWS.COMMONCONTROLS.14.2Google Workspace logs SHALL be stored for a minimum of 6 months in active storage0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
14 Google Workspace Logs
GWS.COMMONCONTROLS.15.1Data SHALL be stored in the United States0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
15 Data Regions and Storage
GWS.COMMONCONTROLS.15.2Supplemental data storage SHALL be set to the United States0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
15 Data Regions and Storage
GWS.COMMONCONTROLS.16.1Non-essential additional Google services SHALL be disabled for all users0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
16 Additional Google Services
GWS.COMMONCONTROLS.16.2Essential additional Google services SHALL be enabled only for authorized users0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
16 Additional Google Services
GWS.COMMONCONTROLS.17.1Multiple super admins SHOULD be required to approve sensitive admin actions0
Attributes
- Type
SHOULD
- Section
Common Controls
- Service
commoncontrols
- Sub Section
17 Multi-Party Approval
GWS.COMMONCONTROLS.18.1A DLP policy SHALL be configured for Drive1
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
18 Data Loss Prevention
GWS.COMMONCONTROLS.18.2A DLP policy SHALL be configured for Gmail0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
18 Data Loss Prevention
GWS.COMMONCONTROLS.18.3A DLP policy SHALL be configured for Chat0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
18 Data Loss Prevention
GWS.COMMONCONTROLS.18.4The DLP rule severity level SHALL be configured appropriately for the organization0
Attributes
- Type
SHALL
- Section
Common Controls
- Service
commoncontrols
- Sub Section
18 Data Loss Prevention
Gmail4117
GWS.GMAIL.1.1Mail Delegation SHOULD be disabled1
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
1 Mail Delegation
GWS.GMAIL.2.1DKIM SHOULD be enabled for all domains0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
2 DomainKeys Identified Mail
GWS.GMAIL.3.1An SPF policy SHALL be published for each domain that fails all non-approved senders0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
3 Sender Policy Framework
GWS.GMAIL.4.1A DMARC policy SHALL be published at the full domain or the second-level domain for all Google Workspace domains, including user alias domains0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
4 Domain-based Message Authentication, Reporting, and Conformance
GWS.GMAIL.4.2The DMARC message rejection option SHALL be p=reject0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
4 Domain-based Message Authentication, Reporting, and Conformance
GWS.GMAIL.4.3The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
4 Domain-based Message Authentication, Reporting, and Conformance
GWS.GMAIL.4.4An agency point of contact SHOULD be included for aggregate and failure reports0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
4 Domain-based Message Authentication, Reporting, and Conformance
GWS.GMAIL.5.1Protect against encrypted attachments from untrusted senders SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.5.2Protect against attachments with scripts from untrusted senders SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.5.3Protect against anomalous attachment types in emails SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.5.4Google SHOULD be allowed to automatically apply future recommended settings for attachments0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.5.5Emails flagged by SCuBA policies GWS.GMAIL.5.1 through GWS.GMAIL.5.3 SHALL NOT be kept in inbox0
Attributes
- Type
SHALL NOT
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.5.6Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace (GWS)0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
5 Attachment Protections
GWS.GMAIL.6.1Identify links behind shortened URLs SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
6 Links and External Images Protection
GWS.GMAIL.6.2Scan linked images SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
6 Links and External Images Protection
GWS.GMAIL.6.3Show warning prompt for any click on links to untrusted domains SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
6 Links and External Images Protection
GWS.GMAIL.6.4Google SHALL be allowed to automatically apply future recommended settings for links and external images0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
6 Links and External Images Protection
GWS.GMAIL.6.5Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace (GWS)0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
6 Links and External Images Protection
GWS.GMAIL.7.1Protect against domain spoofing based on similar domain names SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.2Protect against spoofing of employee names SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.3Protect against inbound emails spoofing your domain SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.4Protect against any unauthenticated emails SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.5Protect your Groups from inbound emails spoofing your domain SHALL be enabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.6Emails flagged by SCuBA policies GWS.GMAIL.7.1 through GWS.GMAIL.7.5 SHALL NOT be kept in inbox0
Attributes
- Type
SHALL NOT
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.7Google SHALL be allowed to automatically apply future recommended settings for spoofing and authentication0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.7.8Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
7 Spoofing and Authentication Protection
GWS.GMAIL.8.1User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
8 User Email Uploads
GWS.GMAIL.9.1POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
9 POP and IMAP Access for Users
GWS.GMAIL.10.1Google Workspace Sync SHOULD be disabled0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
10 Google Workspace Sync
GWS.GMAIL.11.1Automatic forwarding SHOULD be disabled, especially to external domains1
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
11 Automatic Forwarding
GWS.GMAIL.12.1Using a per-user outbound gateway that is a mail server other than the Google Workspace (GWS) mail servers SHALL be disabled1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
12 Per-user Outbound Gateways
GWS.GMAIL.13.1Unintended external reply warnings SHALL be enabled0
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
13 Unintended External Reply Warning
GWS.GMAIL.14.1An email allowlist SHOULD not be implemented0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
14 Email Allowlist
GWS.GMAIL.15.1Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing1
Attributes
- Type
SHALL
- Section
Gmail
- Service
gmail
- Sub Section
15 Enhanced Pre-Delivery Message Scanning
GWS.GMAIL.15.2Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
15 Enhanced Pre-Delivery Message Scanning
GWS.GMAIL.16.1Security sandbox SHOULD be enabled to provide additional protections for emails0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
16 Security Sandbox
GWS.GMAIL.16.2Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace0
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
16 Security Sandbox
GWS.GMAIL.17.1Comprehensive mail storage SHOULD be enabled to allow information traceability across applications1
Attributes
- Type
SHOULD
- Section
Gmail
- Service
gmail
- Sub Section
17 Comprehensive Mail Storage
GWS.GMAIL.18.1Domains SHALL NOT be added to lists that bypass spam filters0
Attributes
- Type
SHALL NOT
- Section
Gmail
- Service
gmail
- Sub Section
18 Spam Filtering
GWS.GMAIL.18.2Domains SHALL NOT be added to lists that bypass spam filters and hide warnings0
Attributes
- Type
SHALL NOT
- Section
Gmail
- Service
gmail
- Sub Section
18 Spam Filtering
GWS.GMAIL.18.3Bypass spam filters and hide warnings for all messages from internal and external senders SHALL NOT be enabled0
Attributes
- Type
SHALL NOT
- Section
Gmail
- Service
gmail
- Sub Section
18 Spam Filtering
Drive and Docs176
GWS.DRIVEDOCS.1.1External sharing SHALL be restricted to allowlisted domains1
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.2Receiving files from outside of allowlisted domains SHOULD be disabled0
Attributes
- Type
SHOULD
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.3Warnings SHALL be enabled when a user is attempting to share with someone not in allowlisted domains1
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.4If sharing outside of the organization, then agencies SHOULD disable sharing of files with individuals who are not using a Google account0
Attributes
- Type
SHOULD
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.5Any OUs that do allow external sharing SHOULD disable making content available to anyone with the link1
Attributes
- Type
SHOULD
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.6Agencies SHALL set access checking to recipients only1
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.7Users SHOULD NOT be allowed to upload or move content to shared drives owned by another organization0
Attributes
- Type
SHOULD NOT
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.8Private to owner SHALL be the default access level for newly created items0
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.9Out-of-Domain file-level warnings SHALL be enabled1
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.10If external sharing is not allowed, then forms owned by users within the organization SHOULD NOT be able to accept responses from anyone with the link outside the organization0
Attributes
- Type
SHOULD NOT
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.1.11If receiving external files is not allowed, then users in the organization SHOULD NOT be able to submit responses to forms from users or shared drives outside of the organization0
Attributes
- Type
SHOULD NOT
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
1 Sharing Outside the Organization
GWS.DRIVEDOCS.2.1Agencies SHOULD NOT allow members with manager access to override shared Google Drive creation settings1
Attributes
- Type
SHOULD NOT
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
2 Shared Drive Creation
GWS.DRIVEDOCS.2.2Agencies SHALL allow users who are not shared Google Drive members to be added to files0
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
2 Shared Drive Creation
GWS.DRIVEDOCS.3.1Agencies SHALL enable the security update for Google Drive files0
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
3 Security Updates for Files
GWS.DRIVEDOCS.4.1Agencies SHOULD disable Google Drive SDK access0
Attributes
- Type
SHOULD
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
4 Drive SDK
GWS.DRIVEDOCS.5.1Agencies SHALL disable Google Drive Add-Ons0
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
5 User Installation of Drive and Docs Add-Ons
GWS.DRIVEDOCS.6.1Google Drive for Desktop SHALL be enabled only for authorized devices0
Attributes
- Type
SHALL
- Section
Drive and Docs
- Service
drivedocs
- Sub Section
6 Drive for Desktop
Calendar63
GWS.CALENDAR.1.1External Sharing Options for Primary Calendars SHALL be configured to Only free/busy information (hide event details)1
Attributes
- Type
SHALL
- Section
Calendar
- Service
calendar
- Sub Section
1 External Sharing Options
GWS.CALENDAR.1.2External sharing options for secondary calendars SHALL be configured to Only free/busy information (hide event details)1
Attributes
- Type
SHALL
- Section
Calendar
- Service
calendar
- Sub Section
1 External Sharing Options
GWS.CALENDAR.2.1External invitations warnings SHALL be enabled to prompt users before sending invitations1
Attributes
- Type
SHALL
- Section
Calendar
- Service
calendar
- Sub Section
2 External Invitations Warnings
GWS.CALENDAR.3.1Calendar Interop SHOULD be disabled0
Attributes
- Type
SHOULD
- Section
Calendar
- Service
calendar
- Sub Section
3 Calendar Interop Management
GWS.CALENDAR.3.2Microsoft 365 (Graph API) SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment0
Attributes
- Type
SHALL
- Section
Calendar
- Service
calendar
- Sub Section
3 Calendar Interop Management
GWS.CALENDAR.4.1Appointment Schedule with Payments SHALL be disabled0
Attributes
- Type
SHALL
- Section
Calendar
- Service
calendar
- Sub Section
4 Paid Appointments
Chat72
GWS.CHAT.1.1Chat history SHALL be enabled for information traceability0
Attributes
- Type
SHALL
- Section
Chat
- Service
chat
- Sub Section
1 Chat History
GWS.CHAT.1.2Users SHALL NOT be allowed to change their history setting0
Attributes
- Type
SHALL NOT
- Section
Chat
- Service
chat
- Sub Section
1 Chat History
GWS.CHAT.2.1External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing1
Attributes
- Type
SHALL
- Section
Chat
- Service
chat
- Sub Section
2 External File Sharing
GWS.CHAT.3.1Space history SHOULD be enabled for information traceability0
Attributes
- Type
SHOULD
- Section
Chat
- Service
chat
- Sub Section
3 History for Spaces
GWS.CHAT.4.1External chat messaging SHALL be restricted to allowlisted domains only1
Attributes
- Type
SHALL
- Section
Chat
- Service
chat
- Sub Section
4 External Chat Messaging
GWS.CHAT.5.1Chat content reporting SHALL be enabled for all conversation types0
Attributes
- Type
SHALL
- Section
Chat
- Service
chat
- Sub Section
5 Content Reporting
GWS.CHAT.5.2All reporting message categories SHOULD be selected0
Attributes
- Type
SHOULD
- Section
Chat
- Service
chat
- Sub Section
5 Content Reporting
Meet70
GWS.MEET.1.1External users who were not explicitly invited SHALL be required to ask to join0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
1 Meeting Access
GWS.MEET.2.1Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace (GWS) tenant or organization0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
2 Internal Access to External Meetings
GWS.MEET.3.1Host Management meeting features SHALL be enabled0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
3 Host Management Meeting Features
GWS.MEET.4.1Warn for external participants SHALL be enabled0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
4 External Participants
GWS.MEET.5.1Incoming calls SHALL be restricted to contacts and other users in the organization0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
5 Incoming Calls
GWS.MEET.6.1Automatic recordings for Google Meet SHALL be disabled0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
6 Video Meeting Settings
GWS.MEET.6.2Automatic transcripts for Google Meet SHALL be disabled0
Attributes
- Type
SHALL
- Section
Meet
- Service
meet
- Sub Section
6 Video Meeting Settings
Groups65
GWS.GROUPS.1.1Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner1
Attributes
- Type
SHALL
- Section
Groups
- Service
groups
- Sub Section
1 External Group Access
GWS.GROUPS.1.2Group owners' ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment1
Attributes
- Type
SHOULD
- Section
Groups
- Service
groups
- Sub Section
1 External Group Access
GWS.GROUPS.1.3Group owners' ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment1
Attributes
- Type
SHOULD
- Section
Groups
- Service
groups
- Sub Section
1 External Group Access
GWS.GROUPS.2.1Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment1
Attributes
- Type
SHOULD
- Section
Groups
- Service
groups
- Sub Section
2 Group Creation
GWS.GROUPS.3.1The default permission to view conversations SHOULD be set to All Group Members1
Attributes
- Type
SHOULD
- Section
Groups
- Service
groups
- Sub Section
3 Default Permissions for Viewing Conversations
GWS.GROUPS.4.1The Ability for Groups to be Hidden from the Directory SHALL be disabled0
Attributes
- Type
SHALL
- Section
Groups
- Service
groups
- Sub Section
4 Ability to Hide Groups from the Directory
Sites11
GWS.SITES.1.1Sites Service SHOULD be disabled for all users1
Attributes
- Type
SHOULD
- Section
Sites
- Service
sites
- Sub Section
1 Sites Service Status
Classroom60
GWS.CLASSROOM.1.1Who can join classes in your domain SHALL be restricted to users in your domain or allowlisted domains0
Attributes
- Type
SHALL
- Section
Classroom
- Service
classroom
- Sub Section
1 Class Membership
GWS.CLASSROOM.1.2Which classes users in your domain can join SHALL be restricted to classes in your domain or allowlisted domains0
Attributes
- Type
SHALL
- Section
Classroom
- Service
classroom
- Sub Section
1 Class Membership
GWS.CLASSROOM.2.1Users SHALL NOT be able to authorize apps to access their Google Classroom data0
Attributes
- Type
SHALL NOT
- Section
Classroom
- Service
classroom
- Sub Section
2 Classroom API
GWS.CLASSROOM.3.1Roster import with Clever SHOULD be turned off0
Attributes
- Type
SHOULD
- Section
Classroom
- Service
classroom
- Sub Section
3 Roster Import
GWS.CLASSROOM.4.1Only teachers SHALL be allowed to unenroll students from classes0
Attributes
- Type
SHALL
- Section
Classroom
- Service
classroom
- Sub Section
4 Student Unenrollment
GWS.CLASSROOM.5.1Class creation SHALL be restricted to verified teachers only0
Attributes
- Type
SHALL
- Section
Classroom
- Service
classroom
- Sub Section
5 Class Creation