Google Workspace includes strong security features, but many must be enabled and configured by an administrator to protect accounts, email, and Drive files.
Key takeaways
What to know before you act
- Enforced 2-Step Verification is the most important Google Workspace security setting.
- Protect super administrator accounts with security keys and use them only for administration.
- Review Drive sharing and third-party app access regularly.
Why it matters
What business leaders should understand
Compromised Workspace accounts can expose email, documents, and connected apps. A checklist helps ensure settings reflect current recommendations.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with google workspace management, microsoft 365 services, and cloud services.
Related reading: Microsoft 365 vs. Google Workspace and Phishing-resistant MFA and passkeys.
Accounts and administrators
Google publishes security checklists for small and larger organizations. For most small businesses, identity settings deliver the biggest improvement.
- Enforce 2-Step Verification for all users.
- Use security keys or passkeys for super administrators.
- Keep the number of super administrators small and use delegated admin roles.
- Configure account recovery options and alerts for suspicious sign-ins.
- Suspend accounts promptly when employees leave and transfer their data.
Email, Drive, and apps
After identity, focus on how data leaves the organization and which applications can access it.
- Configure SPF, DKIM, and DMARC for your domains.
- Enable Gmail advanced phishing and malware protections.
- Set Drive external sharing defaults and warn users when sharing outside the domain.
- Review third-party app access and restrict high-risk scopes.
- Use endpoint management for mobile devices that access company data.
- Review the security center and alert center regularly.
Practical action plan
Steps your business can take
Enforce 2-Step Verification, preferring security keys or passkeys for admins.
Limit super administrator accounts and use them only for administration.
Review Drive external sharing and third-party app access.
Configure SPF, DKIM, and DMARC for your domain.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
Microsoft 365 vs. Google Workspace
Compare the platforms before committing.
Explore nextRelated guide
Phishing-resistant MFA and passkeys
Choose stronger 2-Step Verification methods.
Explore nextRelated guide
Email security changes businesses need to know
Configure SPF, DKIM, and DMARC.
Explore nextWarning signs
Do not ignore these indicators
- 2-Step Verification is optional
- Files are shared publicly with anyone who has the link
- Many third-party apps have broad access to Gmail or Drive
Frequently asked questions
Common questions, answered.
What is the most important Google Workspace security setting?
Enforced 2-Step Verification for all users, with security keys or passkeys for administrators.
How many super administrators should we have?
As few as practical, using delegated admin roles for routine tasks.
How do we control Google Drive sharing?
Set external sharing defaults, warn users when sharing outside the domain, and review public links.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Google Workspace Admin Help
Security checklist for small businesses
Google's recommended security settings for small Google Workspace organizations.
Cybersecurity and Infrastructure Security Agency
Implementing Phishing-Resistant MFA
CISA's fact sheet on MFA attacks, FIDO/WebAuthn authenticators, and phased rollout of phishing-resistant MFA.
Federal Trade Commission
Cybersecurity for Small Business
FTC guidance and training materials covering common cybersecurity topics for small businesses.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.