Review who can sign in, how files are shared, and which devices access company data. These five checks help you find gaps in your Google Workspace setup.

For detailed setup steps, use Google’s security checklist.

1. Secure sign-ins

Protect administrator accounts first, then roll out the same basics across your team.

• Require 2-Step Verification. Give people time to enroll; prefer security keys for administrators.

• Use strong, unique passwords. Store recovery details and backup codes securely.

• Review connected apps. Remove Gmail and Drive access that is no longer needed.

2. Protect business email

Email authentication helps receiving mail systems verify messages from your domain.

• Set up SPF and DKIM. Introduce DMARC gradually. Our Workspace team can help check your configuration.

• Review Gmail safety settings for suspicious attachments, links and impersonation attempts.

• Keep external recipient warnings enabled and ask staff to check recipients before sharing sensitive information.

3. Control file sharing

Give people the access they need, and review it when their work changes.

• Review external sharing. Check public links and access granted to former collaborators.

• Use data loss prevention (DLP), if your plan supports it, to detect sensitive information and restrict sharing.

• Check shared drive permissions. Limit who can manage members and invite external users.

4. Manage work devices

Choose controls that fit the device, its owner and the data it can access.

• Require screen locks on managed mobile devices. Keep operating systems and apps updated.

• Plan for lost devices. Check what a remote wipe removes; some options erase personal data too.

• Review device access regularly. Use device management controls to restrict access from unapproved devices.

5. Keep access up to date

Revoke access when someone leaves. Check security alerts regularly and make sure staff know how to report suspicious activity.

Need help reviewing your setup? Explore our Google Workspace services.