Google Workspace Security Checklist for Small Businesses

Google Workspace security checklist at a glance

Google publishes a security checklist for small businesses (1 to 100 users) and a longer one for medium and large businesses. Google notes that small firms handling financial or health information may need the larger list. This table combines the items with the most impact for a typical SME.

Enforce 2-Step Verification for every user

Google's checklist recommends that everyone use 2-Step Verification (2SV), and that admins and people handling sensitive data such as finance and HR records are enforced first. Its 2SV deployment guide adds that Google is enforcing 2SV for administrator accounts.

1. 1

   Tell staff it is coming

   Give a date and ask everyone to set up 2SV on their own account first, ideally with an authenticator app, passkey or security key.

2. 2

   Check enrolment in the security report

   Go to Reporting > User reports > Security to see who has enrolled before you enforce.

3. 3

   Turn on enforcement

   In Security > Authentication > 2-step verification, allow users to turn on 2SV, then set Enforcement to On from a date, with a short new-user enrolment period.

4. 4

   Require security keys for admins

   Google recommends enforcing security keys at least for admins and other high-value accounts, as they resist phishing.

5. 5

   Print backup codes

   Google advises admins and users with 2SV to generate backup codes and store them securely, so a lost phone does not lock someone out.

Our guide to setting up MFA for business accounts explains which second factor to choose.

Protect super admin accounts

Super admins can see and change everything. Google's small business checklist sets out a short list of habits:

If the only super admin is a former employee or an agency, fix that first. Losing super admin access is one of the hardest problems to recover from in Workspace.

Control third-party app access to Gmail and Drive

Every 'Sign in with Google' or 'Connect your Google account' button can give an app access to mail, files or calendars. Google's third-party app access guide lets admins see which apps have been granted access and set each one as Trusted, Limited, Specific Google data or Blocked.

• Open Security > Access and data control > API controls > Manage third-party app access.
• Review the accessed apps list. Look for anything nobody recognises, or apps with broad Gmail or Drive scopes.
• Mark the tools you rely on (accounting, CRM, e-signature) as Trusted and block the rest where possible.
• Block less secure apps that do not use modern sign-in, as Google's checklist recommends.

This matters even more as staff connect AI tools to their accounts. An app with access to Drive can read every file that user can open.

Drive, Calendar and Gmail sharing settings

Google's small business checklist recommends two Drive settings in particular: make new files visible only to their creator until they are shared (turn off link sharing as the default), and warn users when they share a file with someone outside the company. Google's Drive sharing settings article explains the options under Apps > Google Workspace > Drive and Docs > Sharing settings.

• Calendar: limit external sharing to free/busy only, so meeting titles and notes do not leak.
• Gmail: turn on enhanced pre-delivery message scanning and the extra attachment, link and external image checks.
• Email authentication: publish SPF, DKIM and DMARC so others cannot easily spoof your domain. Our SPF, DKIM and DMARC guide covers the records.
• Leavers: Google's checklist recommends revoking access when staff leave and turning off Google Takeout for compromised or departing users.

Alerts, reports and mobile devices

Turning settings on is half the job; noticing when something goes wrong is the other half. The alert center shows notifications about potential issues in your domain, such as suspicious sign-ins. Google's checklist also recommends admin email alerts for risky events, regular reviews of activity reports, and login challenges for suspicious sign-in attempts.

For phones and tablets, Google's basic mobile management is on by default. It needs no app on the device, and lets you set password requirements and wipe a user's work account from a lost or stolen device. Advanced mobile management adds stronger controls, such as full device wipes and app management, but requires users to install a management app and depends on your edition.

Do it yourself or get help?

Most items here are settings an owner or office manager can change in an afternoon. The tricky parts are 2SV rollout without locking people out, deciding which third-party apps to trust, and cleaning up years of 'Anyone with the link' sharing. Backups are separate: Workspace does not keep independent copies for you, so see our guide to backing up Microsoft 365 and Google Workspace.

Our Microsoft 365 / Google Security Lockdown (S$590) enforces 2SV for up to 15 users, sets anti-phishing and sharing rules, blocks risky apps and cleans up admin roles with a break-glass account. Using Microsoft too? Compare with our Microsoft 365 security checklist, and add Workspace to your employee offboarding checklist.