Secure control
Named admins, strong sign-in and independent recovery.
Accounts · collaboration · recovery
Free Google Workspace security checklist.
Review the controls that protect a Workspace domain, record the evidence behind each answer and leave with a practical list of gaps and questions—not a confidence-inflating score.
Start the Workspace reviewA guided review, not an automated verdict
Record the evidence you have and the evidence you need.
Check the current Admin console, reports, app access, sharing records, change history and recovery tests. Use “not checked” whenever the answer is an assumption.
ConfirmedCurrent evidence supports it
Partly in placeA known gap or exception remains
Not checkedThe evidence has not been reviewed
A sensible review order
Protect control of the domain first.
Start with super admins, 2-Step Verification and recovery. Then work outward through OAuth access, Drive and Groups sharing, mail routes, audit visibility and recoverability.
Trace access
Apps, groups, links, delegates and external users.
Prove recovery
Logs, alert routes, retention and representative restores.
Important boundaries
A green status needs evidence behind it.
Workspace editions and service features differ. The right configuration depends on the organisation's identity model, users, data, applications and obligations.
Prevent administrator lockout
Test recovery before enforcing sign-in or context policies. Keep more than one individually assigned super admin available.
Vault is not a general archive
Retention rules govern supported data and can drive deletion. Design, test and approve them carefully; validate restore needs separately.
No compliance declaration
A checklist cannot establish legal or framework compliance without defined scope, evidence and accountable interpretation.
Google's administrator guidance
Check current product guidance before changing policy.
The checklist uses these first-party references for its most consequential questions. Revisit them during implementation because names, availability and edition support can change.
Google Workspace security checklistsSmall-business and larger-organisation security baselines
Administrator account security2SV, individual admin accounts, separation and recovery
Control app accessOAuth scopes, users, publishers and application trust
Drive log eventsExternal visibility, searchable events and edition-dependent tools
Activity rules and alertsNotifications and actions based on domain activity
Google Vault overviewRetention, deletion, holds, licensing and archive boundaries
Common questions
Google Workspace checklist FAQ.
Does the checklist connect to our Workspace domain?
No. It does not request an administrator sign-in or API permissions. You complete it using evidence from your authorised review.
Why should we have more than one super admin?
Google recommends multiple super admin accounts managed by separate people so another administrator can act if one account is lost or compromised.
Is Google Vault a backup?
Vault is designed for information governance, retention, holds, search and export. Google states that it is not a data archive. Define restore requirements separately and test the chosen recovery method.
Should every organisation enable Context-Aware Access?
Not automatically. Availability, device management, user experience, bypasses and lockout risk need review. The checklist asks whether the complete access model is deliberate and tested.
Need help validating the answers?
Turn the review into safe, owned changes.
ACA Tech Solutions can help UK teams review Google Workspace administration, identity, app access, sharing, audit and recovery, then sequence improvements around real business needs.