Google Workspace is secure by design, but several of the settings that matter most are left loose by default so that new customers do not get stuck. Drive files can be shared with anyone, any app can ask for access to someone's mailbox, and 2-Step Verification is optional for regular users.
This checklist tightens those settings for a small business. You need a super admin account. Plan for an afternoon, and warn staff before you enforce 2-Step Verification.
Google changes the Admin console layout regularly. The paths below were correct in November 2026, but menu names may vary. The search bar at the top of admin.google.com finds any setting by name.
1. Enforce 2-Step Verification
- Admin console (admin.google.com) > Security > Authentication > 2-Step Verification.
- First tick Allow users to turn on 2-Step Verification and give staff a week to enrol.
- Then set Enforcement to On, with a short new-user enrolment period (one or two weeks) so new hires can set it up.
- Under Methods, choose "Any except verification codes via text, phone call" if you can. Passkeys, security keys and Google prompts on a phone are much harder to phish than text codes.
- Use Security keys only for super admins if your team can handle it.
- Check progress: Reporting > User reports > Security shows who has enrolled.
2. Trim admin roles
- Account > Admin roles > Super Admin > Assigned admins. Keep two or three super admins, no more.
- Super admins should use a separate admin account that is not used for daily email, and it must have 2-Step Verification (Google now requires it for super admins).
- Give everyone else a smaller role: User Management, Help Desk, or a custom role with only what they need.
- Set up super admin account recovery under Security > Authentication > Account recovery, with a recovery phone and email you control.
- When someone leaves: suspend the account the same day, reset sign-in cookies, transfer their Drive files, then delete or keep the account as your retention needs require.
3. Tighten Drive sharing
- Apps > Google Workspace > Drive and Docs > Sharing settings > Sharing options.
- For Sharing outside of your organization, choose "Allowlisted domains" if you mostly work with known partners, or keep it on with warn when files owned by users are shared outside ticked.
- Set General access default to Restricted (only people added can open), so new files are private until someone chooses otherwise.
- Untick sharing with people who do not have a Google account if you do not need it.
- Decide who can create shared drives and whether outside people can be added to them.
- Check what is already public: the Security investigation tool (in higher editions) or Reporting > Audit and investigation > Drive log events can list files shared outside the company.
4. Control third-party app access
- Security > Access and data control > API controls > Manage Third-Party App Access.
- Review the list of accessed apps. Block anything you do not recognize, and mark the apps you rely on as Trusted.
- Set unconfigured apps to allow only basic Sign in with Google information, so a random app cannot ask to read someone's mail or Drive.
- Apps > Google Workspace Marketplace apps > Settings: allow only apps on your allowlist.
5. Stop spoofing: SPF, DKIM and DMARC
These three DNS records prove email from your domain is really from you. Without them, anyone can send email that looks like it came from your accounts team.
- SPF: at your DNS host, publish one TXT record on your domain: v=spf1 include:_spf.google.com ~all. Add other senders (your CRM, newsletter tool, website forms) to the same record. You may only have one SPF record.
- DKIM: Admin console > Apps > Google Workspace > Gmail > Authenticate email. Generate a 2048-bit key, add the TXT record it gives you at your DNS host, wait for it to show up, then click Start authentication.
- DMARC: publish a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:[a mailbox you read]. Read the reports for two to four weeks, fix any real senders that fail, then move to p=quarantine and finally p=reject.
- Gmail, Yahoo and Microsoft's consumer mail now expect SPF, DKIM and DMARC from anyone sending in bulk, so this also helps your invoices and newsletters land in the inbox.
- Admin console > Apps > Google Workspace > Gmail > Safety: turn on the recommended protections against spoofing, suspicious attachments and links.
6. Block silent forwarding
Admin console > Apps > Google Workspace > Gmail > End User Access > Automatic forwarding. Untick Allow users to automatically forward incoming email to another address unless you have a reason. A stolen account with a forwarding rule is how many fake-invoice frauds begin.
7. Manage phones and laptops
- Devices > Mobile & endpoints > Settings > Universal settings > General > Mobile management. Basic gives you a screen-lock requirement and the ability to wipe the work account from a lost phone, with no app to install. Advanced adds stronger controls but needs staff to install the Google Device Policy app on Android or a profile on iPhone.
- Require a screen lock and encryption on any device that opens company email.
- Check Devices > Mobile & endpoints > Devices for old phones still signed in, and remove them.
- Windows device management is available in Business Plus and higher editions.
8. Back up your data
Google keeps its service running. Keeping your data recoverable is your job.
- Deleted Drive files sit in the user's trash for 30 days, and an admin can restore files for a short window after that (about 25 days). After that they are gone.
- Google Vault (Business Plus and higher) is for retention and legal holds. It is useful, but it is not a backup you can restore quickly from, and it stops holding an account's data if that account is deleted.
- Use a reputable third-party backup for Gmail, Drive, Calendar and shared drives, stored where someone who takes over your admin account cannot delete it.
- Test it: restore one mailbox folder and one shared drive folder.
9. Watch the alerts
Security > Alert center. Make sure alerts for suspicious logins, government-backed attacks, leaked passwords and changes to admin roles are emailed to at least two people. Look at the alert centre once a month even if nothing came in.
Audit your Workspace with AI
Describe your current settings in the prompt below and paste it into Gemini, ChatGPT or Claude. It gives you a priority list with the Admin console paths.
You are a Google Workspace security reviewer for a small business. I will describe my setup. Tell me what to change, in priority order, with the Admin console path for each change. Business: [number of staff], [industry], [office / remote / mixed] Edition: [e.g. Business Starter / Standard / Plus, Enterprise] 2-Step Verification: [optional / enforced / who has it, which methods are allowed] Super admins: [how many, separate admin accounts or not] Drive sharing outside the organization: [on / warn / allowlisted domains / off] General access default for new files: [restricted / anyone in the organization / don't know] Third-party app access: [unconfigured / restricted / don't know], apps we rely on: [list] SPF / DKIM / DMARC: [what is set up, DMARC policy, or don't know] Other services that send email as our domain: [e.g. CRM, newsletter tool, website forms] Automatic forwarding: [allowed / blocked / don't know] Mobile management: [off / basic / advanced] Backup: [describe or "none"] Give me: 1. A table: setting, what I have, what it should be, why it matters (one line), Admin console path, effort (minutes). 2. The top 5 changes to make this week, in order, and what staff will notice after each one. 3. The exact SPF and DMARC records I should publish, based on the senders I listed, and a timeline for moving DMARC from p=none to p=reject. 4. A short email I can send staff before enforcing 2-Step Verification. 5. A monthly 15-minute check I can repeat. Rules: plain language, explain jargon in one line. Say "menu names may vary" where Google has moved things recently. If something depends on my edition, say which. Do not recommend paid third-party products unless I ask. Canadian English.
Never paste passwords, recovery codes or customer data into an AI tool. Describe settings, not secrets.
Want it done for you?
We set up and secure Google Workspace for small businesses, including the DNS records for SPF, DKIM and DMARC, and a backup we test with you.