Google Workspace Security Checklist for Small Business

Google Workspace ships set up for convenience, not security. Out of the box, any employee can connect any third-party app to company data, and nothing forces 2-Step Verification until an admin enforces it. A small business can close most of that gap in an afternoon in the Admin console, on any Business plan.

This is the checklist we run, in the order we run it.

By Joel Baum for The NetSys Group, which has delivered managed IT, cybersecurity and cloud services from Brooklyn since 1998. We work on-site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, CT, with remote managed IT nationwide.

What should you change first in Google Workspace?

Enforce 2-Step Verification for everyone, block text-message codes, and require security keys or passkeys for admins. Then restrict third-party app access, tighten Drive sharing outside your domain and turn on Gmail's stronger phishing protections. Start there, in that order.

The sign-in piece matters most. Verizon's 2025 Data Breach Investigations Report found that "the use of compromised credentials was an initial access vector in 22% of the breaches reviewed," according to Verizon's write-up of the research. A stolen password plus no second factor is an open door.

1. Lock down how people sign in

Go to Security, then Authentication, then 2-step verification. Only a super admin can change it.

• Enforce it. Turn on enforcement and set a short "New user enrollment period" so new hires can't run unprotected for weeks.
• Block SMS codes. Under Methods, pick "Any except verification codes via text, phone call." Texted codes are the weakest option on the list.
• Admins use keys or passkeys. Put admin accounts in their own group and set it to "Only security key," which Google's 2SV guide says "now supports both security keys and passkeys."

Don't wait for Google to force it. Google says it "will soon require all administrator accounts to have 2-Step Verification (2SV) enabled," and it's rolling that out by edition. Your admin accounts should already be there.

For the owner, the finance lead and every super admin, add Google's Advanced Protection Program. It "enforces the use of security keys or passkeys for sign-in" and blocks risky app access unless an admin trusts the app. Our passkeys vs MFA guide explains why that beats codes.

One piece is already done for you. Google ended support for less secure apps, password-only IMAP, POP and SMTP sign-ins, as of May 1, 2025. If an old scanner or app broke then, fix it with OAuth or an app-specific setup, not by hunting for a workaround.

2. Decide which apps get company data

This is the setting most small businesses have never touched. Under Security, then Access and data control, then API controls, the default for unconfigured third-party apps is "Allow users to access any third-party apps."

That means any employee can click "Allow" on a sketchy calendar tool and hand it their mailbox. It's the same consent-phishing trick we covered for Microsoft 365.

Fix it in two steps:

1. Click Manage App Access and review what's already connected. Mark the apps you use as Trusted, and block the rest.
2. Change the default to "Allow users to access third-party apps that only request basic info needed for Sign in with Google," or to "Don't allow users to access any third-party apps." New apps then need an admin's approval.

Expect a few complaints the first week. That's the setting working.

3. Stop accidental oversharing in Drive

Drive is where files leak by accident. In Apps, then Google Workspace, then Drive and Docs, then Sharing settings:

• Sharing outside your organization: set it to "Allowlisted Domains" if you only share with a few partners. If you can't, leave it on but turn on "Warn when files owned by users or shared drives in your organization are shared outside of your organization."
• General access default: set new files to "Private to the owner," so nothing starts life as "anyone with the link."
• Publishing to the web: turn it off. Google's own Drive security recommendations say the same.

Then check what's already shared. Old "anyone with the link" files don't fix themselves when you change the default.

This also matters for AI. Gemini only sees what each user can already open, so oversharing in Drive becomes oversharing in Gemini answers. Our Gemini for Google Workspace FAQ covers the rest.

4. Turn on Gmail's stronger protections

Go to Apps, then Google Workspace, then Gmail, then Safety. Turn these on:

• Protect against encrypted attachments from untrusted senders
• Identify links behind shortened URLs, and scan linked images
• Protect against domain spoofing based on similar domain names
• Protect against spoofing of employee names
• Protect against any unauthenticated emails
• Apply future recommended settings automatically

Under Spam, Phishing and Malware, turn on enhanced pre-delivery message scanning. It holds suspicious mail for a closer look before it lands.

Then fix your own domain's authentication. Google's sender guidelines have required every sender to "set up SPF or DKIM email authentication" since February 1, 2024, and bulk senders need SPF, DKIM and DMARC. Set up all three anyway.

Our DMARC, SPF and DKIM FAQ walks through it.

5. Read the alert center

Every Business plan includes the alert center, which flags things like suspicious sign-ins and phishing campaigns. Set alerts to email someone who'll actually read them.

The full security center isn't in any Business plan. Google lists it for Enterprise, Frontline and Education editions only. If nobody watches the alert center, that gap is where an outside security team earns its fee.

Which Google Workspace plan do you need for security?

Business Standard covers this checklist. Business Plus adds Vault and advanced endpoint management, which most regulated firms want. Context-Aware Access and Drive trust rules need Enterprise.

Control	Business Starter ($7)	Business Standard ($14)	Business Plus ($22)	Enterprise
2SV enforcement, API controls, Gmail safety, Drive sharing, alert center	Yes	Yes	Yes	Yes
Basic endpoint management	Yes	Yes	Yes	Yes
Advanced endpoint management	No	No	Yes	Yes
Google Vault (retention and eDiscovery)	No	No	Yes	Yes
Security center, Context-Aware Access, Drive trust rules	No	No	No	Yes

Prices are Google's list price per user per month on its pricing page, checked October 21, 2026. Edition details come from Google's Business edition comparison, Vault overview and endpoint management comparison.

Still deciding between platforms? Our Microsoft 365 vs Google Workspace comparison covers the security differences. If you're on Microsoft, here's the Microsoft 365 version of this checklist.

What these settings won't cover

Workspace settings protect the account. They don't protect the laptop. A stolen browser session gets around 2SV, which is why session hijacking is the attack to plan for next.

You still need endpoint protection on every device, phishing training for staff and a person who reviews alerts every day. Settings are the floor.

Frequently asked questions

Is Google Workspace secure enough for a small business?

Yes, once it's configured. Google's platform is solid, but the defaults favor convenience: open third-party app access, 2-Step Verification left to the user and wide Drive sharing. Work through the five sections above and Workspace holds up well for most small businesses, as long as someone watches the alerts.

Does Google Workspace require 2-Step Verification?

Not for regular users; admins choose whether to enforce it. Google has started requiring 2SV on administrator accounts edition by edition, but nothing forces it on your staff. Enforce it yourself in Security, then Authentication, and block text-message codes while you're there.

Can I stop employees from connecting apps to Google Workspace?

Yes. In API controls, change the setting for unconfigured third-party apps from "Allow users to access any third-party apps" to a stricter option, then mark the apps you rely on as Trusted. Anything new then needs an admin's approval before it can read company data.

Is Google Vault a backup?

No. Vault is for retention and eDiscovery: it holds and searches data for legal and compliance needs, and Google's own overview says "Vault isn't a data archive." It's included in Business Plus. If you need to restore a deleted mailbox or shared drive quickly, plan a separate backup and test it.

Not sure where your tenant stands? Book a call and we'll tell you which of these settings are still on their defaults.