Securing Google Workspace for a UK business

The problem

Most Workspace tenants we inherit have the same handful of problems: MFA available but not enforced, more super admins than the business has partners, files shared with "anyone with the link" going back years, and at least one leaver whose account is still active because deleting it felt risky. None of these are exotic attacks. They are configuration debt, accumulated because the tenant was set up in an afternoon and never revisited.

Do these four things first

If you do nothing else this quarter, do these. They close the routes that are actually used against small businesses.

None of them require a project. All of them are administrative changes that can be made in an afternoon, with the caveat that MFA enforcement needs a communication plan or you will spend the following morning on the phone.

• Enforce 2-step verification for everyone, with security keys or the Google prompt rather than SMS. Enforcement, not encouragement — an optional control protects the people who did not need protecting.
• Cut the super admin count to two, with a break-glass account that is not used day to day. Give delegated roles for helpdesk tasks instead.
• Audit external sharing: turn off "anyone with the link" as a default for new files and review what is already shared that way.
• Fix the leaver process: suspend rather than delete, transfer Drive ownership, remove from groups, revoke app passwords and connected devices. Write it down so it survives the person who knows it.

Shared drives are a security control, not just tidiness

Files in a personal My Drive belong to an individual. When that person leaves, ownership has to be transferred manually, and anything missed becomes inaccessible or, worse, stays shared through links nobody can now audit.

Moving client and matter files into shared drives owned by the organisation changes that: membership is managed by group, ownership never leaves the business, and access review becomes something you can actually perform. For law firms and accountancy practices, this is usually the single highest-value structural change in the tenant.

The settings people miss

Beyond the obvious controls, a few configuration items come up repeatedly in assessments and incidents.

Each of these takes minutes and none of them are visible to users, which is exactly why they get skipped.

• Less secure app access and app passwords — legacy authentication routes that bypass MFA entirely
• Third-party app access — OAuth grants users have given to apps that can read all their mail; review and allowlist
• Email authentication — SPF, DKIM and a DMARC policy that is not stuck on p=none forever
• Admin alerts — notification on suspicious login, admin privilege change and suspended-account activity
• Log retention — know how far back your admin and login audit logs actually go before you need them

Where this meets Cyber Essentials

Workspace configuration answers a meaningful slice of a Cyber Essentials assessment — access control, secure configuration and parts of malware protection — but not all of it. Device patching, firewall configuration and the endpoints themselves sit outside the tenant.

The failure we see most often at assessment is not a Workspace setting at all: it is an unsupported laptop belonging to a director, or a leaver who is still in a group. Both are process problems that a well-configured tenant makes visible rather than solves.

Backup is not covered by Google

Google protects against their own infrastructure failing. They do not protect against a user deleting a shared drive, a compromised account destroying mail, or a ransomware event syncing through Drive for desktop. Retention policies buy you a window; they are not a backup.

For businesses with a real recovery requirement we add third-party backup for Workspace and, more importantly, test a restore. An untested backup is a belief, not a control — the same argument we make on networking, backup and disaster recovery.