Google Workspace Security

The platform is, and that is not really the question. Google handles infrastructure security, encryption, patching and gateway filtering to a standard no small business could match. What breaches organisations is almost always on the customer's side of the line: two-step verification left optional, super-admin on one person's account, external sharing never configured, third-party apps holding standing access, and dormant accounts nobody removed. Almost none of those are switched on by default, which means a tenant bought direct and never configured is running on Google's security with none of your own.

None that matters. Google calls it 2-Step Verification; the rest of the industry, including most client security questionnaires and auditors, says multi-factor or two-factor authentication. If a questionnaire asks whether MFA is enforced across your organisation, it is asking whether you have 2-Step Verification enforced — and the honest answer for most unconfigured tenants is that it is available but not required, which is not the same thing.

With an enrolment period. Enforcement is set per organisational unit with a window during which people can enrol, and a communicated deadline. Turning it on without warning locks out everyone who has not set it up, which reliably results in enforcement being switched back off and nobody trying again for a year. Issue backup codes in advance and make sure an administrator can reset an individual's enrolment, because lost phones are a certainty rather than a risk.

The baseline that prevents most incidents — 2-Step Verification, admin role separation, sharing controls, third-party app restrictions, audit logs and basic device management — is available across the editions. What sits higher up is Vault for retention, search and legal hold; context-aware access, where access depends on device and location rather than password alone; data loss prevention; and stronger endpoint management. Edition availability and naming change from time to time, and Google's India price list does not show every edition, so we confirm the current position with Google rather than quoting from memory.

Most businesses we work with do not, and we would rather say so than sell it. DLP sits in the higher editions and is genuinely valuable where a specific category of sensitive data must not leave — payment card details, health records, regulated client data. For a typical trading, retail or services business in Kerala it is an expensive answer to a problem that sharing controls and access discipline already handle. Where it is warranted, it is usually because a regulator or a client contract says so rather than because someone chose it.

This is the control almost nobody reviews, and it is worth an afternoon. Every OAuth prompt somebody approved is standing access that does not expire on its own, the scope granted is usually broader than the task needed, and a compromised third-party service inherits whatever you gave it. You can restrict which applications may connect and review what already has. Staff who left years ago may still have personal tools holding organisational access.

Yes, and the depth depends on your edition. Basic device management — requiring a screen lock and being able to wipe company data from a mobile device — is broadly available. Stronger endpoint policy sits in higher editions. What matters more than the feature is the decision behind it: whether personal phones may hold company mail at all, and what you are permitted to do to that device if it is lost. That should be agreed in writing before it is configured, because the difference between wiping a device and wiping an account matters a great deal to the person holding the phone.

Reset the password and sign out active sessions — a password change alone does not end a session the attacker is already inside. Revoke third-party app tokens, because a granted OAuth connection survives a password reset. Then check for forwarding rules and filters, which is what attackers set up first because they outlive the intrusion; a rule quietly copying invoices to an outside address is how a compromise becomes a financial loss. Read the login and admin audit logs before drawing conclusions. Finally, fix the control that was missing rather than only the instance.

Those are covered separately on our Google Workspace email security page, because they solve a different problem. The controls on this page protect your organisation's accounts and data from unauthorised access. SPF, DKIM and DMARC protect your domain from being impersonated to other people — they stop a forged message that looks like it came from you reaching your customer. Both matter; they are not substitutes. We configure domain authentication as part of any implementation or migration.