Skip to content

Google Workspace is not secure by default. The settings make it secure.

Why this matters

Google Workspace starts in a state that prioritizes ease of use over restriction. That means file sharing may default to anyone with a link, 2-Step Verification may be available but not enforced, and former employee accounts may still have access unless someone specifically disabled them. These are configuration decisions, not Google defaults you have to live with. Most can be fixed in an afternoon.

  • Default settings are not hardened settings. Google provides the tools to secure your account — but most of those tools start turned off.

    Why setup does not equal security without a review of your Admin console

  • Enforced is different from optional. If 2-Step Verification is set to optional, any employee can skip it.

    The single most common misconfiguration in small business Google Workspace accounts

Helix Stax

Free Checklist for Hampton Roads Small Businesses

The Small Business Google Workspace Security Checklist

Most Google Workspace accounts have at least one setting that creates real exposure. This checklist shows you exactly where to look.

What you get

  • Identity and 2-Step Verification enforcement
  • Gmail security: SPF, DKIM, DMARC, and advanced phishing protection
  • Drive sharing defaults and external-file review
  • Device and third-party app access
  • Monitoring and same-day offboarding

Preview

  • Is 2-Step Verification enforced for all users, not just recommended?
  • Are SPF, DKIM, and DMARC configured for your domain?
  • What does Drive default to when someone shares a file?
  • Do you know what third-party apps have access to your Workspace data?
  • Does offboarding happen on the employee's last day?

Get the full checklist free.

Enter your email and we will send it straight to your inbox. We will also send occasional practical IT guidance. No spam. Unsubscribe anytime.

No phone calls unless you book a follow-up yourself.

We will send the checklist and occasional practical IT guidance. No spam. Unsubscribe anytime.