Google Workspace security checklist for small businesses

Accounts

• 2-Step Verification enforced for everyone, and security keys or passkeys for super admins where possible
• Two to four super admins, each with a separate admin account not used for everyday email
• Accounts unused for 90 days suspended or removed
• Leavers suspended on their last day, with Drive ownership transferred

Data and sharing

• Drive sharing outside the company limited to what you need
• No sensitive files shared with anyone who has the link
• Automatic Gmail forwarding to outside addresses reviewed or turned off

Apps

• Third-party app access controlled in API controls, with unknown apps blocked from accessing mail and Drive
• Existing app access reviewed

Email

• SPF includes _spf.google.com and every other sender
• DKIM turned on in the Admin console and published in DNS
• DMARC published and moving toward enforcement

Run the checklist automatically

TenantWard checks these with a read-only Google Workspace connection and explains every gap in plain English.