Google Workspace for Small Business: Security Setup in the Right Order

Small businesses on Google Workspace usually have no security team, one overworked administrator and a tenant still running close to its default settings. That combination is exactly what phishing crews, invoice fraudsters and opportunistic account takeovers look for. Google's own security checklist for small businesses (1 to 100 users) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Secure Cloud Business Applications (SCuBA) baselines for Google Workspace cover most of what matters, but they are long and written for different audiences. This guide puts the settings that give a small organisation the most protection in a practical order, with the Admin console locations, what each one breaks, and how to check it is working. It is for owners, office managers who administer Workspace, and IT providers who look after small clients. Larger tenants should start with the Google Workspace Security Guide.

This is an independent guide from NHI Mgmt Group, based on Google's public documentation as of November 2026. It is not sponsored or reviewed by Google. Product features change, so confirm settings against Google's current documentation.

Key takeaways

• Protect the admin accounts first. Two super admins, both with security keys or passkeys, used only for admin tasks, and a separate everyday account for the person who administers the tenant.
• Enforce 2-Step Verification for everyone. Google calls it essential for admins and anyone handling sensitive data; CISA's baseline goes further and requires phishing-resistant methods and no SMS or voice codes.
• Lock down email authentication and forwarding. SPF, DKIM and DMARC stop others sending as you; blocking automatic external forwarding stops a compromised mailbox quietly copying every invoice.
• Control what third-party apps can reach. OAuth apps that users approve can read mail and files without a password; restrict them through API controls.
• Turn on alerts and look at them. A weekly ten-minute review of the alert centre and admin log catches most small-tenant compromises early.

What is different about securing Workspace in a small business

The platform is the same as for a large enterprise, but the constraints are not. A small business typically has one person doing administration part time, no SIEM, no identity provider in front of Google, and staff using personal phones. Many sit on Business Starter, Business Standard or Business Plus editions, where some enterprise controls are not available. CISA's baseline, for example, lists data loss prevention as available only on Frontline Standard, Enterprise, Education and Enterprise Essentials Plus editions, and context-aware access is likewise an edition-dependent feature. Check what your edition includes before planning around a control.

Step 1: secure the admin accounts

Everything else depends on the super admin accounts, because a super admin can change any setting, read any data through administrative tools and remove other admins.

• Two super admins, run by different people: Google's small business checklist recommends a second super admin managed by a different person so a lost or compromised primary account does not block critical tasks. CISA's baseline (GWS.COMMONCONTROLS.6.2) sets a minimum of two and a maximum of eight. In a very small business the second may be the owner or the IT provider, held under a written agreement.
• Do not stay signed in as super admin: Google advises signing in as super admin only for specific tasks and using an account with limited pre-built admin roles for daily work. Give the office manager a User Management or Help Desk role rather than super admin.
• Security keys or passkeys for admins: CISA requires highly privileged accounts to be enrolled in the Advanced Protection Program (GWS.COMMONCONTROLS.9.1), found under Security > Authentication > Advanced Protection Program. See the Hardware Security Keys Guide.
• Recovery that works when needed: Google recommends recovery phone and email on admin accounts, printed backup codes stored securely, and keeping account details and DNS registrar credentials safe, because Google Support may require DNS verification before resetting a super admin password. CISA's federal baseline disables super admin self-recovery (GWS.COMMONCONTROLS.8.1); a small business with two super admins can reasonably adopt the same, since each can reset the other.

Step 2: enforce strong sign-in for everyone

Configure under Security > Authentication > 2-step verification, and the password management settings.

Rollout: announce the change, let users enrol during the enrolment window, start with admins and finance, then enforce for everyone. Keep a short list of who has backup codes or a spare key, because the first lost phone will arrive within weeks. For wider small business identity practice see the Small Business Identity and Access Security Guide.

Step 3: protect Gmail

Most small business losses on Workspace start in the mailbox. Settings sit under Apps > Google Workspace > Gmail.

• SPF: Google's checklist says to set up SPF so receivers know which servers may send for your domain. CISA requires the SPF policy to fail all non-approved senders (GWS.GMAIL.3.1). Include every service that sends as you, such as your accounting or CRM platform.
• DKIM: generate the key under Authenticate email > DKIM authentication, publish the DNS record, then start authentication (GWS.GMAIL.2.1).
• DMARC: publish a DMARC record, collect reports, fix legitimate senders, then move to p=reject, which is CISA's required end state (GWS.GMAIL.4.2). See the DMARC, SPF and DKIM Guide.
• Safety settings: turn on enhanced pre-delivery message scanning (in Google's checklist and CISA GWS.GMAIL.15.1), attachment protections for encrypted attachments and scripts from untrusted senders, link protections such as identifying links behind shortened URLs and warning on clicks to untrusted domains, and spoofing protections for similar domain names and employee names (GWS.GMAIL.5 to 7). Allow Google to apply future recommended settings automatically.
• Automatic forwarding: disable under End User Access > Automatic forwarding (GWS.GMAIL.11.1). Forwarding rules are a favourite way for an attacker to keep reading mail after a password reset.
• POP and IMAP: CISA disables them (GWS.GMAIL.9.1) because they let legacy clients bypass modern sign-in. Disable unless a specific device needs them, and record that exception.
• Do not bypass spam filters: avoid adding domains to lists that bypass spam filtering or hide warnings (GWS.GMAIL.18).

Step 4: control sharing in Drive and Calendar

• Link sharing off by default: Google's checklist recommends turning off link sharing as the default so only the creator can open a new file until it is shared.
• Warn before external sharing: if staff must share with clients, show a warning when sharing outside the organisation (CISA GWS.DRIVEDOCS.1.3). Where clients are a known list, restrict external sharing to allowlisted domains (1.1).
• Avoid "anyone with the link": CISA recommends disabling it in units that allow external sharing (1.5); in a small business, at least set it to warn and review old public links quarterly.
• Calendar: limit external calendar sharing to free/busy only, as Google's checklist recommends, so meeting titles and attendee lists are not exposed.
• Takeout: CISA disables user access to Google Takeout (GWS.COMMONCONTROLS.12.1). For a small business this mainly protects against a leaver exporting all their mail and files on the way out.

Step 5: restrict third-party apps and connected accounts

When a user clicks "Allow" on an app requesting access to Gmail or Drive, that app receives an OAuth token that keeps working after a password change. In a small business nobody is watching these grants.

• API controls: under Security > Access and data control > API controls, review the list of accessed apps, mark the ones you rely on as trusted, and restrict unconfigured third-party apps. CISA requires application access control policies, no user consent to unconfigured third-party apps and no trust for unconfigured internal apps (GWS.COMMONCONTROLS.10.1 to 10.4).
• Marketplace apps: allow only approved Marketplace apps (GWS.COMMONCONTROLS.11.1).
• Service accounts and delegation: if your IT provider or a vendor integration uses domain-wide delegation, it can act as any user. Keep a list of every grant, its owner and its scopes. See the Google Workspace Domain-Wide Delegation Security Guide.
• Unmanaged accounts: staff may have created personal Google accounts with their work address. CISA recommends account conflict management to replace conflicting unmanaged accounts with managed ones (GWS.COMMONCONTROLS.7.1).

Where identity fits

Small tenants accumulate non-human identities faster than anyone notices: the scanner that emails PDFs with an app password, the accounting integration with Drive access, the marketing tool connected through OAuth, the IT provider's delegated service account, and AI assistants granted access to mail. Each is a credential that can be stolen and that rarely has MFA. Keep a one-page register of every connected app and service account with an owner, remove what is unused each quarter, and revoke grants when a supplier relationship ends. Shared mailboxes should be Google Groups or delegated access, not a shared password. Block personal profiles and password saving for work credentials on company devices, and keep shared credentials in a password manager, not the browser.

Step 6: devices, alerts and recovery

• Auto-update: Google's checklist recommends auto-update for apps and browsers, with Chrome auto-update configurable across the organisation.
• Mobile: at minimum apply basic mobile management so a screen lock is required and you can sign a lost phone out of company data. See the Small Business Device Management Guide.
• Alerts: CISA requires its listed system-defined alert rules to be enabled (GWS.COMMONCONTROLS.13.1). Make sure the Suspicious login, Leaked password, Government-backed attacks, User suspended due to suspicious activity and User granted Admin privilege alerts reach a mailbox someone reads, not only the super admin's.
• Logs: CISA's federal requirement is three months searchable and twelve months retrievable (GWS.COMMONCONTROLS.14.2). Without a SIEM, schedule a weekly look at the admin log, login log and Gmail log in the Admin console. See the Google Workspace Audit Log Detection Guide.
• Backup: Workspace is highly available, but deletion, ransomware synced from a laptop and malicious admins are still your problem. Decide whether retention rules or a separate backup service meet your recovery needs.

Detection and measurement

For small organisations, CISA's open-source ScubaGoggles tool can assess a tenant against the SCuBA baselines and produce a report, which is a practical way for an IT provider to measure many small clients consistently.

Common failure patterns

• One super admin who also reads email all day. A single phish takes the whole tenant, and nobody else can recover it.
• 2SV "available" but not enforced. Optional 2SV leaves exactly the least careful users unprotected.
• SPF without DMARC, or DMARC stuck at p=none. Reports arrive, nobody reads them, and spoofed invoices keep going out under your name.
• External forwarding allowed. A compromised mailbox forwards every payment conversation to the attacker even after the password is changed.
• Unreviewed OAuth grants. Apps approved years ago by former staff still hold mail and Drive access.
• Leavers kept active to "preserve data". Suspend or transfer data and reset credentials on the day someone leaves; do not keep an unused account with a known password.

Framework mapping

Practitioner checklist

• Create a second super admin held by a different person, protect both with security keys or passkeys, and stop using super admin accounts for daily work.
• Store backup codes, admin recovery details and DNS registrar credentials somewhere secure and known to both admins.
• Enforce 2-Step Verification for all users with a one-week enrolment window and phase out SMS codes.
• Set password minimum length to 12 or more, block reuse, remove forced expiry and block less secure apps.
• Publish SPF, enable DKIM and move DMARC to reject; turn on enhanced pre-delivery scanning and Gmail safety settings.
• Disable external automatic forwarding and POP and IMAP unless a recorded exception needs them.
• Turn link sharing off by default, warn on external sharing and limit external calendar sharing to free/busy.
• Restrict third-party app access in API controls and keep a register of connected apps and service accounts.
• Route key alerts to a monitored mailbox and review the alert centre and admin log weekly.
• Run a baseline assessment such as ScubaGoggles once a year or after major changes.

Standards and references

• Google Workspace: Security checklist for small businesses (1-100 users)
• CISA: SCuBA Google Workspace Common Controls baseline
• CISA: SCuBA Gmail baseline
• CISA: SCuBA Google Drive and Docs baseline
• CISA: ScubaGoggles assessment tool
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Google Workspace Security Guide · Small Business Cybersecurity Basics Guide · Gemini for Google Workspace Security Guide · Choosing an IT Support Provider or MSP Securely