Security
Google Workspace security assessment
A Google Workspace security assessment reviews authentication, access, sharing, apps, mail and retention against a documented baseline. A proposed maturity model may use levels 1 to 5, but it is not certification or a peer benchmark. Evidence, remediation dependencies and ownership matter more than the score.
Tell us your edition, audit scope and the concern or requirement behind the enquiry. A configuration review, remediation and incident response are different engagements.
| Baseline | 72 checks across 8 control domains |
|---|---|
| Scoring | Maturity 1–5 per domain, weighted overall |
| Peer comparison | Not claimed without an approved, disclosed dataset |
| Turnaround | 5 working days |
| Fee | £1,750 / $2,250 up to 250 seats |
| Deliverables | Score sheet, roadmap, board summary |
Scoring, and what a maturity level actually means
Level 1 means the control is absent. Level 2 means it exists but is undocumented and applied inconsistently across org units. Level 3 means it is configured correctly everywhere and documented. Level 4 adds monitoring, so drift is detected. Level 5 adds regular testing, so the control is proven to work rather than assumed to.
Most organisations that believe themselves well configured land at level 2 or 3 across the board. The gap between 3 and 4 is where the practical risk sits, because a correctly configured control that silently drifts after an admin change looks identical from the outside to one that still works.
Peer comparison, and its limits
Peer comparisons require a disclosed sample, methodology and permission to use the data. Without that evidence, compare the customer’s controls against the agreed baseline and prior assessments rather than invent a market benchmark.
Where the comparison earns its place is in prioritisation. A domain where you sit well below the band is usually a domain where an inexpensive control is simply missing, and those items go to the top of the roadmap regardless of theoretical severity.
- Identity and authentication, including recovery paths
- Privilege and administrative role distribution
- Data sharing, link exposure and shared drive membership
- Application and OAuth grant governance
- Mail authentication and inbound filtering posture
- Endpoint and mobile enrolment coverage
- Logging, export and alerting configuration
- Retention, holds and tested restore capability
The roadmap is costed in hours, not in adjectives
Every gap carries an engineer-hour estimate and a dependency chain. A roadmap that says improve logging is worthless; one that says four hours to configure a log export sink, two hours to build three alert rules, and one hour a month to review them is something a finance director can approve.
The roadmap is sequenced into three waves: items fixable this week without a business decision, items needing a policy decision, and items needing budget or an edition change. Clients typically clear wave one internally and buy help for waves two and three, which is the outcome we design for.
Reassessment and the trend line
A single score is a talking point. Two scores six months apart are evidence of a functioning security programme, which is what insurers and enterprise procurement teams increasingly ask to see. Reassessment runs at a reduced fee and reuses the same baseline so the numbers are comparable.
Where a tenant is under a managed retainer, the score is refreshed quarterly as part of the service and the delta is reported alongside the change log, so nobody has to reconstruct what happened between assessments.
A decision worth checking
Assess logging and investigation coverage alongside authentication. Document where evidence is unavailable and what monitoring or export would be required; do not infer assurance from a high score in another domain.
What this doesn't cover
- An assessment is not a certification and will not by itself satisfy an ISO 27001 or SOC 2 assessor, though the evidence pack supports both.
- No peer benchmark is claimed without a substantiated, approved dataset and stated methodology.
- We assess configuration. Application-layer testing, code review and social engineering beyond an agreed simulation are out of scope.
- We do not remediate during the assessment, so the score reflects the tenant as found rather than as improved mid-engagement.
Discuss your security review
Tell us your edition, audit scope and the concern or requirement behind the enquiry. A configuration review, remediation and incident response are different engagements.
What happens next
We clarify the review boundary, edition-dependent controls and authorised access. The proposal separates assessment, remediation and any re-test.
Review the configuration audit scopePrefer to talk? Call +44 20 7183 3436 (Mon–Fri 08:00–18:00 GMT).
Questions we get asked
- How does an assessment differ from a security audit?
- An audit lists evidenced findings. An assessment can apply an agreed maturity model and sequence remediation; neither is certification and no peer comparison is implied without supporting data.
- How often should we reassess?
- Every six months for most organisations, quarterly where a managed retainer is in place or where an insurer or enterprise client asks for a documented trend.
- Can the score be shared with clients or insurers?
- Yes. The board summary is written to be shared verbatim, and it excludes the specific configuration detail that would be unwise to circulate outside the organisation.
How this page is verified
Reviewed by Workspace Migration Services security desk, Workspace security and compliance reviewers. Last checked .
- The 72-check baseline maps to CIS Benchmarks for Google Workspace as published on 2026-08-06.
- No substantiating company outcome dataset is published here; base findings on this engagement’s evidence and approved test scope.
- Fees are the Workspace Migration Services rate card as of 2026-08-06.
Sources you can check
Cite this page
Free to reuse with attribution. Copy whichever form your publication needs.
Plain citation
Workspace Migration Services, "Google Workspace security assessment", https://workspacemigration.services/security/google-workspace-security-assessment (last checked 2026-08-06).HTML with source link
<p>Workspace admin audit logs are retained for a limited window by default, so tenants that have never configured export cannot investigate an incident discovered months later. Source: <a href="https://workspacemigration.services/security/google-workspace-security-assessment">Google Workspace security assessment</a> — Workspace Migration Services.</p>Embed this table
<table>
<caption>Google Workspace security assessment — Workspace Migration Services, 2026-08-06</caption>
<tr><th>Baseline</th><td>72 checks across 8 control domains</td></tr>
<tr><th>Scoring</th><td>Maturity 1–5 per domain, weighted overall</td></tr>
<tr><th>Peer comparison</th><td>Not claimed without an approved, disclosed dataset</td></tr>
<tr><th>Turnaround</th><td>5 working days</td></tr>
<tr><th>Fee</th><td>£1,750 / $2,250 up to 250 seats</td></tr>
<tr><th>Deliverables</th><td>Score sheet, roadmap, board summary</td></tr>
</table>
<p><a href="https://workspacemigration.services/security/google-workspace-security-assessment">Google Workspace security assessment</a> — data maintained by Workspace Migration Services.</p>Related pages
Get a scored baseline
Agree the assessment baseline, evidence, access and roadmap scope first. Any re-assessment or comparative scoring is separately specified; no undocumented peer benchmark is promised.