Google Workspace security audit

The audit is deliberately narrow and repeatable. It covers admin roles and privilege distribution, authentication including two-factor coverage and recovery options, external sharing and link exposure, third-party OAuth grants and marketplace applications, mail authentication with SPF, DKIM and DMARC, endpoint and mobile management policy, logging and alerting configuration, and retention including Vault holds.

Each domain produces findings with a severity, a plain description of the exposure, and the exact console path to fix it. Severity is assigned on exploitability and blast radius rather than on a vendor scoring table, because a super-admin account without two-factor authentication matters more than a dozen cosmetic policy gaps.

This is a configuration review, not a penetration test. We do not attempt to breach accounts, phish your staff or test application code. That work exists and is valuable; it is a different engagement with a different scope document and different indemnities.

The reason to be explicit is that many organisations buy a configuration review believing it constitutes assurance against attack. It does not. What it does is remove the failures that are visible from the admin console, which is where a large share of real-world Workspace incidents actually begin.

Every finding gets an owner, an effort estimate in hours, and a dependency note where fixing one thing requires another first. Enforcing two-factor authentication across a domain, for example, is a fifteen-minute setting and a three-week communications exercise, and pretending otherwise produces a list nobody executes.

Roughly two-thirds of findings in a typical tenant are fixable inside a day by one competent administrator. The rest need a decision from someone with authority over how the business works, and those are flagged as decisions rather than tasks so they do not sit unowned in a spreadsheet.

An audit that is never re-tested is an expensive document. One re-test is included within ninety days, covering every finding marked as remediated. The re-test produces a short delta report suitable for sending to a board, an insurer or a client's procurement team.

Where clients need this repeatedly, for cyber insurance renewals or client due-diligence questionnaires, we run it quarterly on a retainer at a reduced rate. The value there is the trend line rather than any single report.