ADMIN-023: Super admin count within the supported range (GWS.COMMONCONTROLS.6.2)
- Platform
- Google Workspace
- Category
- Admin & User Management
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 4
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.COMMONCONTROLS.6.2: a tenant needs at least two super admins so a single lost account cannot lock the organization out, and no more than eight because every additional super admin is an unconstrained path to the whole tenant. Counts enabled accounts carrying super-admin privilege from the directory and fails outside the range of two to eight. Break-glass accounts are a documented exception to be recorded rather than an automatic pass, so they are counted and listed rather than silently excluded.
Recommended value
Between two and eight separate super admin accounts, with any break-glass accounts documented
Remediation
Admin console > Account > Admin roles > Super Admin. If fewer than two, promote a second dedicated admin account so recovery is possible. If more than eight, move admins onto the narrowest delegated role that covers their duties and remove super-admin privilege.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad-too-few | FAIL |
| known-bad-too-many | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.COMMONCONTROLS.6.2v1
- NIST SP 800-53
- AC-2, AC-6, AC-6(5)
- MITRE ATT&CK
- T1078.004