ADMIN-024: Marketplace apps limited to an allowlist (GWS.COMMONCONTROLS.11.1)
- Platform
- Google Workspace
- Category
- Admin & User Management
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 3)
- Golden fixtures
- 6
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.COMMONCONTROLS.11.1: a Marketplace application installed by a user inherits that user's access to Workspace data through OAuth, so an unrestricted Marketplace is a self-service data-egress channel that never passes through review. Reads workspace_marketplace.apps_access_options and requires accessLevel to be ALLOW_LISTED_APPS or ALLOW_NONE. It additionally fails when allowAllInternalApps is on, because that setting exempts internally published apps from the allowlist the control exists to enforce.
Recommended value
Marketplace installs restricted to an allowlist or blocked entirely, with internal apps not exempted
Remediation
Admin console > Apps > Google Workspace Marketplace > Settings. Set app access to 'Allow users to install only allowlisted apps' or block installs entirely, and turn off the option that allows all internal apps.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| clean-blocked | PASS |
| field-missing | Not Assessed |
| known-bad-access | FAIL |
| known-bad-internal | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.COMMONCONTROLS.11.1v1
- NIST SP 800-53
- CM-7, AC-3, SA-9
- MITRE ATT&CK
- T1550.001