ADMIN-025: Multi-party approval required for sensitive admin actions (GWS.COMMONCONTROLS.17.1)
- Platform
- Google Workspace
- Category
- Admin & User Management
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.COMMONCONTROLS.17.1: multi-party approval forces a second admin to sign off on the sensitive actions an attacker performs immediately after taking over an admin account, such as disabling security settings or altering recovery options. It converts a single compromised session into an action that has to survive another human. Reads multi_party_approval.require_approvals and warns where multiPartyApprovalState is anything other than ENABLED.
Recommended value
Multi-party approval enabled for sensitive admin actions
Remediation
Admin console > Account > Multi-party approval. Turn on the requirement for sensitive admin actions and confirm at least two super admins exist to approve them.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.COMMONCONTROLS.17.1v1
- NIST SP 800-53
- AC-3, AC-6, CM-5
- MITRE ATT&CK
- T1078.004