AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2)
- Platform
- Google Workspace
- Category
- Authentication & Access Controls
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.COMMONCONTROLS.8.2 requires that account self-recovery be disabled for users and non-super-admin accounts. Self-service recovery is an account-takeover vector: an attacker who controls a recovery channel can seize the account without the help desk. This check reads the security.user_account_recovery Cloud Identity policy and flags any organizational unit where self-recovery is enabled.
Recommended value
Account self-recovery disabled (enableAccountRecovery = false) for users and non-super admins in all organizational units.
Remediation
In the Google Admin console, under Security > Account recovery, disable self-recovery for users (and non-super admins), so account recovery is handled through an administrator or help-desk process rather than a user-controlled channel.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.COMMONCONTROLS.8.2v1
- NIST SP 800-53
- IA-5, AC-2