DRIVE-019: External-sharing warning enabled (GWS.DRIVEDOCS.1.3)
- Platform
- Google Workspace
- Category
- Drive Security & Data Protection
- Severity
- Medium
- Zero Trust pillar
- Data (weight 2)
- Golden fixtures
- 7
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.DRIVEDOCS.1.3: a user sharing a file outside the organization should be told so at the moment of sharing, which is the last point at which an accidental disclosure is still cheap to stop. Reads drive_and_docs.external_sharing and pairs externalSharingMode with the warning field that mode actually uses: warnForSharingOutsideAllowlistedDomains when sharing is limited to allowlisted domains, warnForExternalSharing when sharing is open. Where external sharing is disallowed the policy cannot apply and the check reports that rather than a silent pass.
Recommended value
Users are warned before sharing Drive content outside the organization
Remediation
Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings. With sharing set to allowlisted domains, turn on 'Warn when files owned by users or shared drives are shared outside allowlisted domains'. With sharing open, turn on 'Warn when files owned by users or shared drives are shared outside <organization>'.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| clean-allowlisted | PASS |
| field-missing | Not Assessed |
| known-bad | FAIL |
| known-bad-allowlisted | FAIL |
| not-applicable | PASS |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.DRIVEDOCS.1.3v1
- NIST SP 800-53
- AC-3, AC-4, AT-2
- MITRE ATT&CK
- T1537