EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1)
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- Medium
- Zero Trust pillar
- Data (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.GMAIL.11.1 recommends disabling automatic email forwarding, especially to external domains. Auto-forwarding is a common data-exfiltration channel and a persistence mechanism after account takeover, because it silently copies inbound mail to an attacker-controlled address. This check reads the gmail.auto_forwarding Cloud Identity policy and flags any organizational unit where automatic forwarding is enabled.
Recommended value
Automatic email forwarding disabled (enableAutoForwarding = false) in all organizational units.
Remediation
In the Google Admin console, under Apps > Google Workspace > Gmail > End User Access, disable 'Allow users to automatically forward incoming email to another address', prioritizing external destinations. Review existing forwarding rules for unexpected external recipients.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.GMAIL.11.1v1
- NIST SP 800-53
- AC-4, SC-7