EMAIL-036: Spam filter bypass not enabled for all senders (GWS.GMAIL.18.3)
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 3)
- Golden fixtures
- 4
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.GMAIL.18.3: an override list that hides the warning banner for all messages from internal and external senders removes the single most visible signal a user has that a message is untrusted, across the entire tenant rather than for a reviewed exception. Reads gmail.spam_override_lists and fails where any override entry sets hideWarningBannerForAll, naming the entries responsible.
Recommended value
No override list hides warning banners for all internal and external senders
Remediation
Admin console > Apps > Google Workspace > Gmail > Spam, phishing and malware. Open each override or approved-sender list and clear the option that bypasses spam filters and hides warnings for all messages from internal and external senders.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| field-missing | Not Assessed |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.GMAIL.18.3v1
- NIST SP 800-53
- SI-8, SI-3, AT-2
- MITRE ATT&CK
- T1566