GWS-K12-006: Student Communication Boundaries
- Platform
- Google Workspace
- Category
- K12 Baseline
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 7
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
- Scope
- OU-scoped: requires the -StudentOU input (or the Student OUs field in Show-Guerrilla). Without it, this check reports Not Assessed.
Guerrilla K12 Baseline (candidate)
This check assesses control K12-SAFE-001 of the K12 Secure Configuration Baseline, version 0.1.0, a candidate community baseline authored by Guerrilla. It is openly published and open for comment; it is not a consensus standard, and this block is deliberately separate from the external framework mappings below.
What it checks
Chat and Meet each have independent settings governing whether accounts can communicate with people outside the organization. For student OUs these settings are a safety boundary: they determine whether an account outside the district can initiate contact with a student through district-provided tools. A FAIL here means a setting permits a class of external contact the district has not affirmatively decided to permit; it does not mean such contact has occurred. Gmail external-mail restrictions live in routing rules this check cannot read and are noted for manual review.
Recommended value
Student OU external chat off or restricted to trusted domains; students join district-hosted meetings only
Remediation
Chat: Admin Console > Apps > Google Workspace > Google Chat > External chat settings; select the student OU and turn external chat off or restrict to allowlisted domains. Meet: Admin Console > Apps > Google Workspace > Google Meet > Meet safety settings; select the student OU and limit which meetings users can join to your organization. Gmail: review any student external-mail restrictions under Apps > Google Workspace > Gmail > Routing.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-policy | WARN |
| no-scope | Not Assessed |
| not-assessed | Not Assessed |
| ou-absent | Not Assessed |
| restricted-warn | WARN |
Framework mappings
- NIST SP 800-53
- AC-4