GWS-K12-010: Student Account Security Floor
- Platform
- Google Workspace
- Category
- K12 Baseline
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 7
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
- Scope
- OU-scoped: requires the -StudentOU input (or the Student OUs field in Show-Guerrilla). Without it, this check reports Not Assessed.
Guerrilla K12 Baseline (candidate)
This check assesses control K12-ACCT-001 of the K12 Secure Configuration Baseline, version 0.1.0, a candidate community baseline authored by Guerrilla. It is openly published and open for comment; it is not a consensus standard, and this block is deliberately separate from the external framework mappings below.
What it checks
An honest student security floor is age-banded: strong password policy and district-controlled recovery everywhere; 2-Step Verification enforced for OUs serving students old enough to hold a second factor. Student-controlled account self-recovery is an account-takeover path at any age and fails this check; a missing 2SV enforcement is reported as context for the district's age-band decision, never as a blind failure of an elementary OU.
Recommended value
Self-recovery disabled for student OUs; STRONG password policy with minimum length 12+; 2SV enforced where the age band supports it, with documented exceptions elsewhere
Remediation
Admin Console > Security > Authentication. Select the student organizational unit. Under Account recovery, turn user account self-recovery off for student OUs (recovery runs through the district help desk). Under Password management, enforce strong passwords with minimum length 12 or higher. Under 2-step verification, enforce 2SV for age bands that can hold a second factor and document the exception for younger OUs.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-policy | WARN |
| no-scope | Not Assessed |
| not-assessed | Not Assessed |
| ou-absent | Not Assessed |
| weak-floor | WARN |
Framework mappings
- NIST SP 800-53
- IA-5, AC-2
- MITRE ATT&CK
- T1098, T1110