GWS-SITES-001: Sites Service Disabled
- Platform
- Google Workspace
- Category
- Gemini for Workspace
- Severity
- Low
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The Google Sites service should be disabled for all users to reduce attack surface, consistent with least-privilege. Sites can be enabled selectively per organizational unit or group where there is a documented need.
Recommended value
Sites service OFF for everyone (enable selectively per OU/group only as needed)
Remediation
Admin Console > Apps > Google Workspace > Sites > Service status > Set to OFF for everyone. Enable selectively per organizational unit or group only where a documented business need exists.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.SITES.1.1v1
- NIST SP 800-53
- CM-7
- MITRE ATT&CK
- T1526, T1530