GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2)
- Plataforma
- Google Workspace
- Categoría
- Collaboration
- Severidad
- Medium
- Pilar de Zero Trust
- Data (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.GROUPS.1.2 requires that group owners not be permitted to add members from outside the organization. External members gain access to everything shared with the group. This check flags organizational units where owners can allow external members (ownersCanAllowExternalMembers is enabled).
Valor recomendado
Group owners cannot allow external members (ownersCanAllowExternalMembers disabled)
Remediación
In Groups for Business sharing settings, disable the option that lets group owners add members from outside the organization, so external membership requires administrative action.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.GROUPS.1.2v1
- NIST SP 800-53
- AC-2, AC-3, SC-7