Google Workspace
Google Workspace: admin management, authentication, Drive, Gmail, groups, OAuth, devices, and logging.
- Command
Invoke-GWSAudit- checks
- 190
- Check families
- 11
| Family | Checks |
|---|---|
| Admin & User Management | 25 |
| Advanced Threat Protection | 36 |
| Adversary Tradecraft | 7 |
| Authentication & Access Controls | 19 |
| Collaboration | 25 |
| Device & Endpoint Management | 11 |
| Drive Security & Data Protection | 23 |
| Gemini for Workspace | 12 |
| K12 Baseline | 15 |
| Logging, Alerting & Monitoring | 7 |
| OAuth & API Security | 10 |
Admin & User Management (25)
- ADMIN-001: Super Admin Account Inventory Critical
- ADMIN-002: Admin Role Assignments Audit High
- ADMIN-003: Delegated Admin Permissions Review Medium
- ADMIN-004: Inactive/Suspended Admin Accounts High
- ADMIN-005: User Account Inventory Medium
- ADMIN-006: Stale User Accounts Medium
- ADMIN-007: OU Structure Review Low
- ADMIN-008: Directory Sharing Settings Medium
- ADMIN-009: User Profile Visibility Low
- ADMIN-010: Groups Settings and External Membership High
- ADMIN-011: Group Creation Restrictions Medium
- ADMIN-012: Groups for Business Settings Medium
- ADMIN-013: Super Admin Count High
- ADMIN-014: Assured Controls - Access Approvals Enabled Medium
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff Medium
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled Medium
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3) Medium
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1) Low
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2) Low
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4) High
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1) Medium
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2) Medium
- ADMIN-023: Super admin count within the supported range (GWS.COMMONCONTROLS.6.2) High
- ADMIN-024: Marketplace apps limited to an allowlist (GWS.COMMONCONTROLS.11.1) High
- ADMIN-025: Multi-party approval required for sensitive admin actions (GWS.COMMONCONTROLS.17.1) Medium
Advanced Threat Protection (36)
- EMAIL-001: SPF Record Validation Critical
- EMAIL-002: DKIM Signing Enabled Critical
- EMAIL-003: DMARC Policy Audit Critical
- EMAIL-004: MTA-STS Policy Medium
- EMAIL-005: TLS Enforcement High
- EMAIL-006: Email Allowlist/Blocklist Review Medium
- EMAIL-007: Inbound Gateway Configuration Medium
- EMAIL-008: Email Routing Rules Audit Medium
- EMAIL-009: Auto-Forwarding Policy High
- EMAIL-010: Delegate Access Settings Medium
- EMAIL-011: POP/IMAP Access Settings High
- EMAIL-012: Spam and Phishing Filter Settings High
- EMAIL-013: Enhanced Pre-Delivery Message Scanning High
- EMAIL-014: External Recipient Warning Medium
- EMAIL-015: Attachment Safety Settings High
- EMAIL-016: Links and External Images Protection High
- EMAIL-017: Spoofing and Authentication Protection Critical
- EMAIL-018: Compliance Rules Audit Medium
- EMAIL-019: DLP Rules Configuration Medium
- EMAIL-020: Gmail Confidential Mode Low
- EMAIL-021: S/MIME Settings Low
- EMAIL-022: Mail Forwarding Rule Enumeration High
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1) Medium
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1) Medium
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1) Medium
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1) High
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1) Low
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1) Low
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1) Low
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1) Medium
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1) Medium
- EMAIL-032: Comprehensive mail storage enabled (GWS.GMAIL.17.1) Medium
- EMAIL-033: Unsafe attachments are not left in the inbox (GWS.GMAIL.5.5) High
- EMAIL-034: Spoofed and unauthenticated mail is not left in the inbox (GWS.GMAIL.7.6) High
- EMAIL-035: No domains bypass spam filtering and warnings (GWS.GMAIL.18.2) High
- EMAIL-036: Spam filter bypass not enabled for all senders (GWS.GMAIL.18.3) High
Adversary Tradecraft (7)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure Critical
- GTRADE-002: Internet-Readable Google Groups High
- GTRADE-003: Open-Join / External-Member Groups Medium
- GTRADE-004: Super-Admin Sprawl Medium
- GTRADE-005: Super-Admin-Equivalent Custom Roles Medium
- GTRADE-006: Persistent / Over-Scoped OAuth Grants High
- GTRADE-007: Admin Role Granted Through a Group High
Authentication & Access Controls (19)
- AUTH-001: 2SV Enforcement Critical
- AUTH-002: 2SV Enrollment Rate High
- AUTH-003: 2SV Method Strength Medium
- AUTH-004: Password Minimum Length High
- AUTH-005: Password Reuse Restriction Medium
- AUTH-006: Session Duration Medium
- AUTH-007: SSO Configuration Medium
- AUTH-008: Less Secure Apps Access High
- AUTH-009: App Passwords Policy Medium
- AUTH-010: Recovery Options Configuration High
- AUTH-011: Login Challenge Settings Medium
- AUTH-012: Super Admin 2SV Enrollment Critical
- AUTH-013: Stale Super Admin Accounts High
- AUTH-014: 2SV Enrollment Allowed Medium
- AUTH-015: 2SV Enrollment Grace Period Low
- AUTH-016: Advanced Protection Self-Enrollment Low
- AUTH-017: Super Admin Account Self-Recovery High
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2) Medium
- AUTH-019: Conflicting unmanaged accounts replaced (GWS.COMMONCONTROLS.7.1) Medium
Collaboration (25)
- COLLAB-001: Meet Recording Settings Medium
- COLLAB-002: Meet External Participant Settings Medium
- COLLAB-003: Meet Anonymous Join Settings Medium
- COLLAB-004: Chat External Communication High
- COLLAB-005: Chat History Settings Medium
- COLLAB-006: Chat Spaces External Access Medium
- COLLAB-007: Chat App Installation Settings Low
- COLLAB-008: Calendar External Sharing High
- COLLAB-009: Calendar External Invitations Medium
- COLLAB-010: Calendar Appointment Slots External Visibility Low
- COLLAB-011: Meet External Participant Labeling Low
- COLLAB-012: Meet Host Management Medium
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1) High
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1) Low
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1) High
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2) Low
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1) Low
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1) Low
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1) Low
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1) High
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2) Medium
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3) Medium
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1) Low
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1) Low
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1) Low
Device & Endpoint Management (11)
- DEVICE-001: MDM Policy Audit High
- DEVICE-002: Device Approval Requirements High
- DEVICE-003: Screen Lock Enforcement High
- DEVICE-004: Device Encryption Requirements High
- DEVICE-005: Compromised Device Blocking High
- DEVICE-006: Jailbroken/Rooted Device Policy High
- DEVICE-007: Chrome Browser Management Medium
- DEVICE-008: Chrome Extension Whitelist/Blocklist High
- DEVICE-009: Chrome OS Device Policies Medium
- DEVICE-010: Endpoint Verification Settings Medium
- DEVICE-011: Company-Owned Device Inventory Low
Drive Security & Data Protection (23)
- DRIVE-001: External Sharing Defaults High
- DRIVE-002: Link Sharing Default Settings High
- DRIVE-003: Anyone With the Link Sharing Audit High
- DRIVE-004: Shared Drive Creation Restrictions Medium
- DRIVE-005: Shared Drive Member Management Medium
- DRIVE-006: Shared Drive External Sharing High
- DRIVE-007: File Ownership Transfer Settings Medium
- DRIVE-008: Drive for Desktop Allowed/Blocked Medium
- DRIVE-009: Third-Party App Drive Access High
- DRIVE-010: Drive DLP Rules Audit Medium
- DRIVE-011: Target Audience Settings Medium
- DRIVE-012: Drive Add-ons Settings Low
- DRIVE-013: Offline Access Settings Medium
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1) High
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9) Low
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1) Medium
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8) Medium
- DRIVE-018: Shared Drive External-Sharing Exposure High
- DRIVE-019: External-sharing warning enabled (GWS.DRIVEDOCS.1.3) Medium
- DRIVE-020: Sharing with non-Google accounts disabled (GWS.DRIVEDOCS.1.4) Medium
- DRIVE-021: Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5) High
- DRIVE-022: Content distribution to outside shared drives blocked (GWS.DRIVEDOCS.1.7) Medium
- DRIVE-023: Drive for Desktop limited to authorized devices (GWS.DRIVEDOCS.5.1) High
Gemini for Workspace (12)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes Medium
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join Medium
- GWS-CLASS-003: Classroom API Data Access Restricted Medium
- GWS-CLASS-004: Classroom Roster Import Disabled Low
- GWS-CLASS-005: Classroom Student Unenrollment Restricted Low
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers Medium
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users Medium
- GWS-GEMINI-002: Gemini Alpha Features Disabled Low
- GWS-GEMINI-003: Gemini Conversation History Enabled Low
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months Low
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled Medium
- GWS-SITES-001: Sites Service Disabled Low
K12 Baseline (15)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff Medium
- GWS-K12-002: Student External Drive Sharing Restricted High
- GWS-K12-003: Students Cannot Authorize Third-Party Apps High
- GWS-K12-004: Vendor Delegated Access Review High
- GWS-K12-005: Delegated Admin Least Privilege High
- GWS-K12-006: Student Communication Boundaries High
- GWS-K12-007: Guardian Access Integrity Medium
- GWS-K12-008: Managed Student Chromebook Posture Medium
- GWS-K12-009: Departed Student Account Disposition Medium
- GWS-K12-010: Student Account Security Floor High
- GWS-K12-011: Student Auto-Forwarding Disabled Medium
- GWS-K12-012: Student Data Export (Takeout) Disabled Medium
- GWS-K12-013: Legacy Authentication Disabled For Students High
- GWS-K12-014: Vault Export And Retention Privileges Restricted High
- GWS-K12-015: Audit Logging License Coverage Medium
Logging, Alerting & Monitoring (7)
- LOG-001: Audit Log Retention Settings High
- LOG-002: Alert Center Rules Inventory High
- LOG-003: Activity Rules Coverage Analysis Medium
- LOG-004: Data Export Settings Medium
- LOG-005: Admin Email Alerts Configuration Medium
- LOG-006: Reporting API Access Low
- LOG-007: System-defined alerting rules all enabled (GWS.COMMONCONTROLS.13.1) High
OAuth & API Security (10)
- OAUTH-001: OAuth App Whitelist/Blocklist High
- OAUTH-002: Installed OAuth Apps Inventory High
- OAUTH-003: OAuth Scope Analysis Critical
- OAUTH-004: OAuth App Risk Scoring High
- OAUTH-005: Unverified App Access Policy High
- OAUTH-006: API Access Control Medium
- OAUTH-007: Marketplace App Installation Restrictions Medium
- OAUTH-008: Domain-Wide Delegation Grants Audit Critical
- OAUTH-009: Service Account Key Enumeration High
- OAUTH-010: Connected Apps With Sensitive Scopes High