Sign-in security
2-Step Verification enforcement, security keys and session controls.
Cybersecurity / Google Workspace
Google Workspace Security Assessment and Hardening
Google Workspace is secure by design but rarely configured securely. We review your admin settings, accounts, sharing and email security, and fix the gaps that attackers and accidental leaks exploit.
Overview
Google Workspace Security Assessment
What it is
A configuration review of your Google Workspace tenant with prioritised fixes, and optional hands-on hardening with your administrator.
Why organisations need it
Most Workspace incidents come from weak sign-in controls, too many administrators, files shared publicly by link, and email that can be spoofed. These are configuration problems, cheap to fix and expensive to ignore. They also matter under the PDPA's Security Principle, since Drive and Gmail hold much of an organisation's personal data.
Key features
What the engagement covers
Admin roles
Super admins and delegated roles reviewed.
Drive sharing
External and link sharing, shared drives and exposed files.
Gmail security
Phishing and malware protections and email authentication.
Devices and apps
Mobile device management and third-party app access.
Monitoring
Alert centre and audit logs.
Business value
What the business gets out of it
Quick wins
High-impact fixes first.
Less data exposure
Public links found and closed.
Fewer account takeovers
Strong sign-in enforced.
PDPA support
Evidence for the Security Principle.
Practical
Fixes your admin can apply.
How it works
How the engagement runs
01
Access
Read-only admin access agreed.
02
Review
Settings, accounts and sharing.
03
Findings
Prioritised report.
04
Hardening
Optional fixes with your admin.
05
Re-check
Confirming changes.
Deliverables
What you receive
Assessment report
Findings by risk.
Hardening checklist
Step-by-step fixes.
Exposed files list
Publicly shared items.
Admin role review
Recommended roles.
Re-check summary
After fixes.
Who it is for
Who this is built for
Industries
Company sizes
Departments
Why Orbix
Why organisations choose Orbix
A governance approach, not a tool sale
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Recommendations you can actually implement
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Consultants who have sat on your side of the table
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Built for the Malaysian operating context
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
HRD Corp expertise where it applies
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Questions
Questions we get asked
Do you need full admin access?
Read-only access is enough for the assessment. Hardening needs admin rights or your administrator's help.
Will changes disrupt users?
We sequence changes and communicate them to avoid lockouts.
How long does it take?
Typically one to two weeks for the assessment.
Do you cover Google Cloud Platform?
No. This covers Google Workspace. Cloud infrastructure is a separate assessment.
Does this help with PDPA?
Yes. It evidences security measures over systems holding personal data.
Get started
Close the gaps in your Google Workspace
Tell us your number of users and edition. We will quote a fixed fee.