Sign-in security
2-Step Verification enforcement, security keys and session controls.
Google Workspace Security Assessment and Hardening
A Google Workspace security assessment is a review of your tenant's sign-in, administrator, sharing and email settings, with prioritised fixes. Google Workspace is secure by design but rarely configured securely. We review your admin settings, accounts, sharing and email security, and fix the gaps that attackers and accidental leaks exploit.
Google Workspace Security Assessment
What it is
A configuration review of your Google Workspace tenant with prioritised fixes, and optional hands-on hardening with your administrator.
Why organisations need it
Most Workspace incidents come from weak sign-in controls, too many administrators, files shared publicly by link, and email that can be spoofed. These are configuration problems, cheap to fix and expensive to ignore. They also matter under the PDPA's Security Principle, since Drive and Gmail hold much of an organisation's personal data.
What the engagement covers
Admin roles
Super admins and delegated roles reviewed.
Drive sharing
External and link sharing, shared drives and exposed files.
Gmail security
Phishing and malware protections and email authentication.
Devices and apps
Mobile device management and third-party app access.
Monitoring
Alert centre and audit logs.
What the business gets out of it
Quick wins
High-impact fixes first.
Less data exposure
Public links found and closed.
Fewer account takeovers
Strong sign-in enforced.
PDPA support
Evidence for the Security Principle.
Practical
Fixes your admin can apply.
How it works
How the engagement runs
01
Access
Read-only admin access agreed.
02
Review
Settings, accounts and sharing.
03
Findings
Prioritised report.
04
Hardening
Optional fixes with your admin.
05
Re-check
Confirming changes.
Deliverables
What you receive
Assessment report
Findings by risk.
Hardening checklist
Step-by-step fixes.
Exposed files list
Publicly shared items.
Admin role review
Recommended roles.
Re-check summary
After fixes.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
Read-only administrator access is enough for the assessment, so nothing can be changed by accident while we review. Hardening, where we apply the fixes, needs admin rights or your administrator working alongside us, and every change is agreed with you first.
Not if they are sequenced. Changes such as enforcing multi-factor sign-in or restricting external sharing are rolled out in stages and communicated to users first, so nobody is locked out and teams know what to expect. We plan the order with your administrator.
Typically one to two weeks for the assessment: scoping and read-only access, review of sign-in controls, administrator roles, Drive sharing and email security, then a findings walkthrough. Optional hardening is scheduled afterwards, in stages.
No. This assessment covers Google Workspace, meaning Gmail, Drive, accounts and admin settings. Google Cloud infrastructure is a separate assessment, covered by our Cloud Security Posture Assessment.
Yes. Gmail and Drive hold much of an organisation's personal data, and the PDPA's Security Principle expects practical steps to protect it. The assessment report evidences the security measures over those systems, which is useful in a PDPA audit or after an incident.