Google Workspace security checklist for small business

Google Workspace is where most small businesses keep their email, files and calendars, so the settings in its Admin console protect a lot. You don't need an IT department to change them. Most of the settings below are a few clicks each.

Set aside about an hour. You'll need super admin access to the Google Admin console (admin.google.com) and the login for wherever your domain's DNS is managed, which is often the company you bought the domain from.

How do I enforce 2-Step Verification for my team?

2-Step Verification (2SV) means a stolen password isn't enough to get into an account. Google recommends it for everyone and says it's especially important for admins and people who handle financial or employee records. Google has also started enforcing 2SV for administrator accounts, so admins will need it either way. (What is MFA?)

To roll it out without surprising anyone:

1. Tell your team what's changing, why, and the date it becomes required.
2. Let people turn it on themselves. In the Admin console, go to Security → Authentication → 2-step verification and check Allow users to turn on 2-Step Verification.
3. Check who's enrolled under Reporting → User Reports → Security, which shows each person's 2SV status.
4. Back on the 2-step verification page, set Enforcement to On, or pick a start date. Set a New user enrollment period too, so new hires have time to enroll.
5. For allowed methods, Any except verification codes via text, phone call is a sensible middle ground for most teams. Text-message codes are the weakest option.

Ask everyone to print backup codes and keep them somewhere safe. If someone loses their phone, a backup code is how they get back in without a support ticket.

Today, send your team a short note with an enrollment deadline one or two weeks out.

How should I protect admin accounts?

Your super admin account can see and change everything in your business's Google account, so it deserves extra care. Google's advice for admin accounts comes down to a few habits:

• Use a separate admin account, such as admin-maria@yourbusiness.com for admin tasks and maria@yourbusiness.com for everyday email. Sign in to the admin account only when you need it, then sign out.
• Name two super admins, each a different person, so one can step in if the other account is lost or locked.
• Use security keys or passkeys. Google calls security keys the most secure form of 2SV because they resist phishing, and when you enforce Only security key for admins, passkeys count too.
• Enroll a spare key and save backup codes, and store both away from the primary key.
• Put a recovery phone number and email on each admin account.
• Keep your DNS login safe. If you ever need Google's help recovering a super admin account, Google may ask you to prove you control your domain's DNS.

Start by creating a dedicated admin account for yourself and a second super admin for a trusted colleague or partner.

How do I set up SPF, DKIM and DMARC for Workspace?

These three DNS records help other email providers confirm that messages from your domain really came from you. Without them, it's easier for scammers to spoof your address, and your real email is more likely to land in spam. Google also requires everyone who sends to personal Gmail accounts to use SPF or DKIM at a minimum.

SPF

SPF is added at your DNS host, not in the Admin console. If Google Workspace is your only sender, use the record above. If you also send through tools like a newsletter service or a store, combine their values into the same record. Your domain should only ever have one SPF record. You can confirm it with our free SPF checker.

DKIM

1. In the Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click Generate New Record. Choose 2048-bit if your DNS host supports it, and keep the default prefix, google.
3. Add the record name and value as a TXT record at your DNS host.
4. Return to Authenticate email and click Start authentication.

If you just set up Gmail, Google says you may need to wait 24 to 72 hours before you can generate a key.

DMARC

DMARC is also added at your DNS host. Google recommends waiting 48 hours after SPF and DKIM are working, then publishing DMARC with p=none. Watch the reports for a few weeks, then move to p=quarantine and later p=reject. Our guide on how to stop email spoofing covers this step by step.

To see which of the three records you already have, check your domain with our free DMARC checker.

Check your Workspace domain from the outside

Our free checkup looks at your SPF, DKIM, DMARC and website basics, then explains what to fix in plain English.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

Which security alerts should I turn on?

The Alert center (in the Admin console under Security → Alert center) collects warnings like suspicious sign-in attempts, leaked passwords, possible employee spoofing in Gmail, and users being given admin rights.

For a small team, make sure email notifications are on for these five alerts: "Suspicious login blocked," "Leaked password," "User granted Admin privilege," "User-reported phishing" and "Gmail potential employee spoofing."

While you're in the Admin console, Google's small business checklist also recommends turning on enhanced pre-delivery message scanning and the extra checks for attachments, links and external images in Gmail's settings. They help catch phishing that might otherwise slip through.

Open the Alert center now, review anything from the past 30 days, and confirm alert emails go to an inbox someone checks.

How do I control third-party app access?

Every time someone clicks "Sign in with Google" on a new app, that app may ask for access to their email, files or calendar. Over time, this adds up to a lot of apps with a lot of access.

1. In the Admin console, go to Security → Access and data control → API controls.
2. Under Accessed apps, click View list to see which apps people have connected. Mark the ones you rely on as Trusted or Limited, and Block anything you don't recognize.
3. Under Settings, choose how unconfigured apps are handled. Allow users to access third-party apps that only request basic info needed for Sign in with Google is a balanced choice for many small teams.

Changes can take up to 24 hours. Tell your team before you restrict access so nobody is surprised when an app stops working.

Go through the connected apps list once, and block any app you don't recognize or no longer use.

What Drive sharing settings should a small team use?

Shared links are convenient, and they're also how client files end up somewhere they shouldn't. Google's small business checklist recommends a few defaults. You'll find them under Apps → Google Workspace → Drive and Docs → Sharing settings.

• Turn link sharing off by default, so a new file stays private to its creator until they share it on purpose.
• If external sharing is on, make sure people see a warning when they share with someone outside your domain.
• If you mostly work with a few partners who also use Google Workspace, allow sharing only with those trusted domains.
• In Calendar sharing settings, restrict external sharing to free/busy information. Calendars often contain client names and meeting details.

Sharing changes can take up to 24 hours to apply everywhere.

Ask your team to look over files they've shared with "Anyone with the link," and switch any client or financial documents back to named people only.

What should happen when someone leaves?

A clear offboarding routine keeps former staff, and anyone who gets hold of their old password, out of your business data. Google's recommended steps are:

1. Wipe company data from their mobile devices.
2. Remove their recovery email and phone number.
3. Change their password.
4. Revoke access for connected apps (OAuth tokens).
5. Reset their sign-in cookies.
6. Revoke security keys and app passwords.
7. Transfer any files and email you need to keep, then delete the account.

Don't forget access outside Google: shared passwords, your website, your bank, and any tools they signed in to with their work account.

Save this list as a document and use it the next time someone leaves, even for short-term contractors.

Who needs Google's Advanced Protection Program?

The Advanced Protection Program bundles Google's strongest account protections into one setting. It requires security keys or passkeys to sign in, restricts third-party app access, turns on deeper Gmail scanning, and tightens account recovery. Google lists super admins, business leaders and law firms among the people it's designed for.

For a small business, a sensible approach is to enroll your super admins and the owner or anyone who approves payments. A super admin can allow enrollment in the Admin console, then each person enrolls with their own keys or passkeys. If you run a firm that handles sensitive client matters, our cybersecurity guide for law firms covers more.

Before you start enrollment, buy two security keys per admin: one primary, one spare.

What should you do next?

You don't need to finish this whole list in one sitting. A good order is:

1. Check your domain's email records with our free DMARC checker, and fix anything missing using how to stop email spoofing.
2. Enforce 2-Step Verification and set up a separate admin account this week.
3. Read SPF, DKIM and DMARC explained if you want to understand how the email records fit together.
4. Work through the broader small business cybersecurity checklist for everything beyond Google Workspace.