When you need it
Your Google Workspace grew with the company. Some people still sign in with only a password, several users work as super admins every day, and dozens of third-party apps can read mail and files because someone once clicked "Allow". Files are shared with anyone who has the link, phones reach company email with no controls, and nobody has checked the admin settings since setup.
What sets the quote
- One Google Workspace organisation, sized from counts in the Google Admin console: users, admins, organisational units, third-party apps with access to your data, shared drives, and devices per platform.
- Check, 1 week: a read-only review against Google's recommended settings, with findings ranked by risk.
- Baseline, 2–3 weeks: the check and the rollout, for up to 500 users, 15 admins and 50 third-party apps.
- Device management adds 1–2 weeks: Google endpoint management for up to 500 phones and computers.
- What can be switched on depends on your Workspace edition (see the table below). If your edition lacks a control you need, the review says so and names the edition that has it.
- More users, several Workspace organisations, or full Mac management, which needs a separate Apple management tool, are quoted after sizing.
What changes
- Everyone signs in with 2-Step Verification, and admins use security keys or passkeys.
- Daily work never runs on a super admin account, and a tested recovery process gets you back in if an admin account is lost.
- Only apps you have reviewed can read your mail, files and calendars.
- Files stay inside the company unless someone shares them on purpose, and spoofed or dangerous email is caught before people open it.
- Every phone and computer that reaches company data is known, protected by a passcode and can be wiped remotely. On Android, work data lives in a separate work profile.
What you get
- 2-Step Verification enforced for everyone, security keys or passkeys required for admins, and login challenges switched on
- Separate super admin accounts kept out of daily use, least-privilege admin roles, and a tested account-recovery process
- Third-party app access control, with unreviewed apps blocked and the apps people already use reviewed and either trusted, limited or removed
- Gmail safety settings for spoofing, attachments and links, DKIM signing switched on, and Drive sharing defaults that limit external and link sharing
- Alert center rules routed to your IT owner
- Device management: advanced mobile management, passcode and encryption rules, device approvals, remote wipe, Android work profiles, and Windows device management where your edition includes it
- On Enterprise editions: Context-Aware Access, so Workspace opens only from approved devices, iOS data protection for Google's apps, and data loss prevention rules for Drive and Gmail
- A settings workbook with the reason and rollback step for each change, and a 90-minute handover with your admins
What each edition allows
| Control | Business Starter and Standard | Business Plus | Enterprise Standard and Plus |
|---|---|---|---|
| 2-Step Verification, admin roles, third-party app control, Gmail safety, Drive sharing, alert center | Yes | Yes | Yes |
| Basic mobile management: passcode rules, account wipe | Yes | Yes | Yes |
| Advanced mobile management: device approvals, remote device wipe, Android work profiles, zero-touch enrolment | — | Yes | Yes |
| Windows device management | — | Yes | Yes |
| Company-owned iPhones and iPads through Apple Business Manager, and iOS data protection | — | — | Yes |
| Context-Aware Access | — | — | Yes |
| Data loss prevention for Drive and Gmail, and the security investigation tool | — | — | Yes |
Macs are reported and checked by Endpoint Verification on every edition, but Google doesn’t manage them. Full ChromeOS management needs Chrome Enterprise Upgrade.
On Microsoft 365, the Microsoft 365 security baseline covers the same ground with Entra ID and Intune. To use Google Workspace as the single sign-on for your other business applications, add identity modernisation.
Not included
- Google Workspace licences, Chrome Enterprise Upgrade and hardware. The design states which edition each control needs.
- Full Mac management, which Google endpoint management does not provide
- Email migration, and Google Vault retention rules and legal holds
- DMARC at reject and MTA-STS (see email domain protection)
- Watching and responding to alerts; we do not offer 24/7 security monitoring
What we need from you
- For the review: a custom admin role with read-only privileges. For the rollout: a time-limited super admin, which Google requires for some settings, such as the Apple device setup.
- A named IT owner who approves each rollout stage, about 2 hours a week.
- Pilot users from each main team, with their phones and computers.
- For company-owned iPhones and iPads: an Apple Business Manager account. It needs your company's D-U-N-S number, and we guide you through it.
How it works
Free 30-minute call, then the counts that size the work and a written fixed quote.
Review of the Admin console settings, your edition, third-party apps, sharing and devices, then target settings, exceptions and rollout groups agreed with your team.
Rollout in stages, starting with a pilot organisational unit, then the rest of the company.
Handover of the settings workbook and the recovery procedure in a 90-minute session with your admins.
At a glance
- Duration
- 1–5 weeks
- Price
- Fixed quote after a free 30-minute call
- Delivered by
- Our lead architect
Related services
PKI review
A one-week review of your PKI and certificates, covering the CA hierarchy, certificate inventory, TLS settings and revocation, rated red, amber or green, with an expiry risk list and a roadmap.
Domain and external attack surface check
A one-week, non-intrusive check of your domains, DNS, email authentication and internet-facing endpoints, with every finding tied to evidence and a fix. It is not a penetration test.
Microsoft 365 security baseline
Conditional Access, phishing-resistant MFA and just-in-time admin rights for Microsoft 365, plus Intune for every laptop and phone, from automatic enrolment and app protection to Defender for Endpoint, in 1–6 weeks.