Google Workspace settings for Cyber Essentials
Five controls, in scheme order, with the setting path and question number for every step. Applies to Google Workspace Business Standard (paths checked against Google Workspace Admin Help).
Cyber Essentials v3.3 requires 2-Step Verification for every Google Workspace user and super admin, super admin accounts kept for administration only, and prompt suspension of leavers. In the Admin console that means enforced 2-Step Verification, security keys for super admins, blocked third-party app access, mobile screen locks and a written offboarding routine.
- Platform
- Google Workspace (Google)
- Applies to
- Google Workspace Business Standard (paths checked against Google Workspace Admin Help)
- Paths last checked
- 2026-11
- Controls covered
- Firewalls, Secure configuration, Security update management, User access control, Malware protection
- Questions
- A2.8A2.9A5.1A5.10A5.2A5.9A6.1A6.2.1A6.5AUTO-FAILA6.5.1A7.11A7.12A7.14A7.16AUTO-FAILA7.17AUTO-FAILA7.3A7.5A7.6A7.7A7.8A7.9A8.3A8.4A8.5
- Steps
- 16 settings across 5 controls
- Reviewed against
- Requirements v3.3 and the Danzell question set v16.3
A4: how do you configure Google Workspace for firewalls?
Apply 2 settings in Google Workspace: turn off POP and IMAP where nobody needs them and protect admin console access with security keys. Together they provide evidence for A5.1 and A7.16.
Google Workspace has no boundary firewall you manage. The equivalent is the authentication boundary: who can sign in, with what, and over which protocols. List Workspace as a cloud service in A2.9; cloud services cannot be excluded from scope. See the firewalls requirements for what the control asks.
Turn off POP and IMAP where nobody needs them
A5.1Admin console > Apps > Google Workspace > Gmail > End User Access > POP and IMAP access: untick Enable IMAP access and Enable POP access for all usersGoogle ended less secure app (password-only) access for Workspace accounts in 2025, so the old Less secure apps setting is gone. Mail clients now sign in with OAuth. Turning off POP and IMAP removes protocols you do not use.
Protect admin console access with security keys
A7.16AUTO-FAILAdmin console > Security > Authentication > 2-step verification > select the super admin organisational unit or group > Methods: Only security key (also accepts passkeys)Context-Aware Access can also restrict access to managed devices or trusted IP ranges, but it is not included in the Business editions; check your edition in Google's feature comparison before relying on it.
A5: how do you configure Google Workspace for secure configuration?
Apply 4 settings in Google Workspace: suspend or delete unused accounts, block unconfigured third-party apps, set the password policy and require a screen lock on mobile devices. Together they provide evidence for A5.2, A7.3, A5.1, A7.11, A7.12, A5.9, A5.10 and A2.8.
Remove accounts nobody uses, stop users granting third-party apps access to organisational data, and make sure every phone and tablet that syncs Workspace data locks. See the secure configuration requirements for what the control asks.
Admin console > Reporting > User reports > Accounts (check each account's last sign-in), then Directory > Users > point to the user > More options > Suspend user or Delete userCheck shared and test accounts too. A suspended account cannot sign in but keeps its data for transfer.
Block unconfigured third-party apps
A5.1Admin console > Security > Access and data control > API controls > Settings > Unconfigured third-party apps: Don't allow users to access any third-party apps (then mark the apps you approve as Trusted under Manage App Access)Admin console > Security > Authentication > Password management > Strength: Enforce strong password, Length: minimum 12 (8 is acceptable because 2-Step Verification is enforced), Expiration: Never expiresGoogle's strong-password check rates strength rather than forcing character rules, which fits Requirements v3.3: no forced complexity and no regular expiry.
Admin console > Devices > Mobile & endpoints > Settings > Universal > General > Mobile management: Advanced; then Universal > General > Password requirements > Require users to set a password: On, Password strength: Standard or stronger, Minimum characters: 6Standard strength requires a PIN or password and rejects screen lock patterns. Google notes that minimum password length is not supported on personally owned Android 12 and later devices, so check those manually.
A6: how do you configure Google Workspace for security update management?
Apply 3 settings in Google Workspace: keep Chrome updating on managed browsers, check mobile OS versions in the device list and record Workspace and its edition as a cloud service. Together they provide evidence for A6.5, A6.5.1, A6.2.1, A6.1, A2.8 and A2.9.
Google patches the Workspace service. Your evidence is the browser and any desktop client that reaches Workspace data, plus the mobile OS versions in the device inventory. See the security update management requirements for what the control asks.
Keep Chrome updating on managed browsers
A6.5AUTO-FAILA6.5.1A6.2.1Admin console > Devices > Chrome > Settings > User & browser settings > Chrome browser updates: Allow updates; Relaunch notification: Force relaunch after a period, no longer than 7 daysEnrol browsers in Chrome Enterprise Core (free) to see the Chrome versions report for A6.2.1.
Record Workspace and its edition as a cloud service
A2.9Admin console > Billing > Subscriptions (edition name for the A2.9 list)
A7: how do you configure Google Workspace for user access control?
Apply 4 settings in Google Workspace: enforce 2-Step Verification for everyone, create dedicated super admin accounts, list and review admin role holders and offboard leavers the same day. Together they provide evidence for A7.17, A7.14, A7.6, A7.7, A7.8, A7.9, A7.5 and A7.3.
2-Step Verification for everyone, separate super admin accounts used only for administration, a short list of who holds admin roles, and an offboarding routine you can describe in A7.3. See the user access control requirements for what the control asks.
Enforce 2-Step Verification for everyone
A7.17AUTO-FAILA7.14Admin console > Security > Authentication > 2-step verification > Allow users to turn on 2-Step Verification: On > Enforcement: On > New user enrollment period: 1 week > Allowed methods: Any except verification codes via text, phone call (preferred) or AnyApply it at the top-level organisational unit. A child OU or group that overrides enforcement is the usual gap.
Admin console > Directory > Users > Add new user (for example admin.name@) > open the account page > Admin roles and privileges > Super Admin: AssignedRemove super admin from everyday accounts. Use the admin account only in the Admin console, never for mail or browsing.
Offboard leavers the same day
A7.3Admin console > Directory > Users > select user > Suspend user, then on the account page Security > Sign-in cookies > Reset, then transfer Drive and calendar data before deleting
A8: how do you configure Google Workspace for malware protection?
Apply 3 settings in Google Workspace: turn on Gmail attachment and link protection, enable Enhanced Safe Browsing in managed Chrome and restrict apps on managed Android devices. Together they provide evidence for A8.3, A8.4 and A8.5.
Gmail and Drive scanning support the control, but A8.1 is about the devices themselves. Laptops still need anti-malware (option A) and phones need app store restrictions (option B). See the malware protection requirements for what the control asks.
Turn on Gmail attachment and link protection
A8.3Admin console > Apps > Google Workspace > Gmail > Safety > Attachments, Links and external images, Spoofing and authentication: turn on the protections and choose Move email to spam or quarantineEnable Enhanced Safe Browsing in managed Chrome
A8.3Admin console > Devices > Chrome > Settings > User & browser settings > Safe Browsing Protection: Safe Browsing is active in the enhanced mode; Disable bypassing Safe Browsing warnings: On
Which questions does this guide cover?
The 24 questions below are the ones Google Workspace can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.
| Question | What it asks | Steps in this guide |
|---|---|---|
| A2.8 | Please list the quantities of tablets and mobile devices within the scope of this assessment. | A5: Require a screen lock on mobile devices; A6: Check mobile OS versions in the device list |
| A2.9 | Please list all the cloud services that are in use by your organisation and provided by a third party. | A6: Record Workspace and its edition as a cloud service |
| A5.1 | Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? | A4: Turn off POP and IMAP where nobody needs them; A5: Block unconfigured third-party apps |
| A5.10 | Which method do you use to unlock the devices? | A5: Require a screen lock on mobile devices |
| A5.2 | Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business? | A5: Suspend or delete unused accounts |
| A5.9 | When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | A5: Require a screen lock on mobile devices |
| A6.1 | Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? | A6: Check mobile OS versions in the device list |
| A6.2.1 | Please list your internet browser(s). | A6: Keep Chrome updating on managed browsers |
| A6.5AUTO-FAIL | Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release? | A6: Keep Chrome updating on managed browsers |
| A6.5.1 | Are all updates applied on your applications by enabling auto updates? | A6: Keep Chrome updating on managed browsers |
| A7.11 | Which technical controls are used to manage the quality of your passwords within your organisation? | A5: Set the password policy |
| A7.12 | Please explain how you encourage people to use unique and strong passwords. | A5: Set the password policy |
| A7.14 | Do all of your cloud services have multi-factor authentication (MFA) available as part of the service? | A7: Enforce 2-Step Verification for everyone |
| A7.16AUTO-FAIL | Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? | A4: Protect admin console access with security keys |
| A7.17AUTO-FAIL | Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it? | A7: Enforce 2-Step Verification for everyone |
| A7.3 | How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation? | A5: Suspend or delete unused accounts; A7: Offboard leavers the same day |
| A7.5 | Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process? | A7: List and review admin role holders |
| A7.6 | How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? | A7: Create dedicated super admin accounts |
| A7.7 | How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email? | A7: Create dedicated super admin accounts |
| A7.8 | Do you formally track which users have administrator accounts in your organisation? | A7: Create dedicated super admin accounts; A7: List and review admin role holders |
| A7.9 | Do you review who should have administrative access on a regular basis? | A7: List and review admin role holders |
| A8.3 | If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites? | A8: Turn on Gmail attachment and link protection; A8: Enable Enhanced Safe Browsing in managed Chrome |
| A8.4 | If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications? | A8: Restrict apps on managed Android devices |
| A8.5 | If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications? | A8: Restrict apps on managed Android devices |
What evidence should you keep for the assessor?
Keep the 5 dated records listed below for Google Workspace. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.
The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.
- 2-Step Verification settings page and the Reporting > User reports > Security view showing enrolment and enforcement for every user.
- List of super admin and other admin role holders from Account > Admin roles, dated.
- API controls settings showing unconfigured third-party apps blocked, and the trusted apps list.
- POP and IMAP setting, and the password management settings.
- Mobile device list with OS version and screen lock status, and the Chrome versions report.
Related guides and requirements
- Firewalls requirementsThe control hub behind the first section of this guide.
- A7.16 and A7.17: MFA on cloud servicesThe automatic-fail questions most setup gaps lead to.
- Check your readinessFree checker that asks the auto-fail questions first.
- CE Plus test case 4: MFA on cloud servicesHow the assessor checks the MFA prompt from an incognito session.
- Cloud services in scopeWhy cloud services cannot be excluded.
- Glossary: Conditional AccessPolicy-based MFA and access rules.
- Microsoft 365 and Entra IDIdentity and productivity
- Supported software listEnd-of-support dates for operating systems and applications.
- Cyber Essentials Plus: how to prepareWhat the tester checks on the day.
Frequently asked questions
Yes. 2-Step Verification is multi-factor authentication, so enforcing it for every user and admin lets you answer yes to A7.16 and A7.17. Google prompts, passkeys and security keys are preferred over SMS codes, but Requirements v3.3 accept SMS because any MFA is better than none.
No. A7.6 and A7.7 ask how you keep administrative accounts separate from everyday work such as email and browsing. Give each administrator a normal account for daily work and a separate super admin account used only in the Admin console, and keep the list of those accounts for A7.8.
Under test case 4.1 the assessor watches a user and an administrator sign in to Google Workspace from an untrusted device or an incognito browser session. A 2-Step Verification prompt before access is granted is a pass. Where several services sign in through Google, the test is done once for that authentication service.
No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.
The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- knowledge.workspace.google.comGoogle Workspace Admin Help: Deploy 2-Step VerificationRead on knowledge.workspace.google.com (opens in a new tab)
- knowledge.workspace.google.comGoogle Workspace Admin Help: Enforce and monitor password requirementsRead on knowledge.workspace.google.com (opens in a new tab)
- knowledge.workspace.google.comGoogle Workspace Admin Help: Turn POP and IMAP on or off for usersRead on knowledge.workspace.google.com (opens in a new tab)