Cyber Essentials with Google Workspace: what to switch on, click by click

Where Google Workspace sits in the assessment

Google Workspace is a cloud service, so it is in scope and cannot be excluded — it holds your email and files. The questionnaire will ask whether it offers MFA (it does), whether MFA is switched on for every administrator (A7.16) and every user (A7.17), and about the accounts themselves: does everyone have their own login, are admin accounts separate from everyday ones, are leavers removed promptly. Google Workspace covers those for Gmail, Drive, Calendar, Meet and Docs in one place, because they share a login. It does not cover your laptops, phones and router — those have their own questions and their own settings.

1. Turn on two-factor login for each person

Google calls MFA “2-Step Verification”. Each person can switch it on for themselves:

1. On a computer, go to myaccount.google.com and sign in with the work Google account.
2. On the left, click “Security”.
3. Under “How you sign in to Google”, click “2-Step Verification”, then “Get started”.
4. Confirm the password if asked.
5. Follow Google’s prompts to add a second step. Google may ask for a phone number first; then choose Google prompts on your phone, or an authenticator app (install Google Authenticator, scan the on-screen code and enter the 6-digit code it shows).
6. If Google shows a “Turn on” button, click it to finish.

Done when: Google asks for a code from the phone (or a prompt) next time that person signs in. Passkeys count as MFA too. Text-message codes are allowed but discouraged; an authenticator app or a prompt is better.

2. Make it compulsory for everyone (admins)

Asking people nicely is not a control. An administrator can require 2-Step Verification for the whole organisation: sign in at admin.google.com, go to Security → Authentication → 2-Step Verification, and turn on enforcement. Give people a short grace period to enrol, then enforce. Until every user and every admin has it on, the honest answer to A7.16 and A7.17 is no — and that is an automatic fail. Check the enrolment report in the admin console before you answer.

3. Separate admin accounts from everyday ones

The person who administers Google Workspace should not do it from the account they use for email all day (A7.6, A7.7). Create a separate admin account — with MFA — used only for admin tasks, and remove the Super Admin role from everyday accounts. Keep a note of who holds admin rights (A7.8) and look at it every few months (A7.9).

4. Joiners and leavers

Decide who creates accounts and who approves it (A7.1), and make sure a leaver’s account is suspended the day they go (A7.3) — Admin console → Users → the person → Suspend, then transfer their files and delete when ready. Shared mailboxes like info@ are better as Google Groups or delegated inboxes than as a login several people share (A7.2).

5. Don’t forget the accounts Google doesn’t cover

A Google shop still has other cloud services: accounting software, a CRM, project tools, the business LinkedIn and Facebook accounts. Each needs MFA on for every user. And the laptops, phones and router are assessed on their own — supported operating systems, automatic updates within 14 days, screen locks, the router’s admin password changed. The MFA guide lists the accounts people forget; the checklist covers the rest.

What this does not do

Google Workspace settings do not make your laptops supported, do not install operating system updates, and do not configure your router. They answer the user-access questions for the Google services — which is a large part of the section where the MFA automatic fails sit, but not the whole assessment.