We onboard a lot of small businesses that run on Google Workspace instead of Microsoft 365, and the pattern is identical: email works, Drive syncs across every laptop, Meet links go out without a hitch, and nobody has looked at the Admin console since the day the domain was set up. That's not negligence. It's how the product is designed to work: frictionless first, hardened second, and the "second" part is entirely on the customer.
The good news is that closing the gap is mostly an afternoon of clicks, not a budget line. Here are the three areas to work through first, in order of impact.
1. Enforce 2-Step Verification for every user
If you do only one thing on this list, do this. Google Workspace lets you allow 2-Step Verification (2SV) or enforce it, and those are very different postures. "Allowed" means employees can turn it on if they feel like it; "enforced" means the Admin console requires it before an account can sign in. Most Google account takeovers start with a password that was phished, reused across sites, or guessed, and enforced 2SV is the one setting that most reliably stops that password from turning into full access to a mailbox and every shared drive behind it.
Roll it out with a short enrollment grace period so nobody gets locked out mid-workday, prefer a security key or the Google prompt over SMS codes, and enroll every admin account in the Advanced Protection Program, Google's strongest 2SV tier built specifically for high-value accounts. Admin accounts are the master key to the tenant, so they deserve the strongest lock on the door.
2. Lock down the Admin console itself
Two habits matter more than any single toggle. First, keep super admin accounts separate from daily-use accounts. Reading email and browsing the web from an account that can also reset every password in the company is a needless risk; create a dedicated admin identity used only for administration. Second, review third-party app access under Security › API controls. By default, users can grant OAuth permissions to third-party apps with a single click, and attackers exploit that with fake apps that request sweeping access to Drive and Gmail, the same consent-phishing trick we've covered for Microsoft 365. Require admin approval before an unverified app can touch company data.
While you're in there, turn on the Alert Center and route its notifications somewhere a human actually reads: suspicious sign-ins, leaked passwords, and suspended-user activity all surface here, but only if someone is watching. It's the setting that pays off exactly once, on the day you need it.
3. Fix Drive sharing defaults and add real backup
Google Workspace ships with generous default sharing: a file can often be set to "anyone with the link" with no sign-in required, and that link travels well beyond its intended audience. Under Drive and Docs settings, restrict external sharing to your domain by default, require sign-in on shared links, and set link expiration where your plan allows it. You're not blocking collaboration, you're making sure a quick share doesn't quietly become a public URL indexed by search engines.
The second, costlier misunderstanding is backup. Google Vault handles retention and legal hold, and Drive keeps a trash window and limited version history, but none of that is an independent, point-in-time backup. If an account is compromised and purged, a departing employee deletes a shared drive, or a sync client propagates ransomware-encrypted files, Vault and trash may not cover it. A dedicated third-party Google Workspace backup product, stored outside the tenant, is the control that closes that gap; our backup and disaster recovery guide covers why "it's already in the cloud" isn't a backup strategy on any platform.
Where to start this week
Enforce 2SV and enroll admins in Advanced Protection today; both are free and safe to turn on immediately. This week, work through admin-account separation, third-party app restrictions, Drive sharing defaults, and a real backup product. The one setting that deserves a second set of eyes before you flip it is anything that can lock legitimate users out, an overly aggressive sharing restriction rolled out without warning creates its own support fire. If you're not confident configuring it solo, that verification pass is exactly what our managed IT and cloud services teams handle. If your shop runs Microsoft instead, the equivalent checklist is our Microsoft 365 settings guide.
You already pay for a genuinely secure platform. The gap between "works" and "protected" is an afternoon in the Admin console, and it's a lot cheaper spent now than after an incident.
Frequently asked questions
Is Google Workspace secure by default?
Partly. Google's infrastructure is strong, and some baseline protections apply automatically. But the settings that matter most for a small business, enforced 2SV, tightened Drive sharing, DKIM signing, restricted app access, and alerting, are opt-in and left permissive until an admin configures them.
What is the single most important Google Workspace setting to enable?
Enforced 2-Step Verification for every user, not just the option to turn it on. Most account takeovers start with a stolen or reused password, and 2SV most reliably stops that password from becoming full account access. Enroll admins in the Advanced Protection Program.
Does Google Workspace back up my email and files automatically?
Not the way most owners assume. Vault handles retention and legal hold, and Drive keeps a trash window and limited version history, but neither is a true, independent backup. Businesses with real continuity needs add a dedicated third-party Google Workspace backup with separate, point-in-time restore.
Can I turn these settings on myself, or do I need help?
A confident admin can enable most of this from the Admin console: 2SV enforcement, DKIM, Drive sharing defaults, and the Alert Center. The setting needing the most care is anything that can lock users out. Many small businesses enable the safe basics themselves and bring in a managed IT provider to verify nothing was missed.
Want us to check which of these are actually on in your Workspace?
30 minutes with an engineer with DoD infrastructure experience. We'll review your Google Workspace setup, show you plainly which protections are off, and hand you a prioritized list: starting with the free, high-impact ones. No jargon, no obligation.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.