Skip to content

The 25 Google Ads security checks Black Cat runs

Black Cat SSPM evaluates 25 security policies against your Google Ads configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect Google Ads — what access Black Cat needs, and why.

Access control & privilege (14)

Governance & compliance (7)

Other checks (4)

severity: medium Active External Data Link fix difficulty: medium #

Review and remove unauthorized external data links from the Google Ads account

  1. Navigate to Tools & Settings > Setup > Linked accounts
  2. Review the list of linked accounts and external data connections
  3. Identify any links that are no longer needed or were not authorized
  4. Click Remove on unauthorized or stale linked accounts
  5. Document approved external data links in your third-party access policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Recent Sensitive Change fix difficulty: medium #

Review recent sensitive changes in Google Ads to ensure they were authorized

  1. Navigate to Tools & Settings > Billing & Payments > Change History or use the Change History report in campaigns
  2. Filter the change history by the change type flagged in the finding (e.g., budget changes, billing, user access)
  3. Identify who made the change and when it occurred
  4. Confirm with the account owner or manager that the change was authorized
  5. If the change was unauthorized, revert it and investigate the source of the change
  6. Consider enabling additional access controls or approval workflows to prevent future unauthorized changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.23 SOC 2 Type II CC1.1 CIS Controls v8 CIS-05.1 NIST CSF 2.0 GV.RR GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b NIS2 Directive NIS2-21.e.1 DORA (SaaS Security) DORA-9.10

severity: high Recent Admin Role Change fix difficulty: medium #

Review the recent access role change to confirm it was authorized and did not result in unauthorized privilege escalation

  1. Navigate to Tools & Settings > Change History or the Campaigns > Change History report
  2. Filter by change type User Access and look for ACCESS_ROLE field changes within the last 72 hours
  3. Identify who made the change and which user's role was modified
  4. Confirm with the account owner that the role change was intentional and authorized
  5. If the change was not authorized, revert the role to its previous value immediately
  6. Investigate the actor's account for signs of compromise and consider resetting their credentials
  7. Update your access change log and notify your security team if unauthorized escalation is confirmed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC8.1 NIS2 Directive NIS2-21.e.1 DORA (SaaS Security) DORA-9.10

severity: high Suspended Account in MCC Hierarchy fix difficulty: medium #

Investigate and resolve the account suspension to restore ad delivery and prevent data loss

  1. Navigate to the affected account in Google Ads and review the suspension notice
  2. Identify the suspension reason (policy violation, billing failure, suspicious activity)
  3. If billing-related, update the payment method under Tools & Settings > Billing > Settings
  4. If policy-related, review the Google Ads policies that were violated and remediate the offending ads or landing pages
  5. Submit an appeal via the Google Ads Help Center if the suspension appears to be in error
  6. Monitor the account status after submitting the appeal and document the outcome

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC7.1 NIS2 Directive NIS2-21.c DORA (SaaS Security) DORA-12.1

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial