The 80 Google Workspace security checks Black Cat runs
Black Cat SSPM evaluates 80 security policies against your Google Workspace configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Google Workspace — what access Black Cat needs, and why.
Identity, MFA & sign-in
5 checks · highest severity: high
Access control & privilege
17 checks · highest severity: high
Data sharing & exposure
36 checks · highest severity: critical
Configuration hardening
21 checks · highest severity: high
Identity, MFA & sign-in (5)
- Admin Without 2-Step Verification severity: high
- Admin 2-Step Verification Not Enforced severity: high
- Delegated Admin Without 2-Step Verification severity: high
- User Without 2-Step Verification severity: high
- User 2-Step Verification Not Enforced severity: high
Access control & privilege (17)
- Admin With App Password severity: medium
- User With App Password severity: low
- OAuth App With Restricted Scopes severity: medium
- Dormant Users severity: medium
- Never Logged In Users severity: medium
- OAuth App Critical Scopes severity: high
- OAuth App AI With Data Scopes severity: medium
- Super Admin Count Excessive severity: medium
- Super Admin Redundancy Missing severity: high
- SSO Not Configured severity: high
- Gemini Unmanaged Actors severity: medium
- Super Admin Account Recovery Enabled severity: high
- Gmail App Passwords Active severity: high
- Gmail Delegate Privileged severity: high
- Gmail Stale Delegates severity: high
- Weak Session Control severity: medium
Data sharing & exposure (36)
- Group Allows External Members severity: medium
- Group Allows External Posting severity: high
- Group Allows Open Join severity: low
- Group Public Conversations severity: medium
- Group Domain-Wide Membership Visibility severity: medium
- Group Contact Owner Anyone severity: medium
- Group Discoverable by Anyone severity: medium
- Mail Delegation Enabled severity: medium
- Drive External Sharing Enabled severity: critical
- Drive Link Sharing Anyone severity: critical
- Drive Sharing Outside Organization severity: high
- Drive Publish to Web Allowed severity: high
- Drive File Public Sharing severity: critical
- Drive File Publicly Indexed severity: critical
- Drive File Link Sharing Enabled severity: high
- Drive File External Edit Access severity: high
- Drive File Owner Is External severity: high
- Drive File Stale External Sharing severity: medium
- Drive File Excessive Permissions severity: medium
- Drive File External Commenter Access severity: medium
- Drive File Broad Internal Sharing severity: medium
- Drive File Org-Wide Link Sharing severity: low
- Drive User Excessive External Sharing severity: medium
- Chat External Access Enabled severity: medium
- DLP Rules Not Configured severity: high
- Gmail Filter Forwards Externally severity: high
- Gmail Multiple Forwarding Destinations severity: high
- Gmail Suspicious Forwarding severity: high
Configuration hardening (21)
- Domain Not Verified severity: high
- DKIM Not Configured severity: high
- Group Spam Moderation Disabled severity: low
- Gemini Not Licensed severity: low
- Gemini Enabled Without DLP severity: medium
- Gemini Active Without DLP severity: medium
- Automatic Email Forwarding Enabled severity: medium
- IMAP Access Enabled severity: medium
- POP Access Enabled severity: medium
- Chat Webhooks Enabled severity: medium
- Gmail Confidential Mode Disabled severity: low
- Gmail Send-As External Alias severity: medium
- Gmail Unverified Send-As Alias severity: medium
- Meet Recording Unrestricted severity: low
- Weak Password Policy severity: high
- Spoofing Protection Disabled severity: high
- Gmail Encrypted Attachment Protection Disabled severity: medium
- Gmail Shortener Scanning Disabled severity: medium
Other checks (1)
severity: low S/MIME Not Configured fix difficulty: hard #
Enable S/MIME in Google Workspace Gmail and upload organization certificates
- Navigate to Google Admin Console > Apps > Google Workspace > Gmail > User Settings
- Enable S/MIME for the organization
- Upload or configure the S/MIME certificate authority
- Instruct users to upload their S/MIME certificates
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7