Google Workspace audit scope
Every area we check in Google Workspace
A Google Workspace audit from SecureMyEmail assesses 119+ individual settings and controls across 12 categories — from who holds super admin to whether a single Drive link is exposing your client files. Every finding is severity-rated and mapped to the CIS Google Workspace Benchmark, the CISA SCuBA baselines, Cyber Essentials and the ACSC Essential Eight.
Looking for Microsoft 365? See that scope →9 checks
Admin & Privileged Access
Super admins, delegated roles and break-glass accounts.
See the checks →14 checks
User Security & 2-Step Verification
2SV coverage, password policy, recovery options and dormant accounts.
See the checks →12 checks
Gmail & Email Security
Phishing and malware defences, forwarding, routing and attachment rules.
See the checks →10 checks
DNS & Email Authentication
SPF, DKIM, DMARC, MTA-STS and domain spoofing exposure.
See the checks →10 checks
Drive, Docs & External Sharing
Link sharing defaults, external access and public files.
See the checks →8 checks
Shared Drives
Membership, external members, download controls and orphaned drives.
See the checks →8 checks
Groups & Mailing Lists
Public groups, external posting, membership sprawl and archive exposure.
See the checks →11 checks
Third-Party Apps & Shadow IT
OAuth grants, Marketplace apps, AI tools and API access.
See the checks →10 checks
Calendar, Meet, Chat & Sites
External sharing of calendars, meeting security and chat file controls.
See the checks →9 checks
Devices & Endpoint Access
Mobile management, BYOD, Chrome browser and context-aware access.
See the checks →9 checks
Logging, Alerting & Data Retention
Audit logs, Alert Center rules, Vault retention and investigation readiness.
See the checks →9 checks
Benchmarks & Compliance Mapping
CIS, SCuBA, Cyber Essentials and the Australian Essential Eight.
See the checks →Read-only, and over before lunch
The scan connects with read-only access, never reads the contents of your email or files, and returns a plain-English, risk-prioritised report.
Get my Google Workspace audit