Description:
This control ensures that Multi-Factor Authentication (MFA) is enforced for all users within the Google Workspace organization. MFA requires users to provide an additional authentication factor beyond their password before gaining access to organizational resources.


Rationale:
Enforcing MFA for all organization members helps protect accounts from credential theft, phishing attacks, password reuse, and unauthorized access. MFA strengthens identity verification and significantly reduces the likelihood of account compromise.


Impact:

  • Reduces the risk of unauthorized access to user accounts.

  • Protects against compromised or stolen credentials.

  • Improves the organization's overall security posture.

  • Supports compliance requirements related to identity and access management.

  • Requires users to complete an additional authentication step during sign-in.


Default Value:
Disabled by default. Administrators must explicitly configure Google Workspace to enforce Multi-Factor Authentication (2-Step Verification) for organization members.


Remediation

Test Plan

  1. Sign in to the Google Admin console with administrative privileges.

  2. Navigate to Security → Authentication → 2-Step Verification.

  3. Verify that Enforce 2-Step Verification is enabled for the applicable organizational units.

  4. Select a user account that is subject to the MFA policy.

  5. Attempt to sign in to the account without completing Multi-Factor Authentication.

  6. Verify that access is denied or that the user is prompted to enroll in MFA before accessing organizational resources.

  7. Verify that MFA enforcement applies to all required organization members.

  8. If MFA is not enforced for all required users, follow the Implementation Plan to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to the Google Admin console with Super Administrator privileges.

  2. Navigate to Security → Authentication → 2-Step Verification.

  3. Select the organizational unit to which the policy will apply.

  4. Enable Allow users to turn on 2-Step Verification if it is not already enabled.

  5. Enable Enforce 2-Step Verification.

  6. Configure the enforcement period according to organizational requirements.

  7. Apply the policy to all applicable organizational units containing organization members.

  8. Click Save to apply the configuration.

  9. Verify that users are required to enroll in and use Multi-Factor Authentication.

  10. Verify that MFA enforcement is applied to all required organization members.


Backout Plan:

  1. Sign in to the Google Admin console with Super Administrator privileges.

  2. Navigate to Security → Authentication → 2-Step Verification.

  3. Select the applicable organizational unit.

  4. Disable Enforce 2-Step Verification or modify the enforcement settings as required.

  5. Click Save.

  6. Verify that authentication behavior reflects the updated configuration.


References: