Description:
This control ensures that inactive and suspended user accounts are disabled within Google Workspace. Disabling unused accounts reduces the risk of unauthorized access through dormant credentials and helps maintain an accurate inventory of active users.
Rationale:
Inactive and suspended accounts present a security risk because they may be overlooked during routine account reviews while still retaining access to organizational resources. Disabling these accounts reduces the attack surface and supports effective identity and access management practices.
Impact:
Reduces the risk of unauthorized access through dormant accounts.
Improves user account lifecycle management.
Supports compliance requirements related to access control and user management.
Ensures only authorized and active users retain access to organizational resources.
May require periodic review of user account status.
Default Value:
Disabled by default. Administrators must manually suspend or disable inactive accounts and ensure suspended accounts remain inaccessible.
Remediation
Test Plan
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Review the list of user accounts.
Identify inactive or suspended user accounts.
Verify that inactive accounts are suspended or disabled.
Select a suspended account and review its status.
Verify that the suspended account cannot access Google Workspace services.
If inactive or suspended accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Review user account activity and identify inactive accounts according to organizational policy.
Select the inactive user account.
Click More → Suspend User.
Confirm the suspension action.
Repeat the process for all inactive accounts that no longer require access.
Review existing suspended accounts to ensure they remain suspended.
Verify that suspended accounts cannot access Google Workspace services.
Document the account status according to organizational procedures.
Backout Plan:
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Select the suspended user account.
Click Reactivate User.
Confirm the reactivation action.
Verify that the user can access Google Workspace services according to the assigned permissions.
References: