Description:
This control ensures that guest access within Google Workspace is restricted according to organizational security requirements. Properly restricting guest access helps prevent unauthorized access to organizational resources, data, and collaboration environments.
Rationale:
Guest users may require limited access to specific resources for collaboration purposes. Restricting guest access reduces the risk of data exposure, unauthorized access, and excessive permissions while maintaining secure collaboration with external parties.
Impact:
Reduces the risk of unauthorized access to organizational resources.
Limits external user access to approved services and data.
Improves control over external collaboration activities.
Supports compliance requirements related to access control and data protection.
May restrict collaboration options available to external users.
Default Value:
Guest access is not fully restricted by default. Administrators must explicitly configure external sharing and guest access settings according to organizational requirements.
Remediation
Test Plan
Sign in to the Google Admin console with administrative privileges.
Navigate to Apps → Google Workspace.
Review external sharing and guest access settings for applicable services.
Verify that guest access is restricted according to organizational policy.
Create or identify a guest user account.
Attempt to access organizational resources using the guest account.
Verify that access is limited to approved resources and services.
If guest access is not properly restricted, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Google Admin console with Super Administrator privileges.
Navigate to Apps → Google Workspace.
Review services that support external collaboration, such as Google Drive, Google Chat, and Google Calendar.
Configure external sharing settings according to organizational policy.
Restrict guest user access to only the required services and resources.
Disable unnecessary external sharing and guest access features.
Apply the configuration to all applicable organizational units.
Click Save to apply the configuration changes.
Verify that guest users have access only to approved resources and services.
Verify that guest access restrictions are enforced across the organization.
Backout Plan:
Sign in to the Google Admin console with Super Administrator privileges.
Navigate to Apps → Google Workspace.
Locate the applicable external sharing or guest access settings.
Modify the guest access restrictions as required.
Click Save to apply the configuration changes.
Verify that guest access functions according to the updated configuration.
References: