Description:
This control ensures that user accounts belonging to departed employees, contractors, or other personnel are promptly removed from Google Workspace when access is no longer required. Timely removal of departed user accounts helps prevent unauthorized access to organizational resources and reduces security risks associated with orphaned accounts.
Rationale:
Departed user accounts may retain access to organizational data, applications, and services if not removed promptly. Removing these accounts reduces the risk of unauthorized access, supports effective user lifecycle management, and helps maintain an accurate inventory of active users.
Impact:
Reduces the risk of unauthorized access by former personnel.
Improves user lifecycle management and account governance.
Supports compliance requirements related to access control and user management.
Ensures only authorized users retain access to organizational resources.
May require coordination with human resources and management teams during offboarding.
Default Value:
Not enforced by default. Administrators must manually suspend, transfer data, and delete user accounts as part of the organization's offboarding process.
Remediation
Test Plan
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Review the list of user accounts.
Identify users who have departed the organization.
Verify that departed user accounts have been removed or deleted according to organizational policy.
Review recently deleted users, if applicable.
Verify that departed users no longer have access to Google Workspace services.
If departed user accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Identify the user account belonging to the departed employee or contractor.
Suspend the user account immediately to prevent further access.
Transfer ownership of the user's files, emails, and other organizational data to an authorized user, if required.
Review any group memberships, delegated access, and shared resources associated with the account.
Remove the user account from groups and shared resource assignments as required.
Delete the user account according to organizational offboarding procedures.
Confirm the deletion of the user account.
Verify that the departed user no longer has access to Google Workspace services.
Backout Plan:
Sign in to the Google Admin console with administrative privileges.
Navigate to Directory → Users.
Select Recently deleted users.
Locate the deleted user account.
Restore the user account if recovery is required and within the Google Workspace recovery period.
Reassign licenses, groups, and permissions as necessary.
Verify that the restored user account functions according to organizational requirements.
References: