Description:
This control ensures that privileged administrative access within Google Workspace is restricted to authorized administrators only. Limiting privileged access helps protect critical organizational settings, user accounts, and sensitive data from unauthorized modifications.
Rationale:
Privileged accounts possess elevated permissions that can significantly impact the security and operation of the Google Workspace environment. Restricting privileged access to authorized administrators enforces the principle of least privilege, reduces the attack surface, and improves accountability for administrative actions.
Impact:
Reduces the risk of unauthorized administrative changes.
Limits exposure of highly privileged accounts.
Improves accountability and administrative oversight.
Supports compliance requirements related to privileged access management.
May require the use of delegated administrative roles for routine administrative tasks.
Default Value:
Administrative roles are assigned manually. Organizations must explicitly restrict privileged access to authorized administrators according to business requirements.
Remediation
Test Plan
Sign in to the Google Admin console with administrative privileges.
Navigate to Account → Admin roles.
Review the administrative roles assigned within the organization.
Verify that privileged roles are assigned only to authorized administrators.
Review the users assigned to highly privileged roles such as Super Admin.
Verify that no unauthorized users have privileged administrative access.
Verify that administrative privileges align with job responsibilities and organizational policy.
If privileged access is assigned to unauthorized users, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Google Admin console with Super Administrator privileges.
Navigate to Account → Admin roles.
Review all administrative roles and their assigned users.
Identify users who do not require privileged administrative access.
Remove privileged roles from unauthorized users.
Assign administrative roles only to authorized personnel based on business requirements.
Apply the principle of least privilege by assigning the lowest level of access necessary to perform job functions.
Review custom administrative roles and permissions to ensure they are appropriately restricted.
Save the configuration changes if prompted.
Verify that privileged access is restricted to authorized administrators only.
Backout Plan:
Sign in to the Google Admin console with Super Administrator privileges.
Navigate to Account → Admin roles.
Select the applicable administrative role.
Reassign the role to additional authorized users as required.
Save the configuration changes.
Verify that administrative access functions according to the updated configuration.
References: