Acme R&D — Google Workspace
Primary Domain: acme-labs.io · External ID: C039284abc · Last evaluated 2026-11-14T19:48:00Z
Posture Score
MFA Registration Coverage
100%
Global / Super Admins
3
High-Risk OAuth Apps
2
Enforce 2-Step Verification (2SV) for all Super Admins with security keys
Configuration matches CIS and SOC 2 hardened baseline.
Google Workspace Super Admins bypass almost all organizational restrictions. Enforcing 2-Step Verification with FIDO2 Security Keys or passkeys prevents takeover of your entire Google Workspace domain.
Enforce 2-Step Verification across all organizational units (disallow SMS/Voice)
Configuration matches CIS and SOC 2 hardened baseline.
SIM-swapping and SS7 interception make SMS and voice call codes vulnerable. Enforcing Google Prompt, authenticator apps, or security keys across all users eliminates password-only and SMS-based compromise.
Limit Google Workspace Super Admins to between 2 and 4 dedicated accounts
Configuration matches CIS and SOC 2 hardened baseline.
Super Admins have irrevocable control over every user, Google Drive file, and Google Cloud project linked to the domain. Keeping Super Admin count between 2 and 4 reduces attack surface.
Disable Less Secure Apps and restrict IMAP/POP access for end users
Configuration matches CIS and SOC 2 hardened baseline.
Legacy IMAP/POP clients and app-specific passwords bypass modern session controls and context-aware access policies.
Disable automatic user-configured external Gmail forwarding
Configuration matches CIS and SOC 2 hardened baseline.
Preventing end users from configuring silent automatic forwarding to external domains stops data exfiltration and persistent mailbox spying.
Restrict Google Drive default link sharing and disallow public "Anyone with the link" defaults
Default Drive link sharing is restricted to named recipients inside acme-labs.io.
When default link sharing is open or external sharing is unrestricted, sensitive Google Docs and Sheets can be accessed by anyone with the URL.
Block unverified third-party OAuth apps from accessing restricted Google Workspace scopes
2 third-party Chrome extensions hold full Google Drive scope across 14 users.
Users frequently sign into AI note-takers, Chrome extensions, and productivity tools with "Sign in with Google", inadvertently granting full read/write access to Gmail and Google Drive.
Affected Resources / Accounts:
SlideDeck Beautifier AIDocSign QuickExtensionRemediation Path: Google Admin Console → Security → Access and data control → API controls → Manage Google Services
- Set Gmail, Google Drive, and Admin Directory Google Services to "Restricted" so only explicitly trusted OAuth apps can request scopes.
- Under Unconfigured third-party apps, select "Don’t allow users to access any third-party apps" or allow only internal/trusted apps.
Enable Google Admin alert rules for Super Admin grants, 2SV changes, and anomalous Drive exports
Configuration matches CIS and SOC 2 hardened baseline.
Real-time alerts when a new Super Admin is promoted, 2SV is disabled, or a user downloads an unusual volume of Drive files allow security teams to contain incidents in minutes instead of weeks.