Most Google Workspace tenancies in Australian small business are running close to the settings they had on day one. The good news is that the highest-value hardening steps cost nothing and are available on every edition. The bad news is that several controls your cyber insurer or your client’s security questionnaire asks about are only sold in the Enterprise and Frontline tiers, and no amount of configuration substitutes for them.
Hardening Google Workspace means changing the Admin console settings that govern identity, application access, data sharing and monitoring so that a stolen password, a malicious add-on or a departing employee cannot quietly take your data with them. Do it in the order below, because each phase makes the next one worth doing.
Why this matters in Australia specifically
Under the Privacy Act, APP 11 requires you to take reasonable steps to protect personal information. If you hold personal information and you suffer unauthorised access, disclosure or loss that is likely to result in serious harm, the Notifiable Data Breaches scheme obliges you to assess it and, if it qualifies, notify the OAIC and the affected individuals. The OAIC’s position is that you must take all reasonable steps to complete that assessment within 30 calendar days of becoming aware of grounds to suspect an eligible breach.
Two practical consequences follow. First, you cannot assess a breach you cannot see, which is why logging and alerting sit high in this plan rather than at the end. Second, the reasonable steps standard is judged against what was available to you, and 2-Step Verification is free on every Workspace edition.
Cyber insurance questionnaires now ask the same handful of questions: is MFA enforced on all users and all administrators, is email filtering in place, are backups separate and tested, and can you detect and investigate an incident. Answering those honestly is easier if you have already done the work. Your obligations under the Notifiable Data Breaches scheme covers the reporting side in detail.
Phase 0: find out which edition you are actually on
Before you plan anything, check Billing, then Subscriptions, and write down the exact edition name. Business Starter, Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Frontline Starter, Frontline Standard, Frontline Plus and the Essentials editions all differ, and several of the controls people assume are standard are not.
Also check whether all your users are on the same edition. Mixed tenancies are common after growth or acquisition, and a policy that relies on an Enterprise feature will silently not apply to the Business Standard users sitting next to them.
Phase 1: identity, because everything else is downstream of it
This phase is free on every edition and delivers most of the risk reduction.
Enforce 2-Step Verification for everyone. Not just admins. Set it under Security, then Authentication, then 2-Step Verification, and set a new user enrolment period so joiners are not locked out on their first day.
Move admins to phishing-resistant methods. Google’s own admin security guidance names security keys as the most secure form of 2SV and the one that resists phishing, because a hardware key will not authenticate to a lookalike domain. Codes delivered by SMS or voice call do not resist phishing or SIM swap. Set the allowed methods to exclude text and call codes at least for administrators and anyone who can move money. Enrol a second key per admin and store it separately. The broader case is in phishing-resistant MFA.
Fix the admin account structure. More than one super admin, each held by a separate person. Separate super admin accounts from the daily accounts those people use for email. Delegate routine tasks to limited prebuilt roles rather than handing out super admin. No shared generic admin logins, because the audit log cannot attribute a change to a person if three people use the same account.
Create a break-glass account and prepare recovery. A super admin account that belongs to the business, not used daily, with printed backup codes and a spare security key stored physically. Google’s guidance to keep signup and billing details on hand exists because those are the questions support asks during account recovery. If you skip this, read recovering a locked admin account now rather than later.
Consider the Advanced Protection Program for super admins. Google positions it as applying many of the admin hardening recommendations at once for high-risk accounts. It requires security keys or passkeys and restricts third-party app access to the account, which is exactly what you want on an account that should be doing nothing except administration.
Note the enforcement clock. Google is progressively enforcing 2SV on administrator accounts, with super admins notified roughly 90 days ahead and other admins roughly 60 days ahead, and escalating access restrictions after the date. Getting ahead of that is free.
Phase 2: close the doors nobody remembers opening
Still free on every edition, and this is where most tenancies have never been touched.
Restrict OAuth and third-party app access. Security, then Access and data control, then API controls. Review the accessed apps list first, then move Gmail and Drive to Restricted so that apps you have not explicitly trusted cannot use the high-risk scopes, allowlist the apps the business genuinely uses, and change the Unconfigured third-party apps setting so that unclassified apps get sign-in information only or nothing. Expect breakage: Google states that restricting a service stops previously installed untrusted apps and revokes their tokens.
Block less secure app access. Anything still authenticating with a username and password rather than OAuth is a standing bypass of your 2SV enforcement. Find it, migrate it, then block it.
Set Drive external sharing deliberately. Apps, then Google Workspace, then Drive and Docs, then Sharing settings. Default new items to restricted rather than link sharing, warn users when they share outside the organisation, and leave the external file indicator on. Allowlisted domains is stronger if your external collaborators are stable.
Turn on the Gmail safety settings. Spoofing and authentication protections against domain and employee-name impersonation, advanced phishing and malware protection for attachments, links and external images, and enhanced pre-delivery message scanning. Then publish SPF, DKIM and DMARC in DNS, and check that your DMARC policy is not still sitting at p=none doing nothing.
Audit Gmail routing rules. Attacker-created routing and forwarding rules survive password resets and do not show up in the user’s own settings. Check the list now and check it again after any suspected compromise.
Restrict Calendar and Chat externally. Free or busy only for external calendar visibility, and external chat limited to the people who need it.
The detail on each of these, including the trade-offs, is in the Admin console settings that carry real risk.
Phase 3: be able to see what happened
Set up admin email alerts. Suspicious sign-in attempts, admin role changes, settings changed by another admin, compromised devices. This is available without an Enterprise licence and it is the difference between finding out in an hour and finding out in a quarter.
Use the alert centre. It aggregates Google-generated security alerts in the Admin console under Security. Assign someone to actually look at it weekly, because an alert nobody reads is not a control.
Know your log retention before you need it. Google retains most log event types for six months, Email log search for 30 days, Chrome reports for 12 months, and Vault log events indefinitely. Administrators cannot extend those periods. If your obligations or your insurer require longer, export on a schedule.
Licence reality: the alert centre and the audit and investigation page are broadly available. The security investigation tool, which is what makes hunting across those logs fast, is listed by Google for Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. On Business tier you can still answer a question you know how to ask. You cannot easily go looking.
Phase 4: control which devices get in
Turn on endpoint management. Basic mobile management is broadly available and gets you an inventory, a screen lock requirement and remote wipe of work data. Advanced mobile management and desktop endpoint verification give you more, including the device signals that Context-Aware Access depends on.
Endpoint verification installs on managed desktops and reports device attributes back to Workspace. On its own it gives you an inventory of the computers accessing company data, which is more than most SMBs have.
Licence reality: Context-Aware Access is not on Business Plus. This is the one that catches people out. Context-Aware Access, which lets you allow or block access to Gmail, Drive and other services based on device state, IP address, geography or operating system, is supported on Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. Business Plus does support App access protection, which is a narrower control, but it is not the same thing. If a client questionnaire asks whether you enforce conditional access on managed devices only, and you are on a Business edition, the honest answer is no.
A warning that matters. Applying Context-Aware Access levels to the Admin console itself can create a total admin lockout if the conditions become unmeetable. Google’s documented remedy is a support case through the Customer Care Portal to strip the policies off the Admin console. Test on a pilot organisational unit first, and never apply an untested access level to the top-level unit.
Phase 5: control the data itself
Licence reality: Drive DLP needs Enterprise or Frontline. Data loss prevention rules for Drive, which scan content for things like credit card numbers, tax file numbers and custom patterns and then block or warn on sharing, are supported on Frontline Standard and Plus, Enterprise Standard and Plus, Education Fundamentals, Standard and Plus, and Enterprise Essentials Plus. If you are on Business Standard or Business Plus, you do not have Drive DLP, and the substitute is tighter sharing defaults plus the external shares report, which is coarser but real.
Data regions are US or Europe only. There is no Australian data region option in Workspace. The choices are United States, Europe or No preference, availability varies by edition, and the policy covers a defined list of core services. If your requirement is genuinely that Australian personal information stays onshore, say so plainly to whoever is asking rather than pointing at this setting.
Vault is retention and eDiscovery, and it needs a licence. Vault is included with Business Plus, Frontline Standard and Plus, Enterprise Standard and Plus, all Education editions, Enterprise Essentials and Enterprise Essentials Plus for domain-verified accounts, and G Suite Business, and is available as an add-on for some other editions. Since 1 November 2025 admins have needed a Vault licence themselves to use it. Vault also does nothing until you configure retention rules. It is not backup, and treating it as backup is the single most common mistake in this space. That argument is set out in backup is a separate problem.
Client-side encryption exists for Gmail, Drive, Meet and Calendar in the higher tiers, and is worth considering only if you genuinely hold regulated or high-value intellectual property, because it changes how search and collaboration behave.
The licence tier summary, stated plainly
Free on every edition, and worth more than anything you can buy: 2-Step Verification enforcement, admin role separation, multiple super admins, OAuth and API controls, Drive sharing defaults, Gmail safety settings, SPF, DKIM and DMARC, admin email alerts, and the audit and investigation page with six month retention.
Needs Business Plus or above: Vault for retention and eDiscovery.
Needs Enterprise Standard or above, or the equivalent Frontline tiers: Context-Aware Access, Drive DLP, the security investigation tool, and the more granular data region controls.
If your risk profile genuinely requires the second and third groups, the licence cost is the cheapest part of getting there. If it does not, spend the money on the first group being done properly and on backup, and do not buy Enterprise to tick a box you will never configure.
How this maps to the Essential Eight
The ACSC and ASD Essential Eight is the framework Australian clients, insurers and government buyers actually reference. Several of its mitigation strategies map cleanly onto Workspace controls, particularly multi-factor authentication and restricting administrative privileges. Others, notably application control, patch applications, patch operating systems and macro settings, are endpoint controls that Workspace does not address at all and that you have to solve on the devices themselves. The full mapping, including where Workspace genuinely cannot help, is in meeting the Essential Eight on Google Workspace, and the framework itself is covered in the Essential Eight explained.
Settle who can raise a support case before you need one
This belongs in the plan rather than at the end of it. Contacting Google Workspace support requires the Support administrator privilege and access to the Admin console, so the people most likely to need support during an incident are exactly the people who may not be able to reach it. Standard Support is included with your licence, has 24/7 access and carries a four hour service level objective for P1 cases, and Google’s published hours of operation table lists Australia as 24/7 in English, so there is no overnight gap to design around.
If someone outside the business is going to open cases for you, Google documents two arrangements. A reseller who manages your subscription can access your Admin console and submit support cases for you unless you remove that access, controlled under Account, then Reseller management. Separately, you can assign a Support Partner in the Google Cloud Support Portal, after which Google states that partner can file cases on your behalf and see cases you filed yourself. Both switches need a working admin sign-in, which is the whole point of doing it now.
Do it in this order
Phase 1 in a week. Phase 2 over a fortnight with a change window for the OAuth restrictions. Phase 3 the same week, because it costs nothing. Phases 4 and 5 only after you have confirmed your edition supports them and someone owns the ongoing tuning.
The mistake to avoid is buying Enterprise licences first and configuring nothing. A Business Standard tenancy with enforced security keys, restricted OAuth scopes and tight sharing defaults is meaningfully safer than an Enterprise Plus tenancy running defaults.
We are listed in Google Cloud’s partner directory, and Workspace hardening is ordinary work for us rather than a side project. We do this as a fixed-scope uplift: an audit against the list above, a written plan with the licence implications spelled out, and the changes made in staged windows so nothing breaks unannounced. Call 1300 028 324 or start at techassist.au/contact.
