What does the Google Workspace setup guide cover?

It walks through ten security requirements — including phishing-resistant multi-factor authentication, least-privilege access control, asset & account inventory, and more — mapped to the DoW Brilliant at the Basics IT Top 10 and to NIST SP 800-171 / CMMC Level 2. Each requirement has a plain-language explanation, a process-flow diagram, and a click-by-click checklist.

Where do I perform these Workspace steps?

In the Google Admin console (admin.google.com). Every step names the exact portal or console path to follow.

Is my checklist progress saved anywhere?

Your step checklist progress is saved only in your own browser (local storage). Nothing is sent to the site, and you can reset it at any time.

Can Google Workspace hold CUI?

Handling CUI requires Google Workspace Assured Controls and careful scoping; the standard commercial tenant is only DoD Impact Level 2. Confirm an authorization path before you store CUI.

How do I strengthen Workspace for defense data?

Enforce phishing-resistant 2-Step Verification, apply client-side encryption with customer-held keys, and scope CUI users into a dedicated organizational unit inside an Assured Workloads boundary.

Google Workspace Setup Guide

REQUIREMENT 01 OF 10

Phishing-Resistant Multi-Factor Authentication

IT-013.5.3IA.L2-3.5.3

IN PLAIN WORDS

Multi-factor means you need two things to log in: your password plus proof it's really you, like a physical security key you plug in or tap. Phishing-resistant means even a fake website can't trick the key, because the key only works on the real Google site. It's like a house key that refuses to turn in any lock except your own front door.

WHY IT MATTERS

Passwords get stolen or guessed all the time, and without a phishing-resistant second factor an attacker who has your password can walk right into your accounts and your CUI.

TOOLS YOU WILL USE

2-Step VerificationSecurity keysPasskeysOrganizational units

HOW THE SETUP FLOWS

1Turn on 2SV
2Create Admins OU
3Require security key
4Distribute keys
5Enforce
6Verify enrollment

STEP-BY-STEP CHECKLIST

1. Open 2-Step Verification settingsIn the Google Admin console, go to Security > Authentication > 2-Step Verification.
2. Turn on enforcementCheck 'Allow users to turn on 2-Step Verification' and set Enforcement to On for the whole organization.
3. Create an Admins org unitIn the Google Admin console, go to Directory > Organizational units and add an OU named 'Admins' for privileged accounts.
4. Require security keys for adminsBack in Security > Authentication > 2-Step Verification, select the Admins OU and set the method to 'Only security key' (includes hardware keys and passkeys).
5. Hand out keys firstGive every affected user a hardware security key or set up a passkey before the enforcement date so no one gets locked out.
6. Set an enrollment grace periodUnder the same 2-Step Verification page, set a 'New user enrollment period' so new hires have a short window to register a key.
7. Confirm coverageIn the Google Admin console, go to Reporting > Reports > Security to view the 2-Step Verification enrollment report and confirm everyone is covered.

Pro tip

Government cloud & CUI

For CUI, pair phishing-resistant MFA with Google Workspace Assured Controls/Assured Workloads; the standard commercial tenant is only DoD IL2 and is not sufficient for CUI on its own.

EVIDENCE TO KEEP

2-Step Verification enrollment reportScreenshot of 'Only security key' policy on Admins OUList of issued security keys/passkeys

See the full IT-01 practice guide →

Google Workspace setup guide

Frequently asked questions