What we review
Workspace holds your email, documents and most internal conversation. We check the admin console configuration, who and what has access, and where data can leave.
Context-Aware Access. Whether sensitive Drive folders and Gmail are restricted to managed devices, approved locations and encrypted connections.
Third-party app access. The apps employees have granted OAuth access to, and which of those scopes allow external read access to mail and files. We identify the high risk ones and help you revoke them.
Data loss prevention. DLP rules that stop credit card numbers, Tax File Numbers and customer records being shared outside your domain.
Admin accounts and 2-step verification. Hardware security keys (FIDO2) for super admins, and privileged roles that are separated and logged.
Findings are mapped to Google’s security guidance and the Australian standards you report against.
Related
- Workspace Studio and Context-Aware Access: resolving zero trust policy conflicts.
- Security reviews: the equivalent review for your Google Cloud organisation.
Questions we get asked
What does a Google Workspace Security Review cover?
We audit your Google Workspace admin console across four areas: Context-Aware Access policies, third-party OAuth app permissions granted by staff, Data Loss Prevention (DLP) rules for Drive and Gmail, and super-admin privilege separation with FIDO2 hardware security keys.
How long does a Workspace Security Review take?
Most Workspace reviews complete within one to two weeks, finishing with a prioritised fix list mapped to Google's security guidance and Australian standards such as the ACSC Essential Eight and APRA CPS 234.
Do you help fix the findings or only hand over a report?
We do both. We walk your team through the findings and can implement the policy changes, OAuth app revocations, Context-Aware Access rules, and DLP detectors directly with your administrators.
Talk to an architect who has done this before.
Bring your current setup and the outcome you need. You will get a view on the approach, the risks and roughly what it costs.
Straight to a senior GCP architect. No SDR, no slide deck.
Not ready to talk? See how we migrated Hapana off AWS →
Or call +61 2 8359 9507 · Hello@aviato.consulting