Locking Down Google Workspace: The Admin Security Checklist
Last verified: October 2026
The single highest-impact move in Google Workspace is enforcing 2-Step Verification — not just allowing it. Here's the full admin checklist: enforce 2SV, protect the super-admin, and close the back doors. Rather have a hand? My number is (330) 200-8042.
The Google Workspace Admin Checklist, at a Glance
If your business runs on Google Workspace, your sign-ins are the front door to Gmail, Drive, and everything else — and most account takeovers are just a stolen or guessed password. The highest-impact fix is 2-Step Verification (2SV), but there's a catch: you have to enforce it, not merely allow it, or most people never turn it on. This guide is a plain-English admin checklist, biggest wins first: enforce 2SV with a short enrollment window, prefer security keys and passkeys for admins, protect the super administrator, keep a break-glass admin so nobody gets locked out, check recovery info and alerts, and shut down old app-password back doors that bypass your second step. Setting names move, so confirm them in your current Admin console. There's a printable 29-page version up top.
Common Questions
1 What's the single most important step?
Enforcing 2-Step Verification — Google's name for MFA. It's the highest-impact control and stops most account takeovers, and Google is mandating it for admin accounts anyway. Turn it on, set it to enforce with a short enrollment period, and warn your team first.
2 Why isn't turning 2SV on enough — why 'enforce'?
Because 'on but optional' means most people never set it up, so their accounts stay protected by a password alone. Enforcing requires everyone to have it (with a grace period to enroll), which is the only version that actually protects you.
3 How do I turn it on?
As of writing: sign in to the Admin console as super-admin, go to Security > Authentication > 2-Step Verification, turn it on, and set it to Enforce with a short enrollment window. Google moves these menus, so confirm the path in your current Admin console.
4 Are text-message codes good enough?
Better than nothing, but for admins and high-value users prefer security keys or passkeys (FIDO2). Those are phishing-resistant — bound to the real site, so a fake login page can't capture anything reusable. Phone prompts are fine for everyday staff.
5 Why protect the super-admin especially?
Because it can change everything — add and remove people, reach any data, rewrite security. It's the keys to the kingdom. Give it a phishing-resistant second step, a strong unique password, and don't use it as a daily mailbox. Keep the super-admin count small.
6 What are app passwords and why turn them off?
Older ways for apps and devices to connect with just a password — sometimes called app passwords or less-secure app access. They can bypass 2SV entirely, so a leaked one is a back door around your enforced second step. Shut them off unless you have a specific reason to keep one.
Would You Rather I Just Help?
Locking down Google Workspace is exactly the kind of quick, high-value job I love — an afternoon and your email and files are far safer, with nothing to sell you (I don't sell Google licenses). I'll enforce 2-Step Verification, protect your super-admin, set up a break-glass account, and close the old back doors so nobody gets locked out. $99 flat for a visit, 30-day come-back-free. I'm a tech helper — just honest advice.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).