Ensure Access Checker is configured to limit file access

MediumLevel 1Manual reviewgoogle-workspace

Description

When a user shares a file via a Google product other than Docs or Drive (e.g. by pasting a link in Gmail), Google can check that the recipients have access. If not, when possible, Google will ask the user to pick how they want to share the file. In general, access should be restricted to the smallest group possible. In this case recipients only.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

To verify this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Select Apps 3. Select Drive and Docs 4. Select Sharing Settings 5. Select Sharing Options 6. Under Access Checker 7. Ensure Recipients only. is checked

How it is fixed

Fix method: Guidance or infrastructure patch

To configure this setting via the Google Admin Console: 1. Log in to https://admin.google.com as an administrator 2. Select Apps 3. Select Drive and Docs 4. Select Sharing Settings 5. Select Sharing Options 6. Under Access Checker 7. Set Recipients only. to checked 8. Select Save

Properties

Operating systems: Any
Tags: access-controlgoogle-workspacesaas
Reference: CIS Google Workspace Foundations Benchmark v1.4.0 - 3.1.2.1.1.5 Ensure Access Checker is configured to limit file access