Is Google Workspace acceptable for Cyber Essentials?

Yes. Configured correctly, Google Workspace meets every Cyber Essentials cloud requirement. The assessor focuses on 2SV enforcement, Less Secure Apps disabled and admin separation.

Does 2SV count as MFA?

Yes. Google's 2-Step Verification is recognised as MFA under the Cyber Essentials standard.

Can we use SMS as the second factor?

It is permitted but discouraged. Google Prompts, authenticator apps and security keys are stronger and preferred.

Do we need Mobile Device Management?

If staff access work email on personal devices, you need at least Basic Mobile Management enabled. Advanced is recommended.

What about Google Drive sharing?

Sharing settings should restrict external sharing to 'warn' or 'approved domains' rather than 'anyone with the link' by default.

Cyber Essentials Checklist for Google Workspace

The Google Workspace settings the assessor will look for

1. 2-Step Verification (2SV) enforced for everyone

Admin console > Security > Authentication > 2-Step Verification. Set Enforcement to "On for everyone" with no enrolment grace period for new users. Acceptable methods: security keys, Google prompts, authenticator apps, backup codes. SMS is permitted but no longer best practice.

2. Less Secure Apps disabled

Admin console > Security > Less Secure Apps > "Disable access". This blocks legacy authentication that bypasses 2SV.

3. Strong password policy

Admin console > Security > Password management. Minimum length 12 characters, prevent password reuse, enforce on next sign-in.

4. Context-aware access (recommended)

Restrict access by device type, location or IP. Not strictly required, but a strong control that helps with assessor confidence.

5. Advanced Mobile Management

Devices > Mobile & endpoints > Settings. Enforce screen lock, encryption and remote wipe on managed devices.

6. Admin role separation

Super Admin accounts must not be used for day-to-day email or web browsing. Create separate admin accounts and protect them with hardware security keys.

Evidence for the assessor

Screenshot of 2SV enforcement page showing "On for everyone"
Screenshot of Less Secure Apps "Disable access"
Screenshot of password policy
List of Super Admin accounts and their named owners
Mobile device list from Devices console