+
+### Policies
+
+#### GWS.COMMONCONTROLS.1.1v0.1
+Phishing-Resistant MFA SHALL be required for all users.
+
+
+ > Phishing-resistant methods:
+
+ - FIDO2 Security Key (directly in Google Workspace)
+
+ - Phone as Security Key
+
+ - FIDO2 Security Key (Federated from Identity Provider)
+
+ - Federal Personal Identity Verification (PIV) card (Federated from agency Active Directory or other identity provider).
+
+ - Google Passkeys
+
+- Rationale
+ - Required by Office of Management and Budget Memo M-22-09.
+ - Add an extra layer of security to user accounts by asking users to verify their identity when they enter a username and password. MFA (including methods using 2-Step Verification) requires an individual to present a minimum of two separate forms of authentication before access is granted. MFA provides additional assurance that the individual attempting to gain access is who they claim to be. With MFA, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
+- Last Modified: August 17, 2023
+- Notes
+ - Policy 1.1 applies if Phishing-Resistant MFA is available. Otherwise, Policy 1.4 applies.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.2v0.1
+Google 2SV new user enrollment period SHALL be set to 1 week.
+
+- Rationale
+ - This allows enough time for new personnel to log into their account and configure MFA prior to getting locked out of their account. However, does not give an excessive amount of time in order to limit security risks.
+- Last Modified: August 17, 2023
+- Notes
+ - This setting and policy only applies when the means of Phishing-Resistant MFA in use relies
+ on Google 2SV.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.3v0.1
+Allow users to trust the device SHALL be disabled.
+
+- Rationale
+ - This ensures that Google 2SV must be used each time to prevent unauthorized access to accounts.
+- Last Modified: August 17, 2023
+- Notes
+ - This setting and policy only applies when the means of Phishing-Resistant MFA in use relies
+ on Google 2SV.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.4v0.1
+If phishing-resistant MFA is not yet tenable, an MFA method from the following list SHALL be used in the interim.
+
+> Google prompt
+
+> Google Authenticator
+
+> Backup Codes
+
+> Software Tokens One-Time Password (OTP): This option is commonly implemented using mobile phone authenticator apps
+
+> Hardware Tokens OTP
+
+- Rationale
+ - Some agencies do not have capability for phishing-resistant MFA at this time, therefore an
+ alternative is provided.
+- Last Modified: August 17, 2023
+- Notes
+ - ONLY to be enforced if Policy 1.1 is not possible for the agency.
+ - SMS or Voice as the MFA method SHALL NOT be used.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+### Resources
+
+- [GWS Admin Help \| Set up 2-Step Verification (Deploy)](https://support.google.com/a/answer/9176657?hl=en&ref_topic=2759193&fl=1#zippy=%2Cchoose-a--step-verification-method-to-enforce%2Cturn-on-enforcement)
+- [GWS Admin Help \| Set up 2-Step Verification (Protect your business)](https://support.google.com/a/answer/175197#zippy=%2Csecurity-keys%2Cconsider-using-security-keys-in-your-business)
+- [GWS Admin Help \| Set up SSO via a third-party Identity provider](https://support.google.com/a/topic/7579248?hl=en&ref_topic=7556686)
+- [Google Cloud Architecture Center \| Federating Google Cloud with Active Directory](https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction)
+- [Google Cloud Architecture Center \| Federating Google Cloud with Azure Active Directory](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-active-directory)
+- [Google Workspace Updates /| Simplify and Strengthen Sign-In by Enabling Passkeys for Your Users](https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html)
+- [Google Security Blog /| So Long Passwords, Thanks for all the Phish](https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html)
+- [Allow Users to Skip Passwords at Sign-In (Beta)](https://support.google.com/a/answer/13529161)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- FIDO2-compliant security keys
+
+### Implementation
+
+Note: If using a third-party IdP with GWS, refer to Google documentation on [setting up third-party single sign-on](https://support.google.com/a/topic/7579248?hl=en&ref_topic=7556686) (SSO). If using GWS as the IdP, refer to [Google documentation on setting up SSO](https://support.google.com/a/answer/12032922?hl=en).
+
+To enforce Phishing-Resistant 2-Step Verification (MFA) for all users, use the Google Workspace Admin Console:
+
+#### Policy 1 common Instructions
+1. Sign in to [Google Admin console](https://admin.google.com/) as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Select **2-Step Verification.**
+
+#### GWS.COMMONCONTROLS.1.1v0.1 Instructions
+1. Under **Authentication**, ensure that **Allow users to turn on 2-Step Verification** is checked.
+2. Set **Enforcement** to **On.**
+3. Under **Methods** select **Only security key.**
+4. Under **Security codes** select **Don't allow users to select security codes.**
+5. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.2v0.1 Instructions
+1. Set **New user enrollment** period to **1 Week**.
+2. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.3v0.1 Instructions
+1. Under Frequency, deselect the **Allow user to trust device** checkbox.
+2. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.4v0.1 Instructions
+
+If using security keys:
+1. Under **Methods**, select **Only security Key**. Next, select **Don't allow users to select security codes**.
+2. Select **Save**
+
+If security keys are not yet available for your organization:
+1. Under **Methods**, select **Any except verification codes via text, phone call**.
+2. Select **Save**
+
+If using Passkeys, use the Google Workspace Admin Console:
+1. Sign in to [Google Admin console](https://admin.google.com/) as an administrator.
+2. Select **Security** -\> **Authentication** -\> **Passwordless.**
+3. Select **Skip passwords.**
+4. Select the **Allow users to skip passwords at sign-in by using passkeys** box.
+5. Select **Save.**
+
+## 2. Context-aware Access
+
+Device-based context-aware access provides access control policies based on device disposition attributes such as compliance with organizational secure configuration policies for devices (e.g., managed by Unified Endpoint Management). GWS also provides other context-aware access policies based on authentication and network information. These can be used to implement more targeted access policies. For advanced use cases, custom context aware access rules can be authored using the Common Expressions Language (CEL).
+
+Device-based context-aware access can be used in several ways depending on agency business requirements. The following options are all acceptable approaches:
+
+- Properties of the device as reported by Google (encryption, screen lock, OS version, etc.)
+- Device inventory status (corporate-issued versus BYOD)
+- Use of Managed Chrome Browser
+- Data based on integration with certain third-party device management tools
+
+It is extremely important to know how context-aware access policies affect one another, for example:
+
+- At a given scope (e.g., Organizational Unit [OU] or Group), each context aware access rule is evaluated separately. If any rule grants access, then access is allowed to the given application.
+- If rules are applied to OUs and Groups, which allow an action that may be denied after evaluating a policy at a higher level, then access will be allowed.
+
+To enforce a device policy that requires company-owned devices, Google needs a list of serial numbers for company-owned devices.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.2.1v0.1
+Policies restricting access to GWS based on signals about enterprise devices SHOULD be implemented.
+
+- Rationale
+ - Granular device access control afforded by context-aware access is in alignment with Federal zero trust strategy and principles. Context-aware access can help to increase the security of your GWS data by allowing you to restrict access to certain applications or services based on the user's context.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:005: Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)
+
+#### GWS.COMMONCONTROLS.2.2v0.1
+Use of context-aware access for more granular controls, including using Advanced Mode (CEL), MAY be maximized and tailored if necessary.
+
+- Rationale
+ - Granular device access control afforded by context-aware access is in alignment with Federal zero trust strategy and principles. Context-aware access can help to increase the security of your GWS data by allowing you to restrict access to certain applications or services based on the user and/or device context. Advanced Mode's Common Expressions Language (CEL) gives administrators the ability to tailor access policies for devices, time-based use cases, authentication, and to combine multiple conditions into tailored controls.
+- Last Modified: July 11, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:005: Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)
+
+### Resources
+
+- [GWS Admin Help \| Context-Aware Access overview](https://support.google.com/a/answer/9275380)
+- [GWS Admin Help \| Context-Aware Access examples for Basic mode](https://support.google.com/a/answer/9587667)
+- [GWS Admin Help \| Context-Aware Access examples for Advanced mode](https://support.google.com/a/answer/11368990)
+- [GWS Admin Help \| Device management security checklist](https://support.google.com/a/answer/7422256)
+- [GWS Admin Help \| Set up guide: Deploy company-owned devices in Google endpoint management](https://support.google.com/a/answer/10287358)
+- [GWS Admin Help \| Turn endpoint verification on or off](https://support.google.com/a/answer/9007320)
+- [GWS Admin Help \| Set up guide: Deploy company-owned devices in Google endpoint management—Steps 1 and 2](https://support.google.com/a/answer/10287358#zippy=%2Cstep-sign-up-for-enterprise-management-services%2Cstep-source-devices)
+- [GitHub \| Google \| Google Common Expressions Language (CEL)](https://github.com/google/cel-spec)
+- [Google Cloud Access Context Manager \| Macros for CEL expressions](https://cloud.google.com/access-context-manager/docs/custom-access-level-spec#macros_for_cel_expressions)
+- [Google Cloud Access Context Manager \| Custom access level specification](https://cloud.google.com/access-context-manager/docs/custom-access-level-spec)
+- [GWS Blog \| Enable advanced context-aware access to Google Workspace in the Admin console](https://workspaceupdates.googleblog.com/2021/11/enable-advanced-context-aware-access-to.html)
+- [GWS Admin Help \| Google Workspace Device management security checklist](https://support.google.com/a/answer/7422256)
+- [GWS Admin Help \| Deploy Context-Aware Access](https://support.google.com/a/answer/12643733)
+
+### Prerequisites
+
+- One or more of the following user roles should have been configured to set context-aware policies:
+
+ > Super admin
+
+ > Delegated admin with each of these privileges:
+
+ - Data Security -\> Access level management
+
+ - Data Security -\> Rule management
+
+ - Admin API Privileges -\> Groups\>Read
+
+ - Admin API Privileges -\> Users\>Read
+
+- Serial numbers may be required to enforce a policy for company-owned devices. Refer to [Google documentation](https://support.google.com/a/answer/10287358) on device management for additional guidance.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.2.1v0.1 Instructions
+To turn on Context-Aware Access:
+
+1. Access the [Google Admin console](https://admin.google.com/).
+2. From the menu, go to **Security** -\> **Access and data control** -\> **Context-Aware Access**.
+3. Verify **Context-Aware Access** is **ON for everyone**. If not, click **Turn On**.
+
+#### GWS.COMMONCONTROLS.2.2v0.1 Instructions
+Note that the implementation details of context-aware access use cases will vary per agency. Refer to [Google's documentation](https://support.google.com/a/answer/12643733) on implementing context-aware access for your specific use cases. Common use cases include:
+
+- Require company-owned on desktop but not on mobile device
+- Require basic device security
+- Allow access to contractors only through the corporate network
+- Block access from known hijacker IP addresses
+- Allow or disallow access from specific locations
+- Use nested access levels instead of selecting multiple access levels during assignment
+
+## 3. Login Challenges
+
+Login challenges are additional security measures used to verify a user's identity. For example, Google might ask the user to confirm their recovery email before logging in as part of a challenge.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.3.1v0.1
+Login Challenges SHALL be enabled when third party SAML SSO is in use.
+
+- Rationale
+ - Many organizations use third-party identity providers (IdPs) to authenticate users who use single sign on (SSO) through SAML. The third-party IdP authenticates users and no additional risk-based challenges are presented to them. Any Google 2-Step Verification (2SV) configuration is ignored. This is the default behavior. You can set a policy to allow additional risk-based authentication challenges and 2SV if it's configured. If Google receives a valid SAML assertion (authentication information about the user) from the IdP during user sign-in, Google can present additional challenges to the user.
+ - Login challenges requires users have a recovery phone number or email account associated with their organizational account. If not previously configured, users will be prompted to enter this information periodically until provided.
+ - One login challenge option prompts users to enter their employee ID. This method is susceptible to information gathering attacks, should a list of employee IDs ever be leaked.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+### Resources
+
+- [GWS Admin Help \| Protect Google Workspace accounts with security challenges](https://support.google.com/a/answer/6002699)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- When using Employee ID challenge, the Employee ID must be uploaded to Google Workspace through the Agency's Identity Management infrastructure (e.g., via GCDS).
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.3.1v0.1 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security**-\>**Authentication**-\>**Login challenges.**
+3. Under **Organizational units**, ensure that the name for the entire organization is selected.
+4. Click **Post-SSO verification**, then select **Ask users for additional verifications from Google if a sign-in looks suspicious, and always apply 2-Step Verification policies (if configured)**. Click **SAVE**.
+5. Optionally, if employee IDs are known to agency employees (or accessible to the employee outside of Google Workspace), they may be used.
+6. Click **Login challenges**.
+7. Select the **Use employee ID to keep my users more secure** checkbox.
+8. Click **SAVE**.
+
+## 4. User Session Duration
+
+This control allows configuring of limits on how long a GWS session can be active before being prompted for authentication credentials.
+
+Note: If using a third-party IdP, and agency-set web session lengths for its users, then there will be a need to set the IdP session length parameter to expire before the Google session expires to ensure users are forced to sign in again. See [GWS documentation](https://support.google.com/a/answer/7576830) for additional details.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.4.1v0.1
+Users SHALL be forced to re-authenticate after an established 12-hour GWS login session has expired.
+
+- Rationale
+ - This is to ensure that a session is not active without needing to reauthenticate for a longer period of time as this creates a higher potential for unauthorized access.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:004: Use Alternate Authentication Material: Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+
+### Resources
+
+- [GWS Admin Help \| Set session length for Google services](https://support.google.com/a/answer/7576830?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.4.1v0.1 Instructions
+To configure Google session control:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security.**
+3. Select **Access and data control** -\> **Google session control.**
+4. Look for the **Web session duration** heading.
+5. Set the duration to **12 hours.**
+
+## 5. Secure Passwords
+
+Per NIST 800-63 and OMB M-22-09, ensure that user passwords do not expire and that long passwords are chosen. Research indicates that frequent password rotation breeds poor password choice and encourages password reuse. Ensure that passwords are strong to defend against brute-force attacks. Ensure that passwords are not reused to defend against credential theft.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.5.1v0.1
+User password strength SHALL be enforced.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.2v0.1
+User password length SHALL be at least 12 characters.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.3v0.1
+Password policy SHALL be enforced at next sign-in.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.4v0.1
+User passwords SHALL NOT be reused.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.5v0.1
+User passwords SHALL NOT expire.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+### Resources
+
+- [GWS Admin Help \| Enforce and monitor password requirements for users](https://support.google.com/a/answer/139399?hl=en#zippy=%2Cwhat-makes-a-password-strong)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure a strong password policy is configured, use the Google Workspace Admin Console:
+
+#### Policy Group 5 common Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Locate **Password management.**
+4. Follow implementation for each individual policy.
+5. Select **Save**.
+
+#### GWS.COMMONCONTROLS.5.1v0.1 Instructions
+1. Under **Strength**, select the **Enforce strong password** checkbox.
+
+#### GWS.COMMONCONTROLS.5.2v0.1 Instructions
+1. Under **Length**, set **Minimum Length** to 12+.
+
+#### GWS.COMMONCONTROLS.5.3v0.1 Instructions
+1. Under **Strength and Length enforcement**, select the **Enforce password policy at next sign-in** checkbox.
+
+#### GWS.COMMONCONTROLS.5.4v0.1 Instructions
+1. Under **Reuse**, deselect the **Allow password reuse** checkbox.
+
+#### GWS.COMMONCONTROLS.5.5v0.1 Instructions
+1. Under **Expiration**, select **Never Expires.**
+
+## 6. Highly Privileged Accounts
+
+Highly privileged accounts represent significant risk to an agency if compromised or if insiders use them in an unauthorized way. Highly privileged accounts share the same risk factors related to the catastrophic impacts on GWS services, user community and agency data, if compromised. This section supports the definition of highly privileged accounts and the controls necessary to protect them.
+
+Pre-Built GWS Admin Roles considered highly privileged:
+
+- Super Admin: This role possesses critical control over the entire GWS structure. It has access to all features in the Admin Console and Admin API and can manage every aspect of agency GWS accounts.
+- User Management Admin: This account has rights to add, remove, and delete normal users in addition to managing all user passwords, security settings, and other management tasks that make it potentially crucial if compromised.
+- Services Admin: This admin has full rights to turn on or off GWS services and security settings for these services (Gmail, Drive, Voice, etc.). Given that most GWS features are premised on these services being secure, compromise of this account would be critical.
+- Mobile Admin: This admin has full rights to manage all the agency mobile devices including authorizing their use and controlling the apps that can be downloaded and used on them. This admin can also set the security policies on all agency mobile devices connected to GWS.
+- Groups Admin: This admin has full rights to view profiles in the organizational and OU structures and can manage all rights for those members in the group.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.6.1v0.1
+Agencies SHALL ensure that all accounts with highly privileged roles are separate administrative accounts, distinct from the ordinary day to day accounts of those personnel.
+
+- Rationale
+ - This helps ensure that the accounts with admin privileges are only used when performing admin tasks and that for ordinary tasks personnel use a lower-privileged account.
+- Last Modified: July 11, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.6.2v0.1
+All highly privileged accounts SHALL leverage Google Account authentication with phishing-resistant MFA and not the agency's authoritative on-premises or federated identity system.
+
+- Rationale
+ - Provides a stronger and more centralized form of authentication which provides stronger protections against compromises.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [Google Cloud Architecture Center \| Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+- [GWS Admin Help \| Create, edit, and delete custom admin roles](https://support.google.com/a/answer/2406043)
+- [GWA Admin Help \| Assign Specific Admin Roles](https://support.google.com/a/answer/9807615?hl=en)
+- [GWA Admin Help \| Pre-Built Admin Roles](https://support.google.com/a/answer/2405986?hl=en)
+
+### Prerequisites
+
+- Super admin users cannot log in to admin.google.com with a 3rd party IdP when using Super Admin level accounts—they must use Google Login as the authentication mechanism. This policy extends this rule to other Admin types.
+- Delegated accounts, including the ones defined as highly privileged above, can by default, use a third-party IdP to access admin.google.com: however, this policy prohibits that practice. All highly privileged accounts must use phishing resistant Google Authentication.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.6.1v0.1 Instructions
+1. The implementation process for this can be located [here](https://support.google.com/a/answer/9807615).
+
+#### GWS.COMMONCONTROLS.6.2v0.1 Instructions
+1. The implementation process for this can be located [here](https://support.google.com/a/answer/9807615).
+
+## 7. Super Admin Accounts
+
+Super Admin is the highest privileged role in GWS because it provides unfettered access to the organization. Therefore, if a user's credential with these permissions were to be compromised, it would present significant risks to the security of the organization. Limit the number of users that are assigned the role of Super Administrator. Assign users to finer-grained administrative roles that they need to perform their duties instead of being assigned the Super Administrator role.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.7.1v0.1
+A minimum of **two** and maximum of **four** separate and distinct Super Admin users SHALL be configured.
+
+- Rationale
+ - Having only a single Super Admin Account can be problematic if this user were unavailable for an extended period of time. Also, Super Admin accounts should not be shared amongst multiple users.
+ - In addition, having too many super admins could be problematic as then there are many users with those privileges which creates a larger security risk
+- Last Modified: July 10, 2023
+- Note: Admin count does not include "break-glass" Super Admin accounts.
+
+
+- MITRE ATT&CK TTP Mapping
+ - [T1136: Create Account](https://attack.mitre.org/techniques/T1136/)
+ - [T1136:003: Create Account: Cloud Account](https://attack.mitre.org/techniques/T1136/003/)
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:003: Account Manipulation: Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003/)
+
+### Resources
+
+- [Google Cloud Architecture Center \| Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+- [GWS Admin Help \| Create, edit, and delete custom admin roles](https://support.google.com/a/answer/2406043)
+- [GWS Admin Help \| Assign Specific Admin Roles](https://support.google.com/a/answer/9807615?hl=en)
+- [GWS Admin Help \| Pre-Built Admin Roles](https://support.google.com/a/answer/2405986?hl=en)
+- [GWS Admin SDK Documentation \| Make User Super Admin](https://developers.google.com/admin-sdk/directory/reference/rest/v1/users/makeAdmin)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.7.1v0.1 Instructions
+To obtain a list of all GWS Super Admins:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -\> **Admin Roles**.
+3. Click the **Super Admin** role in the list of roles
+4. The subsequent dialog provides a list of Super Admins.
+
+## 8. Conflicting Account Management
+
+It is possible for employees of an organization to create conflicting, unmanaged accounts that are unmanaged by an enterprise's Google Workspace tenant. Unmanaged accounts are defined as users who independently created a Google account using the organization's domain. For example, a user with an enterprise/corporate email of user@company.com could create a personal, unmanaged Google account using that email address. This would create an account conflict in a GWS tenant licensed to company.com since email addresses are unique.
+
+Creating a conflicting account can also happen unintentionally. After signing up for Google Cloud Identity or Google Workspace, admins might decide to set up single sign-on with an external identity provider (IdP) such as Azure Active Directory (AD) or Active Directory. When configured, the external IdP might automatically create accounts in Cloud Identity or Google Workspace for all users for which single sign-on was enabled, inadvertently creating conflicting accounts.
+
+Unmanaged accounts carry significant risk, as they cannot be managed by admins, rendering them outside of the scope of protection admins can apply to keep work data secure. Significantly, two-step verification (2SV) cannot be enforced. Even if access is revoked, these accounts can carry a social engineering risk. Further, reconciling conflicting accounts creates churn for admins and adds to the workload of onboarding users to Google Workspace & Google Cloud.
+
+The GWS admin console provides several administrative options for handling conflicting, unmanaged accounts:
+ - Automatically invite users to transfer unmanaged accounts.
+ - Replace unmanaged accounts with managed ones.
+ - Don't create new accounts if unmanaged accounts exist.
+
+This policy requires replacing unmanaged accounts with managed ones. When this option is configured, data owned by the account will not be imported; the user will receive a temporary account address, which they'll need to manually replace with a @gmail.com address of their choice; the user will receive an email notification of this and are informed they cannot use the original email any longer.
+
+By changing the email address, the user resolves the conflict by ensuring that the managed account and consumer account have different identities. The result remains that they have one consumer account that has all their original data, and one managed account that doesn't have access to the original data.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.8.1v0.1
+Account conflict management SHALL be configured to replace conflicting unmanaged accounts with managed ones.
+
+- Rationale
+ - As per Google, if employees of an organization use unmanaged accounts, then the premise of having a single place to manage user identities is compromised. Unmanaged accounts aren't managed by Google Workspace or Cloud Identity. Therefore, the ideal security course of action for government agencies is to replace conflicting unmanaged accounts with managed ones, rather than allowing a grace period or doing nothing with such accounts.
+ - Per Google, unmanaged personal accounts that use a business email address carry multiple risks, including the following:
+ - You can't control the lifecycle of an unmanaged user account. An employee who leaves the company might continue to use the unmanaged account to access corporate resources or to generate corporate expenses.
+ - Even if you revoke access to all resources, the unmanaged account might still pose a social engineering risk. Because the user account uses a seemingly trustworthy identity with your company's domain name, the former employee might be able to convince current employees or business partners to grant access to resources again—for example, a sensitive Drive file.
+ - A former employee with an unmanaged account might use the user account to perform activities that aren't in line with your organization's policies, which could put your company's reputation at risk.
+ - You can't enforce security policies like 2-step verification or password complexity rules.
+ - You can't restrict which geographic location Docs and Drive data is stored in, which might be a compliance risk.
+ - You can't restrict which Google services can be accessed by an unmanaged user account.
+ - Reconciling conflicting accounts creates churn for admins and adds to the workload of onboarding users to Google Workspace & Google Cloud.
+ - Note that if unmanaged accounts are used for official federal government business, they may be subject to record-keeping requirements under the Federal Records Act, 44 U.S.C. Chapter 31 et seq.
+- Last Modified: September 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1136: Create Account](https://attack.mitre.org/techniques/T1136/)
+ - [T1136:003: Create Account: Cloud Account](https://attack.mitre.org/techniques/T1136/003/)
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:003: Account Manipulation: Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003/)
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+
+### Resources
+
+- [GWS Admin Help | Use the transfer tool to migrate unmanaged users](https://support.google.com/a/answer/6178640)
+- [GWS Admin Help | Find and add unmanaged users](https://support.google.com/a/answer/11112794)
+- [Google Workspace Updates Blog | Resolve conflict accounts faster with the new Conflict Accounts Management tool](https://workspaceupdates.googleblog.com/2023/08/conflict-accounts-management-tool.html)
+- [Google Cloud Architecture Center | Migrating consumer accounts](https://cloud.google.com/architecture/identity/migrating-consumer-accounts#using_a_conflicting_account)
+- [Google Cloud Architecture Center | Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+
+### Prerequisites
+
+- Super Admin privileges
+
+### Implementation
+#### GWS.COMMONCONTROLS.8.1v0.1 Instructions
+
+To configure account conflict management per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -\> **Account settings.**
+3. Click the **Conflicting accounts management** card.
+4. Select the radio button option: **"Replace conflicting unmanaged accounts with managed ones."**
+5. Click **Save.**
+
+## 9. Catastrophic Recovery Options for Super Admins
+
+If a catastrophic event occurs in which the GWS Super Admin credentials are lost or stolen, this control is in place to require "break-glass" Super Admin accounts. These accounts are to be physically secured in a highly secure location as a recovery option, with the account self-recovery feature disabled in GWS.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.9.1v0.1
+A second, "break-glass" Super Admin account SHALL be created and physically secured for each individual Super Admin user to mitigate account access issues resulting from catastrophic credential loss or compromise.
+
+- Rationale
+ - Having a "break-glass" account for each super admin is important in case the super admin loses access to their account and needs to recover it.
+ - Only using this account for recovery provides a benefit of being able to track when they recover their account as the access to the "break-glass" account would indicate a recovery.
+ - Keeping it physically secure ensures there is no unauthorized access to the account.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.2v0.1
+Account self-recovery for Super Admins SHALL be disabled, forcing Super Admin users who have lost their login credentials to contact another Super Admin to recover their account.
+
+- Rationale
+ - This makes it more difficult for a potential adversary from being able to attempt to gain access to a super admin account through the method of account recovery.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.3v0.1
+"Break-glass" account credentials SHALL be used only if all Super Admins have lost their credentials.
+
+- Rationale
+ - This helps ensure that their is limited access to the "break-glass" account keeping the credentials to those accounts secure and not exposing them to potentially being leaked.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.4v0.1
+A geographically separate and secure location SHOULD be planned and implemented to store "break-glass" account credentials for Super Admins.
+
+- Rationale
+ - Keeping break glass credentials in a separate and secure location helps prevent against losing the credentials if something happens to the primary location.
+ - In addition, provides extra security as the credentials are kept separate from where an attacker would most likely look.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [GWS Admin Help \| Allow super administrators to recover their password](https://support.google.com/a/answer/9436964?fl=1)
+- [GWS Admin Help \| Recover an account protected by 2-Step Verification](https://support.google.com/a/answer/9176734?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.9.1v0.1 Instructions
+To configure break glass Super Admin account:
+
+1. Follow standard instructions for setting up a GWS normal user
+2. Follow these instructions for upgrading user to a Super Admin
+3. Link: [https://support.google.com/a/answer/172176](https://support.google.com/a/answer/172176?hl=en&fl=1)
+4. Follow the guidance in this document for setting up phishing resistant MFA for the Super Admin
+5. Store the MFA credentials for this account in a highly protected safe or secured room
+6. Set up multi-factor and/or multi-person access to the secured area
+
+#### GWS.COMMONCONTROLS.9.2v0.1 Instructions
+To disable Super Admin account self-recovery:
+
+1. Sign in to https://admin.google.com as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Select **Account Recovery**.
+4. Click **Super admin account recovery**.
+5. To apply the setting to all your Super Admins, leave the top OU selected. Otherwise, select a child OU or a configuration group.
+6. Deselect the **Allow Super Admins to recover their account** checkbox.
+7. Click **Save**.
+8. Ask your Super Admins to set up a recovery phone number or email address for receiving password recovery instructions.
+
+#### GWS.COMMONCONTROLS.9.3v0.1 Instructions
+1. There are no implementation steps for this policy.
+
+#### GWS.COMMONCONTROLS.9.4v0.1 Instructions
+1. There are no implementation steps for this policy.
+
+## 10. GWS Advanced Protection Program
+
+This control enforces more secure protection of highly privileged, senior executive and sensitive users accounts from targeted attacks. It enforces optional GWS user security features like:
+
+- Strong authentication with security keys
+- Use of security codes with security keys
+- Restrictions on third-party access to account data
+- Deep Gmail scans
+- Google Safe Browsing protections in Chrome
+- Account recovery through admin
+
+### Policies
+
+#### GWS.COMMONCONTROLS.10.1v0.1
+Highly privileged accounts SHALL be enrolled in the GWS Advanced Protection Program.
+
+- Rationale
+ - Sophisticated phishing tactics can trick even the most savvy users into giving their sign-in credentials to attackers. Advanced Protection requires you to use a security key, which is a hardware device or special software on your phone used to verify your identity, to sign in to your Google Account. Unauthorized users won't be able to sign in without your security key, even if they have your username and password.
+ - The Advanced Protection Program includes a curated group of high-security policies that are applied to enrolled accounts. Additional policies may be added to the Advanced Protection Program to ensure the protections are current.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.10.2v0.1
+All sensitive user accounts SHOULD be enrolled into the GWS Advanced Protection Program. This control enforces more secure protection of sensitive user accounts from targeted attacks. Sensitive user accounts include political appointees, Senior Executive Service (SES) officials, or other senior officials whose account compromise would pose a level of risk prohibitive to agency mission fulfillment.
+
+- Rationale
+ - Sophisticated phishing tactics can trick even the most savvy users into giving their sign-in credentials to attackers. Advanced Protection requires you to use a security key, which is a hardware device or special software on your phone used to verify your identity, to sign in to your Google Account. Unauthorized users won't be able to sign in without your security key, even if they have your username and password.
+ - The Advanced Protection Program includes a curated group of high-security policies that are applied to enrolled accounts. Additional policies may be added to the Advanced Protection Program to ensure the protections are current.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [GWS Admin Help \| Protect users with the Advanced Protection Program](https://support.google.com/a/answer/9378686)
+- [GWS Admin Help \| Advanced Protection Program FAQ](https://support.google.com/a/answer/9503534?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- Two security keys are required for added assurance. If one key is lost or damaged, users can use the second key to regain account access.
+
+### Implementation
+
+#### Policy Group 10 Instructions
+To allow all users to enroll:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security -**\> **Authentication** -\> **Advanced Protection Program.**
+3. On the right, locate the **Advanced Protection** header.
+4. Locate the **Allow users to enroll in the Advanced Protection Program** header.
+5. Select **Enable user enrollment.**
+6. Click **SAVE.**
+
+## 11. App Access to Google APIs
+
+Agencies need to have a process in place to manage and control application access to GWS data. This control enables the ability to restrict access to Google Workspace APIs from other applications and is aimed at mitigating the significant cybersecurity risk posed by the potential compromise of OAuth tokens. The baseline policy statements are written to allow implementers to balance operational need with risk posed by granting app access.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.11.1v0.1
+Agencies SHALL develop and implement a process to explicitly allow-list (trust) third-party app access to GWS services.
+
+- Rationale
+ - Prevents unauthorized access to GWS through the GWS API which provides additional protection against cyber attacks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.2v0.1
+Agencies SHALL use GWS application access control policies to restrict access to all GWS services by third party apps.
+
+- Rationale
+ - You can restrict (or leave unrestricted) access to most Workspace services, including Google Cloud Platform services such as Machine Learning. For Gmail and Google Drive, you can specifically restrict access to high-risk scopes (for example, sending Gmail or deleting files in Drive). While users are prompted to consent to apps, if an app uses restricted scopes and you haven't specifically trusted it, users can't add it.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.3v0.1
+Agencies SHALL NOT allow users to consent to access to low-risk scopes.
+
+- Rationale
+ - Allowing users to give access to OAuth scopes that aren't classified as high-risk could still allow for apps that are not trusted to be granted access by non-administrator personnel and without having to be allowlisted in accordance with 11.1.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.4v0.1
+Agencies SHALL NOT trust unconfigured internal apps.
+
+- Rationale
+ - By not trusting unconfigured apps it is ensuring the platform remains secure as unconfigured apps could be unsecure and create vulnerabilities within the whole system.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.5v0.1
+Agencies SHALL NOT allow users to access unconfigured third-party apps.
+
+- Rationale
+ - Not allowing access to unconfigured apps helps ensure the platform remains secure as unconfigured apps could be unsecure and create vulnerabilities within the whole system.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+
+### Resources
+
+- [RFC 6819](https://datatracker.ietf.org/doc/html/rfc6819)
+- [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749)
+- [OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)
+- [GWS Admin Help \| Control which third-party & internal apps access GWS data](https://support.google.com/a/answer/7281227#zippy=%2Cstep-control-api-access%2Cstep-restrict-or-unrestrict-google-services%2Cbefore-you-begin-review-authorized-third-party-apps%2Cstep-manage-third-party-app-access-to-google-services-add-apps)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### Policy Group 11 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com).
+2. Go to **Security** -\> **Access and Data Control** -\> **API controls.**
+
+#### GWS.COMMONCONTROLS.11.1v0.1 instructions:
+1. There are no implementation steps for this policy
+
+#### GWS.COMMONCONTROLS.11.2v0.1 instructions:
+1. Select **Manage Google Services.**
+2. Select the **Services box** to check all services boxes.
+3. Once this box is selected, then the **Change access** link at the top of console will be available; select it.
+4. Select **Restricted: Only trusted apps can access a service.**
+5. Select **Change** then **confirm** if prompted.
+
+#### GWS.COMMONCONTROLS.11.3v0.1 instructions:
+1. Select **Manage Google Services.**
+2. Select the **Services box** to check all services boxes.
+3. Once this box is selected, then the **Change access** link at the top of console will be available; select it.
+4. Ensure to uncheck the check box next to **For apps that are not trusted, allow users to give access to OAuth scopes that aren't classified as high-risk.**
+5. Select **Change** then **confirm** if prompted.
+
+#### GWS.COMMONCONTROLS.11.4v0.1 Instructions
+1. Select **Settings.**
+2. Select **Unconfigured third-party apps** and select **Don't allow users to access any third-party apps**
+3. Select **SAVE.**
+
+#### GWS.COMMONCONTROLS.11.5v0.1 Instructions
+1. Select **Settings.**
+2. Select **Internal apps** and uncheck the box next to **Trust internal apps.**
+3. Select **SAVE.**
+
+It should be noted that admins will have to manually approve each trusted app. The implementation steps for this activity are outlined in Google's [documentation on controlling which third-party & internal apps access GWS data](https://support.google.com/a/answer/7281227) (also listed under Resources).
+
+## 12. Authorized Google Marketplace Apps
+
+This section enables the ability to restrict the installation of Google Workspace Marketplace apps to a defined list provided and configured in the app allowlist. This guidance includes and applies to internally developed applications.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.12.1v0.1
+Policy SHOULD be established dictating the app review and approval process.
+
+- Rationale
+ - Helps ensures a standardized procedure for approving apps for marketplace and ensures it is documented.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+
+#### GWS.COMMONCONTROLS.12.2v0.1
+Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.
+
+- Rationale
+ - Users should only be allowed to install approved and vetted apps. This includes internally developed applications which being allowed without proper vetting poses a significant insider risk. This will help limit the overall attack surface for the organization.
+- Last Modified: October 24, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+
+### Resources
+
+- [GWS Admin Help \| Manage Google Workspace Marketplace apps on your allowlist](https://support.google.com/a/answer/6089179?fl=1)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.12.1v0.1 Instructions
+1. There are no implementation steps for this policy
+
+#### GWS.COMMONCONTROLS.12.2v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Apps** -\> **Google Workspace Marketplace apps** -\> **Settings.**
+3. Select **Allow users to install and run allowlisted apps from the Marketplace.**
+4. Ensure that the **Allow exception for internal apps. Users can install and run any internal app, even if it is not allowlisted.** checkbox is unchecked.
+5. Click **Save.**
+
+To add an app to the allowlist:
+1. On the left-hand side above **Setting,** click **Apps lists.**
+2. Click the **ALLOWLIST APP** to add an app to the allow list.
+
+ or
+
+3. Click **Allowlisted Apps** to manage the allow list.
+
+## 13. Less Secure Apps
+
+This control disables legacy authentication and requires the use of modern authentication protocols based on federation for access from applications.
+
+Some older versions of common software may break when this control is implemented. Examples of these apps include:
+
+- Mails configured with POP3
+- Older versions of Outlook
+
+### Policies
+
+#### GWS.COMMONCONTROLS.13.1v0.1
+Access to Google Workspace applications by less secure apps that do not meet security standards for authentication SHALL be prevented.
+
+- Rationale
+ - You can block sign-in attempts from some apps or devices that are less secure. Apps that are less secure don't use modern security standards, such as OAuth. Using apps and devices that don't use modern security standards increases the risk of accounts being compromised. Blocking these apps and devices helps keep your users and data safe.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+### Resources
+
+- [GWS Admin Help \| Control access to less secure apps](https://support.google.com/a/answer/6260879?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.13.1v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security.**
+3. Select **Access and data control** -\> **Less secure apps.**
+4. Select **Disable access to less secure apps (Recommended).**
+5. Click **Save** to commit this configuration change.
+
+## 14. Google Takeout Services for Users
+
+This section prevents users from downloading a copy of the Google Takeout service's data to their user accounts. Services include Google Blogger, Books, Maps, Pay, Photos, Play, Play Console, Location History and YouTube, among numerous others.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.14.1v0.1
+Google Takeout services SHALL be disabled for users.
+
+- Rationale
+ - Google Takeout is a service that allows you to download a copy of your data stored within 40+ Google products and services. This includes data from Gmail, Drive, Photos, Calendar, and many others. You can download your data in a variety of formats, including ZIP, TAR, and XML. While there may be a valid use case for individuals to backup their data in non-enterprise settings, this feature represents considerable attack surface as a mass data exfiltration mechanism, particularly in enterprise settings where other backup mechanisms are likely in use.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [GWS Admin Help \| Security checklist for medium and large businesses](https://support.google.com/a/answer/7587183?hl=en#zippy=%2Caccounts%2Capps-google-workspace-only%2Csites-google-workspace-only%2Cdrive%2Cgoogle-groups)
+- [GWS Admin Help \| Allow or block Google Takeout](https://support.google.com/a/answer/6396995#managing&zippy=)
+
+### Prerequisites
+
+- Determine which OU or access group will be affected by this policy and confirm that the right user and system accounts are in that OU or access group.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.14.1v0.1 Instructions
+1. Sign in to https://admin.google.com as an administrator.
+2. Select **Account** then **Google Takeout.**
+3. Select **User access to Takeout for Google services**.
+4. For services without an individual admin control, select **Services without an individual admin control** then **Edit.**
+5. Select **Don't allow for everyone**.
+6. Click **Save**.
+7. For services with an individual admin control, under **apps** select the checkbox next to **Service name** and select **Don't allow**.
+8. Click **Save.**
+
+## 15. System-defined Rules
+
+GWS includes system-defined alerting rules that provide situational awareness into risky events and actions. A security best practice is to enable the following list of rules. Please note that some, but not all, of these rules may be set to "on" by default. Rules that are not listed may be useful but not security relevant. Review all system-defined rules to implement the appropriate configuration based on individual requirements.
+
+- Google security checklist for medium and large businesses
+- Government-backed attacks
+- User-reported phishing
+- User's Admin privilege revoked
+- User suspended for spamming through relay
+- User suspended for spamming
+- User suspended due to suspicious activity
+- User suspended (Google identity alert)
+- User suspended (by admin)
+- User granted Admin privilege
+- User deleted
+- Suspicious programmatic login
+- Suspicious message reported
+- Suspicious login
+- Suspicious device activity
+- Suspended user made active
+- Spike in user-reported spam
+- Rate limited recipient
+- Phishing message detected post-delivery
+- Phishing in inboxes due to bad allowlist
+- New user added
+- Mobile settings changed
+- Malware message detected post-delivery
+- Leaked password
+- Google Operations
+- Gmail potential employee spoofing
+- Email settings changed
+- Drive settings changed
+- Domain data export initiated
+- Device compromised
+- Calendar settings changed
+- Account suspension warning
+- Client-side encryption service unavailable
+
+### Policies
+
+#### GWS.COMMONCONTROLS.15.1v0.1
+Required system-defined alerting rules, as listed in the Policy section, SHALL be active, with alerts enabled when available. Any system-defined rules not are considered optional but ought to be reviewed for consideration.
+
+- Rationale
+ - System-defined rules can allow an administrator to be notified of specific activity within a domain—such as a suspicious sign-in attempt, a compromised mobile device, or when another administrator changes settings.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [GWS Admin Help \| Data sources for the security investigation tool](https://support.google.com/a/answer/11482175)
+- [GWS Admin Help \| View and edit system-defined rules](https://support.google.com/a/answer/3230421)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.15.1v0.1 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com).
+2. On the left navigation pane, click the hamburger menu above **Home**-\>**Show more**.
+3. Click **Rules**.
+4. From the Rules page, click **Add a filter**.
+5. From the drop-down menu, select **Type**.
+6. Select the **System defined** check box.
+7. Click **Apply**.
+8. A list of system defined rules displays. Select one of the rules from the list by clicking the table row for that rule—for example, the Device compromised rule.
+9. From the Rule details page, you can view the conditions and actions for the rule—for example, to confirm if email notifications are turned on, and to confirm the recipients for those email notifications.
+10. Click **Edit Rule**.
+11. Click **Next: View Conditions**.
+12. Click **Next: Add Actions**.
+13. From the Actions page, you can change the severity for the alert to High, Medium, or Low, send an alert to the alert center if the rule's conditions are met, set up admin email notifications, and specify recipients for those notifications.
+14. Click **Next: Review**.
+15. Review the updated rule details, and then click **Update Rule**.
+
+## 16. Google Workspace Logs
+
+Configure GWS to send critical logs to the agency's centralized SIEM so that they can be audited and queried. Configure GWS to send logs to a storage account and retain them for when incident response is needed.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.16.1v0.1
+The following critical logs SHALL be sent at a minimum.
+
+ > Admin Audit logs
+
+ > Enterprise Groups Audit logs
+
+ > Login Audit logs
+
+ > OAuth Token Audit logs
+
+ > SAML Audit log
+
+ > Context Aware Access logs
+
+- Rationale
+ - OMB M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents, provides guidance on log retention for federal agencies. The memorandum defines the types of logs that must be retained at each maturity level for log retention.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:008: Impair Defenses: Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008/)
+
+#### GWS.COMMONCONTROLS.16.2v0.1
+Audit logs SHALL be maintained for at least 6 months in active storage and an additional 18 months in cold storage, as dictated by OMB M-21-31. The logs SHALL be sent to the agency's Security Operations Center (SOC) for monitoring.
+
+- Rationale
+ - OMB M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents, provides guidance on log retention for federal agencies. The memorandum defines three maturity levels for log retention, with each level requiring different minimum retention periods.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:008: Impair Defenses: Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008/)
+
+### Resources
+
+- [GWS Admin Help \| Share data with Google Cloud Platform services](https://support.google.com/a/answer/9320190)
+- [Google Cloud Operations Suite \| Audit logs for Google Workspace](https://cloud.google.com/logging/docs/audit/gsuite-audit-logging)
+- [Google Cloud Operations Suite \| View and manage audit logs for Google Workspace](https://cloud.google.com/logging/docs/audit/configure-gsuite-audit-logs)
+- [Google Cloud Operations Suite \| Aggregate and store your organization's logs](https://cloud.google.com/logging/docs/central-log-storage)
+- [Google Cloud Architecture Center \| Google Logging export scenarios](https://cloud.google.com/architecture/design-patterns-for-exporting-stackdriver-logging?hl=en#logging_export_scenarios)
+- [GWS Admin Help \| Data sources for GWS Audit and investigation page](https://support.google.com/a/answer/9725452)
+- [Google Cloud Operations Suite \| Configure and Manage sinks – Google Cloud](https://cloud.google.com/logging/docs/export/configure_export_v2)
+- [OMB M-21-31 \| Office of Management and Budget](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.16.1v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Go to Menu [Account \> Account settings \> Legal and compliance](https://admin.google.com/ac/companyprofile/legal).
+3. Click **Sharing options.**
+4. Select **Enabled.**
+5. Click **Save**.
+
+#### GWS.COMMONCONTROLS.16.2v0.1 Instructions
+1. There is no implementation for this policy.
+
+## 17. Data Regions
+
+Google Workspace administrators can choose to store data in a specific geographic region (currently the United States or Europe) by using a data region policy. The policy can be applied to a specific organizational unit (OU) in a tenant or at the parent OU. For the interests of Federal agencies, the best practice is to restrict stored data for all users to the U.S. This means applying this setting at the parent OU. Data region storage covers the primary data-at-rest (including backups) for Google Workspace core services (see resources section for services in scope).
+
+At the time of writing, data region policies cannot be applied to data types not specifically listed in documentation linked in the resources section. Notably, this includes logs and cached content.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.17.1v0.1
+The data storage region SHALL be set to be the United States for all users in the agency's GWS environment.
+
+- Rationale
+ - This policy is aligned with the concept of data sovereignty. Ensuring that data is stored in a specific region (in this case, the U.S. for FCEB agencies) affords the administrator of the GWS environment a degree of control and governance over their cloud data.
+ - FCEB agencies may need to meet specific regulations for various data classifications including data governance, security controls, privacy, and data residency. Being able to establish data sovereignty and identify residency regions can aid in these efforts.
+- Last Modified: October 30, 2023
+
+### Resources
+- [GWS Admin Help \| Data regions: Choose a geographic location for your data](https://support.google.com/a/answer/7630496)
+- [GWS Admin Help \| What data is covered by a data region policy?](https://support.google.com/a/answer/9223653)
+
+### Prerequisites
+
+- Super Admin role
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.17.1v0.1 Instructions
+To configure Data Regions per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -> **Account settings**.
+3. Click the **Data Regions** card.
+4. Click the **Data Regions** policy card.
+5. Select the radio button option: "**United States**"
+6. Click **Save**.
+
+## 18. Supplemental Data Storage
+
+Google Workspace administrators have the option to store a copy of users’ data in a specific country. This is accomplished by enabling Supplemental Data Storage in the Google Admin console. You can do this for some or all of your users. Google will then store those users’ data on servers based in the country you select, in addition to Google’s existing data centers. The following Google Workspace core services are included in this feature: Gmail, Google Calendar, Google Groups for Business, Google Drive, and Google Contacts.
+
+Google will periodically backup users’ data to servers located in the country specified.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.18.1v0.1
+The supplemental data storage region SHALL NOT be set to 'Russian Federation'.
+
+- Rationale
+ - This policy is aligned with the concept of data sovereignty. Ensuring that data is not stored in a specific region affords the administrator of the GWS environment a degree of control and governance over their cloud data. This policy takes into account geopolitical and USG national security concerns.
+- Last Modified: November 30, 2023
+
+### Resources
+- [GWS Admin Help \| Set up Supplemental Data Storage](https://support.google.com/a/answer/6281927)
+
+### Prerequisites
+- Super Admin role
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.18.1v0.1 Instructions
+To configure Supplemental Data Storage per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -> **Account settings**.
+3. Click the **Supplemental Data Storage** card.
+4. Ensure the checkbox for "**Russian Federation**" is unchecked.
+6. Click **Save**.
diff --git a/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..7a9795e9
--- /dev/null
+++ b/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,1592 @@
+# CISA Google Workspace Security Configuration Baseline for Gmail
+
+Gmail is the Google Workspace offering for sending and receiving email. Users can upload attachments to emails and send them to a given email address. Additional Gmail features include integrating with other Google applications, such as Meet and Chat. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Gmail security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at the [Gmail Google Workspace Admin Help Center](https://support.google.com/a/topic/9202?hl=en&ref_topic=9197) and addresses the following:.
+
+- [Mail Delegation](#1-mail-delegation)
+- [Domain Keys Identified Mail](#2-domainkeys-identified-mail)
+- [Sender Policy Framework](#3-sender-policy-framework)
+- [Domain Based Message Authentication, Reporting, and Conformance](#4-domain-based-message-authentication-reporting-and-conformance)
+- [Attachment Protections](#5-attachment-protections)
+- [Links and External Images Protections](#6-links-and-external-images-protection)
+- [Spoofing and Authentication Protection](#7-spoofing-and-authentication-protection)
+- [User Email Uploads](#8-user-email-uploads)
+- [POP and IMAP Access](#9-pop-and-imap-access-for-users)
+- [Workspace Sync](#10-google-workspace-sync)
+- [Automatic Forwarding](#11-automatic-forwarding)
+- [Image URL Proxy Allowlists](#12-image-url-proxy-allowlists)
+- [Per User Outbound Gateways](#13-per-user-outbound-gateways)
+- [Unintended External Reply Warning](#14-unintended-external-reply-warning)
+- [Email Allowlist](#15-email-allowlist)
+- [Enhanced Pre-Delivery Message Scanning](#16-enhanced-pre-delivery-message-scanning)
+- [Security Sandbox](#17-security-sandbox)
+- [Approved Senders List](#18-approved-senders-list)
+- [Blocked Senders List](#19-blocked-senders-list)
+- [Comprehensive Mail Storage](#20-comprehensive-mail-storage)
+- [Content Compliance Filtering](#21-content-compliance-filtering)
+- [Objective Content Filtering](#22-objectionable-content-filtering)
+- [Attachment Compliance Filtering](#23-attachment-compliance-filtering)
+
+
+Within Google Workspace, settings can be assigned to users through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Mail Delegation
+
+This section determines whether users can delegate access to their mailbox to others within the same domain. This delegation includes access to read, send, and delete messages on the account owner's behalf. This delegation can be done via a command line tool (GAM) if enabled in the admin console.
+
+### Policies
+
+#### GWS.GMAIL.1.1v0.1
+Mail Delegation SHOULD be disabled.
+
+- Rationale
+ - Mail delegation can be a useful tool for delegating email management tasks to trusted individuals. However, it does pose the potential for risks such as unintentional disclosure of sensitive information, impersonation of delegated accounts, and malicious deletion or modification of emails.
+- Last Modified: October 4, 2023
+- Notes
+ - Exceptions should be limited to individuals authorized by existing Agency policy, such as SES or Politically Appointed staff. Other considerations include ensuring that delegated accounts require Phishing-Resistant Multi-Factor Authentication (MFA), limiting delegated account permissions (ex. allowing view/reply but not delete), monitoring delegated accounts regularly, and disabling them if no longer required.
+
+- MITRE ATT&CK TTP Mapping
+ - [T098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T098:002: Account Manipulation: Additional Email Delegate Permissions](https://attack.mitre.org/techniques/T1098/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn Gmail delegation on or off](https://support.google.com/a/answer/7223765?hl=en)
+- [GAM: Example Email Settings - Creating a Gmail delegate](https://github.com/GAM-team/GAM/wiki/ExamplesEmailSettings#creating-a-gmail-delegate)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.1.1v0.1 Instructions
+To configure the settings for Mail Delegation:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **User Settings -\> Mail delegation**.
+4. Ensure that the **Let users delegate access to their mailbox to other users in the domain** checkbox is unchecked.
+5. Select **Save**.
+
+
+## 2. DomainKeys Identified Mail
+
+This section enables DomainKeys Identified Mail (DKIM) to help prevent spoofing on outgoing messages sent from a specific domain. DKIM allows digital signatures to be added to email messages in the message header, providing a layer of both authenticity and integrity to emails. Without DKIM, messages that are sent from a specific domain are more likely to be marked as spam by receiving mail servers. DKIM relies on Domain Name System (DNS) records, thus, its deployment depends on how an agency manages its DNS.
+
+### Policies
+
+#### GWS.GMAIL.2.1v0.1
+DKIM SHOULD be enabled for all domains.
+
+- Rationale
+ - An adversary may modify the `FROM` field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is a means for recipients to detect spoofed emails and verify the integrity of email content.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1434: Internal Spear Phishing](https://attack.mitre.org/techniques/T1434/)
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with DKIM](https://support.google.com/a/answer/174124)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.2.1v0.1 Instructions
+To configure the settings for DKIM:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Authenticate email -\> DKIM authentication**.
+4. Select a domain listed in the **Selected** domain drop-down menu.
+5. Select **START AUTHENTICATION**.
+6. Select **Save**.
+7. Add the DNS TXT record listed in Admin Console to the domain, via the domain provider's DNS settings page. Note that it can take up to 48 hours for DNS changes to fully propagate.
+
+Note that step 7 requires action taken outside of the Google Admin Console, dependent on the agency's domain provider. Thus, the exact final step needed to set up DKIM varies from agency to agency. See [Turn on DKIM for your domain](https://support.google.com/a/answer/180504) for more details.
+
+To test your DKIM configuration, consider using a web-based tool, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/).
+
+## 3. Sender Policy Framework
+
+The Sender Policy Framework (SPF) is a mechanism that allows domain administrators to specify which IP addresses are explicitly approved to send email on behalf of the domain, facilitating detection of spoofed emails. SPF isn't configured through the Google Admin Console, but rather via DNS records hosted by the agency's domain. Thus, the exact steps needed to set up SPF varies from agency to agency, but Google's documentation provides some helpful starting points.
+
+### Policies
+
+#### GWS.GMAIL.3.1v0.1
+A list of approved IP addresses for sending mail SHALL be maintained.
+
+- Rationale
+- Failing to maintain an accurate list of authorized IP addresses may result in spoofed email messages or failure to deliver legitimate messages when SPF is enabled. Maintaining such a list helps ensure that unauthorized servers sending spoofed messages can be detected, and permits message delivery from legitimate senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.3.2v0.1
+An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.
+
+- Rationale
+ - An adversary may modify the `FROM` field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Publishing an SPF policy for each agency domain mitigates forged `FROM` fields by providing a means for recipients to detect emails spoofed in this way. SPF is required for federal, executive branch, departments and agencies by Binding Operational Directive 18-01, "Enhance Email and Web Security."
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with SPF](https://support.google.com/a/answer/33786#to-do)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.3.1v0.1 Instructions
+Identify any approved senders specific to your agency (see [Identify all email senders for your organization](https://support.google.com/a/answer/10686639#senders) for tips). Additionally, see [Define your SPF record—Basic setup](https://support.google.com/a/answer/10685031) for inclusions required for Google to send email on behalf of your domain.
+
+#### GWS.GMAIL.3.2v0.1 Instructions
+SPF is not configured through the Google Workspace admin center, but rather via DNS records hosted by the agency's domain. Thus, the exact steps needed to set up SPF varies from agency to agency. See [Add your SPF record at your domain provider](https://support.google.com/a/answer/10684623) for more details.
+
+To test your SPF configuration, consider using a web-based tool, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/). Additionally, SPF records can be requested using the command line tool `dig`. For example:
+```
+dig example.com txt
+```
+If SPF is configured, a response resembling `v=spf1 include:_spf.google.com -all` will be returned; though by necessity, the contents of the SPF policy may vary by agency. In this example, the SPF policy indicates the IP addresses listed by the policy for "_spf.google.com" are the only approved senders for "example.com." These IPs can be determined via additional SPF lookups, starting with "_spf.google.com." Ensure the IP addresses listed as approved senders for your domain are those identified for GWS.GMAIL.3.1v0.1. See [Define your SPF record—Advanced setup](https://support.google.com/a/answer/10683907) for a more in-depth discussion of SPF record syntax.
+
+## 4. Domain-based Message Authentication, Reporting, and Conformance
+
+
+Domain-based Message Authentication, Reporting, and Conformance (DMARC) works with SPF and DKIM to authenticate mail senders and ensure that destination email systems can validate messages sent from your domain. DMARC helps receiving mail systems determine what to do with messages sent from your domain that fail SPF or DKIM checks.
+
+### Policies
+
+#### GWS.GMAIL.4.1v0.1
+A DMARC policy SHALL be published for every second-level domain.
+
+- Rationale
+ - Without a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling spoofed emails to reach end users' mailboxes. By publishing DMARC records at the second-level domain, the second-level domains and all subdomains will be protected.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.4.2v0.1
+The DMARC message rejection option SHALL be p=reject.
+
+- Rationale
+ - Of the three policy options (i.e., none, quarantine, and reject), reject provides the strongest protection. Reject is the level of protection required by BOD 18-01 for federal, executive branch, departments and agencies.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1586:002: Compromise Accounts](https://attack.mitre.org/techniques/T1586/)
+ - [T1586:002: Compromise Accounts: Email Accounts](https://attack.mitre.org/techniques/T1586/002/)
+
+#### GWS.GMAIL.4.3v0.1
+The DMARC point of contact for aggregate reports SHALL include `reports@dmarc.cyber.dhs.gov`.
+
+- Rationale
+ - Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including reports@dmarc.cyber.dhs.gov as a point of contact for these reports gives CISA insight into spoofing attempts and is required by Binding Operational Directive 18-01, "Enhance Email and Web Security" for federal, executive branch, departments and agencies.
+- Last Modified: November 13, 2023
+- Note: Only federal, executive branch, departments and agencies should include this email address in their DMARC record.
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.4.4v0.1
+An agency point of contact SHOULD be included for aggregate and failure reports.
+
+- Rationale
+ - Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including an agency point of contact gives the agency insight into attempts to spoof their domains.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Domain-based Message Authentication, Reporting, and Conformance (DMARC) \| RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with DMARC](https://support.google.com/a/answer/2466580)
+
+### Prerequisites
+
+- DKIM or SPF must be enabled
+
+### Implementation
+
+#### GWS.GMAIL.4.1v0.1 Instructions
+DMARC is not configured through the Google Admin Console, but rather via DNS records hosted by the agency's domain(s). As such, implementation varies depending on how an agency manages its DNS records. See [Add your DMARC record](https://support.google.com/a/answer/2466563) for Google guidance.
+
+Note, a DMARC record published at the second-level domain will protect all subdomains. In other words, a DMARC record published for `example.com` will protect both `a.example.com` and `b.example.com`, but a separate record would need to be published for `c.example.gov`.
+
+To test your DMARC configuration, consider using one of many publicly available web-based tools, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/). Additionally, DMARC records can be requested using the command line tool `dig`. For example:
+
+```
+dig _dmarc.example.com txt
+```
+
+If DMARC is configured, a response resembling `v=DMARC1; p=reject; pct=100; rua=mailto:reports@dmarc.cyber.dhs.gov, mailto:reports@example.com; ruf=mailto:reports@example.com` will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to reports@dmarc.cyber.dhs.gov and reports@example.com. Failure reports will be sent to reports@example.com.
+
+#### GWS.GMAIL.4.2v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes `p=reject`.
+
+#### GWS.GMAIL.4.3v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes reports@dmarc.cyber.dhs.gov as one of the emails for the `rua` field.
+
+#### GWS.GMAIL.4.4v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes a point of contact specific to your agency, in addition to reports@dmarc.cyber.dhs.gov, as one of the emails for the `rua` field and one or more agency-defined points of contact for the `ruf` field.
+
+## 5. Attachment Protections
+
+This section enables protections against suspicious attachments and scripts from untrusted senders, to include encrypted attachments, documents with malicious scripts, and attachment file types that are uncommon and/or archaic. Through these attachments malware can be spread. These messages can be kept in the inbox with a warning label (default), moved to spam, or quarantined.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.5.1v0.1
+Protect against encrypted attachments from untrusted senders SHALL be enabled.
+
+- Rationale
+ - Protect users from potentially malicious attachments that are employing obfuscation tactics for payload delivery.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.2v0.1
+Protect against attachments with scripts from untrusted senders SHALL be enabled.
+
+- Rationale
+ - Protect users from downloading and executing potentially malicious attached scripts.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.3v0.1
+Protect against anomalous attachment types in emails SHALL be enabled.
+
+- Rationale
+ - Protect users from attachments identified as anomalous by this control.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.4v0.1
+Google SHOULD be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - Apply the latest recommended attachment protection settings from Google to limit the need for manual configuration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.5.5v0.1
+Emails flagged by the above attachment protection controls SHALL NOT be kept in inbox.
+
+- Rationale
+ - Helps warn users about the risks of opening a suspicious attachment.
+- Last Modified: September 8, 2023
+- Notes
+ - Agencies and Organizations can choose whether to send email to spam or quarantine
+ - Applies to Policies 5.1 - 5.3
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+
+#### GWS.GMAIL.5.6v0.1
+Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum attachment protection functionality provided by Google to maintain a baseline security posture.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Attachment Protections:
+
+#### Policies Group 5 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Attachments**.
+4. Follow implementation for each individual policy
+5. Select **Save**.
+
+#### GWS.GMAIL.5.1v0.1 Instructions
+1. Check the **Protect against encrypted attachments from untrusted senders** checkbox.
+
+#### GWS.GMAIL.5.2v0.1 Instructions
+1. Check the **Protect against attachments with scripts from untrusted senders** checkbox.
+
+#### GWS.GMAIL.5.3v0.1 Instructions
+1Ok. Check the **Protect against anomalous attachment types in emails** checkbox
+
+#### GWS.GMAIL.5.4v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.5.5v0.1 Instructions
+1. Under the setting for Policy 5.1 through Policy 5.3, ensure either "Move email to spam" or "Quarantine" is selected.
+
+
+
+#### GWS.GMAIL.5.6v0.1 Instructions
+1. No implementation steps for this policy
+
+
+## 6. Links and External Images Protection
+
+This section enables extra protections to prevent email phishing due to links and external images. Specific settings for this control include identifying hidden malicious links behind shortened URLs, scanning linked images to find hidden malicious content, showing a warning prompt when clicking links to untrusted domains, and applying future recommended settings automatically.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.6.1v0.1
+Identify links behind shortened URLs SHALL be enabled.
+
+- Rationale
+ - Phishing links are often obfuscated with URL shorteners. By allowing the identification of links that are behind shortened URLs, this control helps users identify malicious links.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+#### GWS.GMAIL.6.2v0.1
+Scan linked images SHALL be enabled.
+
+- Rationale
+ - Scanning linked images provides additional protections for potential malware that may be sent via email through an image.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.6.3v0.1
+Show warning prompt for any click on links to untrusted domains SHALL be enabled.
+
+- Rationale
+ - This will provide awareness to users about the risks associated with clicking an unknown link
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+#### GWS.GMAIL.6.4v0.1
+Google SHALL be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - Apply the latest recommended link and image protection settings from Google to limit the need for manual configuration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.6.5v0.1
+Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google to maintain a baseline security posture.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+- [Google Workspace Admin Help: Set up rules to detect harmful attachments](https://support.google.com/a/answer/7676854?product_name=UnuFlow&hl=en&visit_id=637831464632988595-2408633144&rd=1&src=supportwidget0&hl=en)
+- [Google Workspace Admin Help: Monitor the health of your Gmail settings](https://support.google.com/a/answer/7490901?product_name=UnuFlow&hl=en&visit_id=637831464698491311-452219641&rd=1&src=supportwidget0&hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Links and External Images Protection:
+
+#### Policies Group 6 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Links and external images**.
+4. Follow implementation for each individual policy.
+5. Select **Save**
+
+#### GWS.GMAIL.6.1v0.1 Instructions
+1. Check the **Identify links behind shortened URLs** checkbox.
+
+#### GWS.GMAIL.6.2v0.1 Instructions
+1. Check the **Scan linked images** checkbox.
+
+#### GWS.GMAIL.6.3v0.1 Instructions
+1. Check the **Show warning prompt for any click on links to untrusted domains** checkbox.
+
+#### GWS.GMAIL.6.4v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.6.5v0.1 Instructions
+1. No implementation steps for this policy
+
+
+## 7. Spoofing and Authentication Protection
+
+This control enables extra protections to prevent spoofing of a domain name, employee names, email pretending to be from a specific domain, and unauthenticated email from any domain. These messages can be kept in the inbox with a warning label (default), moved to spam, or quarantined.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.7.1v0.1
+Protect against domain spoofing based on similar domain names SHALL be enabled.
+
+- Rationale
+ - Attackers commonly try to trick users into going to a malicious site by using similar domain names. This policy helps protect the organization and users from this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.2v0.1
+Protect against spoofing of employee names SHALL be enabled.
+
+- Rationale
+ - Attackers will try to phish individuals by spoofing the email/identity of another employee (e.g., CEO and IT staff). Therefore, this provides additional protection against this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.3v0.1
+Protect against inbound emails spoofing your domain SHALL be enabled.
+
+- Rationale
+ - Attackers will try to phish individuals by spoofing the domain name of your organization. This policy provides additional protection against this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.4v0.1
+Protect against any unauthenticated emails SHALL be enabled.
+
+- Rationale
+ - This policy provides extra protection from potentially malicious emails, helping safeguard the organization from data leakage and other malware.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.5v0.1
+Protect your Groups from inbound emails spoofing your domain SHALL be enabled.
+
+- Rationale
+ - This provides protections against phishing attacks using an email address within your domain.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.6v0.1
+Emails flagged by the above spoofing and authentication controls SHALL NOT be kept in inbox.
+
+- Rationale
+ - Emails that fail Gmail's spoofing and authentication checks may pose a significant risk to users. By moving these emails to either spam or quarantine, the risk of a user inadvertently interacting with these emails is reduced.
+- Last Modified: September 8, 2023
+- Notes
+ - Agencies and organizations can choose whether to send to spam or quarantine
+ - This policy applies to Policy 7.1 - Policy 7.5
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+
+#### GWS.GMAIL.7.7v0.1
+Google SHALL be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - This allows automatic application of recommended settings from Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.8v0.1
+Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Spoofing and Authentication Protection:
+
+#### Policies Group 7 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Spoofing and authentication**.
+4. Follow steps for individual policies below.
+5. Select **Save**
+
+#### GWS.GMAIL.7.1v0.1 Instructions
+1. Check the **Protect against domain spoofing based on similar domain names** checkbox.
+
+#### GWS.GMAIL.7.2v0.1 Instructions
+1. Check the **Protect against spoofing of employee names** checkbox.
+
+#### GWS.GMAIL.7.3v0.1 Instructions
+1. Check the **Protect against inbound emails spoofing your domain** checkbox.
+
+#### GWS.GMAIL.7.4v0.1 Instructions
+1. Check the **Protect against any unauthenticated emails** checkbox.
+
+#### GWS.GMAIL.7.5v0.1 Instructions
+1. Check the **Protect your groups from inbound emails spoofing your domain** checkbox.
+
+#### GWS.GMAIL.7.6v0.1 Instructions
+1. Under each setting from Policy 7.1 through Policy 7.5, make sure either "Move email to spam" or "Quarantine" is selected.
+
+
+#### GWS.GMAIL.7.7v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.7.8v0.1 Instructions
+1. There is no implementation for this policy.
+
+
+## 8. User Email Uploads
+
+This section enables users to import their email and contacts from non-Google webmail accounts such as Yahoo!, Hotmail, or AOL.
+
+### Policies
+
+#### GWS.GMAIL.8.1v0.1
+User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment.
+
+- Rationale
+ - This helps ensure that unauthorized files from other webmail providers are not introduced into the secure Gmail environment.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced Gmail settings reference for admins](https://support.google.com/a/answer/2786758#zippy=%2Csetup-settings)
+- [Google Workspace Admin Help: Turn imports from webmail hosts on or off](https://support.google.com/a/answer/2525613?product_name=UnuFlow&hl=en&visit_id=637832286168108072-385761693&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for User Email Uploads:
+
+#### GWS.GMAIL.8.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Setup -\> User email uploads**.
+4. Uncheck the **Show users the option to import mail and contacts from Yahoo!, Hotmail, AOL, or other webmail or POP3 accounts from the Gmail settings page** checkbox.
+5. Select **Save**.
+
+
+## 9. POP and IMAP Access for Users
+
+This section determines whether users have POP3 and IMAP access. Doing so allows the user to access Gmail emails from outside the context of protected/hardened environments and from older versions of Gmail applications or other third-party mail applications.
+
+### Policies
+
+#### GWS.GMAIL.9.1v0.1
+POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.
+
+- Rationale
+ - Disabling POP and IMAP helps prevent use of legacy and unapproved email clients with weaker authentication mechanisms that would increase the risk of email account credential compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+#### GWS.GMAIL.9.2v0.1
+POP and IMAP access MAY be enabled on a per-user and per-application basis as needed.
+
+- Rationale
+ - Depending on organizational needs, there are instances where users and applications may need to use these protocols.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn POP and IMAP on and off for users](https://support.google.com/a/answer/105694?hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for POP and IMAP access:
+
+#### Policies Group 9 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> POP and IMAP access**.
+4. Follow the implementation for each policy.
+5. Select **Save**.
+
+#### GWS.GMAIL.9.1v0.1 Instructions
+1. Uncheck the **Enable IMAP access for all users** checkbox.
+
+#### GWS.GMAIL.9.2v0.1 Instructions
+1. Uncheck the **Enable POP access for all users** checkbox.
+
+
+## 10. Google Workspace Sync
+
+This section determines whether Google Workspace Sync allows data synchronization between Google Workspace and Microsoft Outlook. The data includes email, calendar, and contacts. Data synchronizes each time users start Outlook. This is an additional plugin that must be downloaded.
+
+### Policies
+
+#### GWS.GMAIL.10.1v0.1
+Google Workspace Sync SHOULD be disabled.
+
+- Rationale
+ - Google Workspace Sync could be used as a data exfiltration mechanism if enabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1048:003: Exfilitration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/003/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+#### GWS.GMAIL.10.2v0.1
+Google Workspace Sync MAY be enabled on a per-user basis as needed.
+
+- Rationale
+ - Users may need access to this feature for organizational needs/tasks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1048:003: Exfilitration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/003/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Sync for Microsoft Outlook](https://tools.google.com/dlpage/gssmo)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Google Workspace Sync:
+
+#### Policy Group 10 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Google Workspace Sync**.
+
+#### GWS.GMAIL.10.1v0.1 Instructions
+1. Uncheck the **Enable Google Workspace Sync for Microsoft Outlook for my users** checkbox.
+2. Select **Save**.
+
+#### GWS.GMAIL.10.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+2. Select **Save**.
+
+
+## 11. Automatic Forwarding
+
+This section determines whether emails can be automatically forwarded from a user's inbox to another of their choosing, possibly to external domains.
+
+### Policies
+
+#### GWS.GMAIL.11.1v0.1
+Automatic forwarding SHOULD be disabled, especially to external domains.
+
+- Rationale
+ - In the event that an attacker gains control of an end-user account, they could create automatic forwarding rules to exfiltrate data from your environment.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:003: Email Collection: Email Forwarding Rule](https://attack.mitre.org/techniques/T1114/003/)
+
+### Resources
+- [Google Workspace Admin Help: Disable automatic forwarding](https://support.google.com/a/answer/2491924?hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Automatic Forwarding:
+
+#### GWS.GMAIL.11.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Automatic forwarding**.
+4. Uncheck the **Allow users to automatically forward incoming email to another address** checkbox.
+5. Select **Save**.
+
+
+## 12. Image URL Proxy Allowlists
+
+This section determines whether image URL proxy allowlists can be used within a domain. These lists allow for a set of domains and a path prefix to be specified for a large group of URLs. In doing so, those URLs will be able to bypass proxy protection to keep links to images intact while protecting users and the domain against image-based security vulnerabilities.
+
+### Policies
+
+#### GWS.GMAIL.12.1v0.1
+Image URL proxy allowlists SHOULD be enabled to avoid broken links to images that are dependent on internal IP addresses within an organization's domain.
+
+- Rationale
+ - To avoid attacks based on image-based vulnerabilities as well as preventing broken image links.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set up an image URL proxy whitelist](https://support.google.com/a/answer/3299041?amp;ref_topic=9981578&product_name=UnuFlow&hl=en&ref_topic=9981578&visit_id=637832334308346620-2267967707&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Image URL Proxy Whitelists:
+
+#### GWS.GMAIL.12.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Image URL proxy allowlist**.
+4. In the **Enter image URL patterns** field, enter **image URL proxy whitelist patterns**.
+ 1. A pattern can contain the scheme, the domain, and a path.
+ 2. The pattern must always have a forward slash (/) between the domain and path.
+ 3. If the URL pattern specifies a scheme, then the scheme and the domain must fully match. Otherwise, the domain can partially match the URL suffix.
+ 4. For example, the pattern /google.com matches www.google.com, but not gle.com. The URL pattern can specify a path that's matched against the path prefix.
+5. Select **Save**.
+
+
+## 13. Per-user Outbound Gateways
+
+This section determines whether outgoing mail is delivered only through the Google Workspace mail servers or another specified external SMTP server. With this setting, a user can choose which email address displays in the "From" field.
+
+### Policies
+
+#### GWS.GMAIL.13.1v0.1
+Using a per-user outbound gateway that is a mail server other than the Google Workspace mail servers SHALL be disabled.
+
+- Rationale
+ - Mail sent via external SMTP will circumvent your outbound gateway.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow per-user outbound gateways](https://support.google.com/a/answer/176054?hl=en#zippy=%2Cwhy-youd-disallow-use-of-an-outbound-gateway%2Cwhy-youd-allow-use-of-an-outbound-gateway)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Per-user Outbound Gateways:
+
+#### GWS.GMAIL.13.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Allow per-user outbound gateways**.
+4. Uncheck the **Allow users to send mail through an external SMTP server when configuring a "from" address hosted outside your email domain** checkbox.
+5. Select **Save**.
+
+
+## 14. Unintended External Reply Warning
+
+This section determines whether users are prompted with a warning for messages that include external recipients (users with emails addresses that are outside of your organization). However, the warning is not shown if the external recipient is in the organization's Directory, personal Contacts, or other Contacts; or if a secondary domain or domain alias address is used.
+
+### Policies
+
+#### GWS.GMAIL.14.1v0.1
+Unintended external reply warnings SHALL be enabled to avoid unintentional replies and remind users to treat external messages with caution.
+
+- Rationale
+ - As an admin for your organization, you can turn alerts on or off for messages that include external recipients (people with email addresses outside of your organization). These alerts help people avoid unintentional replies, and remind them to treat external messages with caution.
+- Last Modified: July, 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control Gmail external recipient warnings](https://support.google.com/a/answer/7380041?amp;ref_topic=9974443&product_name=UnuFlow&hl=en&ref_topic=9974443&visit_id=637832389706060412-548862041&rd=1&src=supportwidget0&hl=en)
+- [Capacity Enhancement Guide Counter-Phishing Recommendations for Federal Agencies \| CISA](https://www.cisa.gov/sites/default/files/publications/Capacity_Enhancement_Guide-Counter-Phishing_Recommendations_for_Federal_Agencies.pdf)
+- [Actions to Counter Email-Based Attacks on Election-Related Entities \| CISA](https://www.cisa.gov/sites/default/files/publications/CISA_Insights_Actions_to_Counter_Email-Based_Attacks_on_Election-Related_S508C.pdf)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings to warn users of external recipients:
+
+#### GWS.GMAIL.14.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Warn for external recipients**.
+4. Check the **Highlight any external recipients in a conversation. Warn users before they reply to email with external recipients who aren't in their contacts** checkbox.
+5. Select **Save**.
+
+
+## 15. Email Allowlist
+
+This section determines whether an email allowlist allows for messages from certain IP addresses to not be marked as spam by Gmail. However, if implemented, emails from these senders will bypass important security mechanisms, such as SPF, DKIM, and DMARC.
+
+### Policies
+
+#### GWS.GMAIL.15.1v0.1
+An email allowlist SHOULD not be implemented.
+
+- Rationale
+ - Messages sent from IP addresses on an allowlist bypass important security mechanisms, including spam filtering and sender authentication checks. Avoiding use of email allowlists helps prevent potential threats from circumventing security mechanisms.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.15.2v0.1
+A connection filter policy to create a Blocked Senders list MAY be implemented.
+
+- Rationale
+ - A filter policy to block known malicious senders can help prevent targeted phishing campaigns.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Add IP addresses to allowlists in Gmail](https://support.google.com/a/answer/60751?product_name=UnuFlow&hl=en&visit_id=637832433423162856-2822445044&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Email Allowlists:
+
+#### GWS.GMAIL.15.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Email allowlist**.
+4. Under the **Enter the IP addresses for your email allowlist** field, ensure **no IP addresses** are listed.
+5. Select **Save**.
+
+#### GWS.GMAIL.15.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 16. Enhanced Pre-Delivery Message Scanning
+
+This section determines whether Gmail can screen and identify suspicious content that may be phishing attempts. In doing so, Google can either show a warning or move the email to Spam, but email delivery will experience a short delay due to the additional checks.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.16.1v0.1
+Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing.
+
+- Rationale
+ - As an administrator, you can increase Gmail's ability to identify suspicious content with enhanced pre-delivery message scanning. Typically, when Gmail identifies a possible phishing message, a warning is displayed and the message might be moved to spam.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.16.2v0.1
+Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent phishing with pre-delivery message scanning](https://support.google.com/a/answer/7380368?product_name=UnuFlow&hl=en&visit_id=637835839970922069-4253681586&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Enhanced Pre-Delivery Message Scanning:
+
+#### GWS.GMAIL.16.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Enhanced pre-delivery message scanning**.
+4. Check the **Enables improved detection of suspicious content prior to delivery** checkbox.
+5. Select **Save**.
+
+#### GWS.GMAIL.16.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 17. Security Sandbox
+
+This section determines whether certain messages and their associated attachments are executed in a sandbox environment for protection against malware, ransomware, and zero-day threats. Malicious software may be missed by traditional antivirus programs. However, this may cause some messages to get delayed before final delivery. Some of the file types scanned include Microsoft executables, Microsoft Office, PDF, and archives (zip, rar).
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.17.1v0.1
+Security sandbox SHOULD be enabled to provide additional protections for their email messages.
+
+- Rationale
+ - This allows potentially malicious messages to be quarantined to be analyzed to see if it malicious.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.GMAIL.17.2v0.1
+Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules to detect harmful attachments](https://support.google.com/a/answer/7676854?amp;visit_id=637866938191629894-2885947509&rd=1&product_name=UnuFlow&hl=en&visit_id=637866938191629894-2885947509&rd=2&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Security sandbox or Security sandbox rules:
+
+#### GWS.GMAIL.17.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Security sandbox**.
+4. Check the **Enable virtual execution of attachments in a sandbox environment for all the users of the Organizational Unit for protection against malware, ransomware, and zero-day threats** checkbox.
+5. Either **Security sandbox** or **Security sandbox rules** may be enabled but enabling **Security sandbox** takes precedence.
+6. If **Security sandbox** rules are enabled, then the configuration needs to be completed and consists of the following fields **:**
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions to describe the content to search for in each message.
+ 4. Action to take if expressions match.
+7. Select **Save**.
+
+#### GWS.GMAIL.17.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+
+## 18. Approved Senders List
+
+This section allows for the use of an approved senders list that will bypass the spam folder.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.18.1v0.1
+An Approved Senders List SHOULD be configured to keep legitimate emails out of the spam folder.
+
+- Rationale
+ - Messages approved by the agency will be delivered and not put in spam folder.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.18.2v0.1
+An allowed senders list MAY be added but SHOULD NOT add allowed domains.
+
+- Rationale
+ - Messages approved by the agency will be delivered and not put in spam folder.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.18.3v0.1
+Any third-party or outside application selected for spam approved senders' lists SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.GMAIL.18.4v0.1
+Addresses added to the Allowed Senders List SHALL be set to require authentication.
+
+- Rationale
+ - Authentication of delivered mail provides extra security for the agency.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent spoofing, phishing, and spam](https://support.google.com/a/topic/9061731?hl=en&ref_topic=9202)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Spam Approved Senders Lists:
+
+#### GWS.GMAIL.18.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Spam**.
+4. Select any combination of the following configurations:
+ - Check the **Be more aggressive when filtering spam** checkbox.
+ - Check the **Bypass spam filters for messages received from internal senders** checkbox.
+ - Check the **Bypass spam filters for messages received from addresses or domains within these approved senders' lists** checkbox.
+ - An existing list or new list can be used.
+ - Check the **Put spam in administrative quarantine** checkbox.
+5. Select **Save**.
+
+#### GWS.GMAIL.18.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.18.3v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.18.4v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 19. Blocked Senders List
+
+This section allows use of a blocked senders list that automatically rejects messages from specified addresses or domains.
+
+### Policies
+
+#### GWS.GMAIL.19.1v0.1
+A blocked senders list SHOULD be configured to prevent emails from known malicious sources.
+
+- Rationale
+ - This protects the agency against potential attacks by blocking any known malicious senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.19.2v0.1
+Blocked senders or domains MAY be added to the blocked senders list.
+
+- Rationale
+ - This protects the agency against potential attacks by blocking any known malicious senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent spoofing, phishing, and spam](https://support.google.com/a/topic/9061731?hl=en&ref_topic=9202)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Blocked Senders Lists:
+
+#### GWS.GMAIL.19.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Blocked Senders**.
+4. If the **blocked senders list** is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Addresses or domains that you want to automatically reject messages from.
+ 3. Default rejection notice.
+ 4. Option to bypass this setting for messages received from addresses or domains within these approved senders' lists.
+5. Select **Save**.
+
+#### GWS.GMAIL.19.2v0.1 Instructions
+1. There is no implementation for this policy.
+
+
+## 20. Comprehensive Mail Storage
+
+This section allows for email messages sent through other Google Workspace applications, (i.e., Calendar, Drive, Docs, Sheets, Slides, Drawings, Forms, and Keep) to be stored in the associated users' Gmail mailboxes. This includes a copy of all sent or received messages within a specified domain (including messages sent or received by non-Gmail mailboxes).
+
+### Policies
+
+#### GWS.GMAIL.20.1v0.1
+Comprehensive mail storage SHOULD be enabled to allow tracking of information across applications.
+
+- Rationale
+ - This allows for tracking shared information from emails between GWS applications for traceability and security purposes.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up comprehensive mail storage](https://support.google.com/a/answer/3547347?product_name=UnuFlow&hl=en&visit_id=637835896823763789-338955802&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Comprehensive Mail Storage:
+
+#### GWS.GMAIL.20.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Comprehensive mail storage**.
+4. Check the **Ensure that a copy of all sent and received mail is stored in associated users' mailboxes** checkbox.
+5. Select **Save**.
+
+
+## 21. Content Compliance Filtering
+
+This section determines whether Gmail content is filtered based upon specified expressions, such as keyword, strings or patterns, and metadata. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.21.1v0.1
+Content filtering SHOULD be enabled within Gmail messages.
+
+- Rationale
+ - Protects the agency against malicious content from entering the agencies systems.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+
+#### GWS.GMAIL.21.2v0.1
+Any third-party or outside application selected for advanced email content filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.21.3v0.1
+Gmail or third-party applications SHALL be configured to protect PII and sensitive information as defined by the agency. At a minimum, credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) SHALL be blocked.
+
+- Rationale
+ - This helps protect against PII data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules for advanced email content filtering](https://support.google.com/a/answer/1346934?hl=en&ref_topic=9974692)
+- [Personally identifiable information (PII) \| NIST](https://csrc.nist.gov/glossary/term/personally_identifiable_information#:~:text=NISTIR%208259,2%20under%20PII%20from%20EGovAct)
+- [Sensitive information \| NIST](https://csrc.nist.gov/glossary/term/sensitive_information)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Objectionable content:
+
+#### GWS.GMAIL.21.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Content Compliance**.
+4. If **Content compliance** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions for content to search for in messages.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.21.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+#### GWS.GMAIL.21.3v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+
+## 22. Objectionable Content Filtering
+
+This section determines whether Gmail content is filtered based upon word lists, for example, obscenities or "confidential" words. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.22.1v0.1
+Word lists SHOULD be enabled to filter objectionable content within Gmail messages.
+
+- Rationale
+ - This helps ensure that confidential/sensitive information can be filtered from Gmail messages to help ensure there is no unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1595: Active Scanning](https://attack.mitre.org/techniques/T1595/)
+ - [T1595:003: Active Scanning: Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003/)
+
+#### GWS.GMAIL.22.2v0.1
+Any third-party or outside application selected for objectionable content filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules for objectionable content](https://support.google.com/a/answer/1346936?hl=en)
+- [Personally identifiable information (PII) \| NIST](https://csrc.nist.gov/glossary/term/personally_identifiable_information#:~:text=NISTIR%208259,2%20under%20PII%20from%20EGovAct)
+- [Sensitive information \| NIST](https://csrc.nist.gov/glossary/term/sensitive_information)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for objectionable content:
+
+#### GWS.GMAIL.22.1v0.1 Instructions
+1. Sign into the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Objectionable content**.
+4. If **Objectionable content** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Custom objectionable words.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.22.2v0.1 Instructions
+1. This has no implementation steps for this policy.
+
+
+## 23. Attachment Compliance Filtering
+
+This section determines whether attachments are filtered based on file type, file name, and message size. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.23.1v0.1
+Attachment compliance SHOULD be enabled to filter specific attachments within Gmail messages.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.2v0.1
+The attachment filter SHOULD attempt to determine the true file type and assess the file extension.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.3v0.1
+The set of disallowed file types SHALL be determined.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing. This also helps protect the organization from attacks based on specific file types.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.4v0.1
+Any third-party or outside application selected for attachment compliance filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Content filtering with rules](https://support.google.com/a/topic/9974692?hl=en&ref_topic=2683824)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Attachment Compliance:
+
+#### GWS.GMAIL.23.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Attachment compliance**.
+4. If **Attachment compliance** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions for content to search for in messages.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.23.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.23.3v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.23.4v0.1 Instructions
+1. There is no implementation steps for this policy
diff --git a/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..e04b853d
--- /dev/null
+++ b/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,268 @@
+# CISA Google Workspace Security Configuration Baseline for Google Calendar
+
+Google Calendar is a calendar service in Google Workspace used for creating and editing events that enables collaboration amongst users. Calendar allows administrators to control and manage their sharing settings for both internal and external use. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Calendar security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing) and addresses the following:
+
+- [External Sharing Options for Primary Calendars](#1-external-sharing-options-for-primary-calendars)
+- [External Invitations Warnings](#2-external-invitations-warnings)
+- [External Sharing Options for Secondary Calendars](#3-external-sharing-options-for-secondary-calendars)
+- [Calendar Interop Management](#4-calendar-interop-management)
+- [Paid Appointments](#5-paid-appointments)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. External Sharing Options for Primary Calendars
+
+This section determines what information is shared from primary calendars with external entities.
+
+### Policies
+
+#### GWS.CALENDAR.1.1v0.1
+External Sharing Options for Primary Calendars SHALL be configured to "Only free/busy information (hide event details)" to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CALENDAR.1.2v0.1
+External sharing options for primary calendars between multiple components within an organization MAY be configured.
+
+- Rationale
+ - Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External Sharing in Primary Calendar:
+
+#### GWS.CALENDAR.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Calendar**.
+3. Select **Sharing settings** -\> **External sharing options for primary calendars**.
+4. Select **Only free/busy information (hide event details)**.
+5. Select **Save**.
+
+#### GWS.CALENDAR.1.2v0.1 Instructions
+1. There is no implementation for this policy
+
+## 2. External Invitations Warnings
+
+This section determines whether users are warned when inviting one or more guests from outside of their domain.
+
+### Policies
+
+#### GWS.CALENDAR.2.1v0.1
+External invitations warnings SHALL be enabled to prompt users before sending invitations.
+
+- Rationale
+ - When your users create a Google Calendar event that includes one or more guests from outside of your domain, they are prompted to confirm whether it's OK to include external guests in the event invitation, assisting in the prevention of unintentional data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow external invitations in Google Calendar events](https://support.google.com/a/answer/6329284?product_name=UnuFlow&visit_id=637836623092961849-291754447&rd=1&src=supportwidget0)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.2.1v0.1 Instructions
+
+To configure the settings for Confidential Mode:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Calendar**.
+3. Select **Sharing settings** -\> **External Invitations**.
+4. Check the **Warn users when inviting guests outside of the domain** checkbox.
+5. Select **Save**.
+
+## 3. External Sharing Options for Secondary Calendars
+
+This section determines what information is shared from secondary calendars with external entities.
+
+### Policies
+
+#### GWS.CALENDAR.3.1v0.1
+External sharing options for secondary calendars SHALL be configured to "Only free/busy information (hide event details)" to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CALENDAR.3.2v0.1
+
+External sharing options for secondary calendars between multiple components within an organization MAY be configured.
+
+- Rationale
+ - Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+#### GWS.CALENDAR.3.1v0.1 Instructions
+
+To configure the settings for External Sharing in secondary calendars:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **General settings -\> External sharing options for secondary calendars**.
+4. Select **Only free/busy information (hide event details)**.
+5. Select **Save**.
+
+#### GWS.CALENDAR.3.2v0.1 Instructions
+
+1. There is no implementation for this policy
+
+## 4. Calendar Interop Management
+
+This section determines whether Microsoft Exchange and Google Calendar can be configured to work together to allow users in both systems to share their availability status so they can view each other's schedules. The availability and event information that will be shared between Exchange and Calendar include availability for users, group or team calendars, and calendar resources (such as meeting rooms). Calendar Interop respects event-level privacy settings from either Exchange or Calendar.
+
+Due to the added complexity and attack surface associated with configuring Calendar Interop, it should be disabled in environments for which this capability is not necessary for agency mission fulfillment.
+
+### Policies
+
+#### GWS.CALENDAR.4.1v0.1
+Calendar Interop SHOULD be disabled unless agency mission fulfillment requires collaboration between users internal and external to an organization who use both Microsoft Exchange and Google Calendar.
+
+- Rationale
+ - Prevent information exchange between Microsoft and Google calendars for users using both services, unless it is required by the organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+#### GWS.CALENDAR.4.2v0.1
+OAuth 2.0 SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment.
+
+- Rationale
+ - When required by organizational requirements, for user's to exchange information between Google and Microsoft calendars, users will be authenticated using OAuth 2.0 to prevent unauthorized access.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1555: Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/)
+
+### Resources
+
+- [Google Workspace Admin Help: About Calendar Interop](https://support.google.com/a/answer/7444958?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.4.1v0.1 Instructions
+
+To configure the settings for Calendar Interop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Calendar Interop management**.
+4. Uncheck the **Enable Interoperability for Calendar** checkbox.
+5. Select **Save**.
+
+#### GWS.CALENDAR.4.2v0.1 Instructions
+
+To configure the settings for Calendar Interop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Calendar Interop management**.
+4. Select **OAuth 2.0 client credentials**
+5. Select **Save**.
+
+## 5. Paid Appointments
+
+This section covers whether or not the paid appointment booking feature is enabled.
+
+### Policies
+
+#### GWS.CALENDAR.5.1v0.1
+Appointment Schedule with Payments SHALL be disabled.
+
+- Rationale
+ - This helps avoid unnecessary interconnectivity with third-party services that can create a greater chance of additional vulnerabilities in the platform.
+ - There is no obvious need for agencies to have this feature enabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Help: Allow paid appointment schedules in Calendar](https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F13765946&assistant_id=generic-unu&product_context=13765946&product_name=UnuFlow&trigger_context=a)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.5.1v0.1 Instructions
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Advanced Settings -\> Appointment schedules with payments**
+4. Select **OFF- Blocks users' from adding required payments to their Calendar appointment schedules**
+5. Select **Save**
diff --git a/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..73612d37
--- /dev/null
+++ b/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,302 @@
+# CISA Google Workspace Security Configuration Baseline for Google Chat
+
+Google Chat is a communication and collaboration tool in Google Workspace that supports direct messaging, group conversations, and content creation and sharing. Chat allows administrators to control and manage their messages and files. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Chat security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Google Chat settings](https://support.google.com/a/answer/9540647?hl=en) and addresses the following:
+
+- [Chat History](#1-chat-history)
+- [External File Sharing](#2-external-file-sharing)
+- [History for Spaces](#3-history-for-spaces)
+- [External Chat Messaging](#4-external-chat-messaging)
+- [Installation of Chat Apps](#5-installation-of-chat-apps)
+- [DLP Rules](#6-dlp-rules)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Chat History
+
+This section covers chat history retention for users within the organization and prevents users from changing their history setting. This control applies to both direct messages and group messages.
+
+### Policies
+
+#### GWS.CHAT.1.1v0.1
+Chat history SHOULD be enabled for information traceability.
+
+- Rationale
+ - Helps ensure there is a record of chats sent to receive in the case that it needs to be reviewed in the future for legal or compliance issues.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+#### GWS.CHAT.1.2v0.1
+Users SHALL NOT be allowed to change their history setting.
+
+- Rationale
+ - This setting helps prevent changes by the user.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn chat history on or off for users](https://support.google.com/a/answer/7664184)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for History for chats:
+
+#### GWS.CHAT.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **History for chats**.
+4. Select **History is ON**.
+5. Select **Save**
+
+#### GWS.CHAT.1.2v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Uncheck the **Allow users to change their history setting** checkbox.
+4. Select **Save**.
+
+## 2. External File Sharing
+
+This section covers what types of files users are allowed to share external to their organization.
+
+### Policies
+
+#### GWS.CHAT.2.1v0.1
+External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing.
+
+- Rationale
+ - Protects against unintentional or intentional data leakage from the agency or organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfilitration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control file sharing in Chat](https://support.google.com/a/answer/10277783?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External filesharing:
+
+#### GWS.CHAT.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **Chat File Sharing**.
+4. In the **External filesharing** dropdown menu, select **No files.**
+5. Select **Save**.
+
+## 3. History for Spaces
+
+This section covers whether chat history is retained by default for users within the organization. This control does not apply for threaded chat spaces because those require that history be on, which cannot be changed. Chat spaces allow for multiple users to share files, assign tasks, and stay connected.
+
+### Policies
+
+#### GWS.CHAT.3.1v0.1
+Space history SHOULD be enabled for traceability of information.
+
+- Rationale
+ - This provides the ability to trace history when needed from an organizational level.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set a space history option for users](https://support.google.com/a/answer/9948515?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for History for spaces:
+
+#### GWS.CHAT.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **History for spaces**.
+4. Select **History is ON by default** or **History is ALWAYS ON**.
+5. Select **Save**.
+
+## 4. External Chat Messaging
+
+This section permits users to send Chat messages outside of their organization, but such Chat messages must be restricted to allowlisted domains only.
+
+### Policies
+
+#### GWS.CHAT.4.1v0.1
+External Chat messaging SHALL be restricted to allowlisted domains only.
+
+- Rationale
+ - Protects the organization from external risks and helps prevent data leakage outside the organization.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CHAT.4.2v0.1
+Only allow this for allowlisted domains SHALL be enabled.
+
+- Rationale
+ - This limits the security vulnerabilities present with allowing chatting outside of organization.
+- Last Modified: August 1, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set external chat options](https://support.google.com/a/answer/9269229?product_name=UnuFlow&visit_id=637841711304802210-4105703050&rd=1&src=supportwidget0)
+- [Google Workspace Admin Help: Allow external sharing with only trusted domains](https://support.google.com/a/answer/6160020)
+- [CIS Google Workspace Benchmark v1.1.0 - 3.1.4.2.2 Ensure Google Chat Externally is Restricted to Allowlisted Domains](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External Chat:
+
+#### Policy Group 4 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **External Chat Settings** -\> **Chat externally**.
+
+#### GWS.CHAT.4.1v0.1 Instructions
+1. Select **ON**.
+2. Select **Save**.
+
+#### GWS.CHAT.4.2v0.1 Instructions
+1. Select **Only allow this for allowlisted domains**
+2. To add allowlisted domains select **Manage allowlisted domains**
+3. Select **Save**.
+
+## 5. Installation of Chat Apps
+
+This section covers preventing ordinary users from being able to install Chat apps.
+
+### Policies
+
+#### GWS.CHAT.5.1v0.1
+User-level ability to install Chat apps SHALL be disabled.
+
+- Rationale
+ - Protects against security risks associated with installing chat apps such as phishing, spyware, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195:002: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow users to install Chat apps](https://support.google.com/a/answer/7651360?product_name=UnuFlow&hl=en&visit_id=637916846359382524-3147840186&rd=1&src=supportwidget0&hl=en#zippy=%2Cstep-add-marketplace-apps-to-your-allowlist-optional%2Cstep-decide-what-apps-users-can-install%2Cstep-let-users-install-apps-in-chat)
+- GWS Common Controls Minimum Viable Secure Configuration Baseline
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Chat apps:
+
+#### GWS.CHAT.5.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **Chat apps** -\> **Chat apps access settings**.
+4. Select **OFF** for **Allow users to install Chat apps**.
+5. Select **SAVE**.
+
+## 6. DLP rules
+
+This recommendation applies only to agencies that allow external sharing (see section 2.1).
+
+Using data loss prevention (DLP), organizations can create and apply rules to control the content that users can share in files outside the organization. DLP gives you control over what users can share and prevents unintended exposure of sensitive information.
+
+DLP rules can use predefined content detectors to match PII (e.g., SSN), credentials (e.g., API keys), or specific document types (e.g., source code). Custom rules can also be applied based upon regex match or document labels.
+
+### Policies
+
+#### GWS.CHAT.6.1v0.1
+Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.
+
+- Rationale
+ - Data Loss Prevention (DLP) rules trigger scans of files to look for sensitive content and restrict sharing of documents that may contain sensitive content. Configuring DLP rules helps agencies protect their information, by determining what data and/or phrasing might be sensitive, and restricting the dissemination of the documents containing that data. Examples include PII, PHI, portion markings, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfilitration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1213: Data from Information Repositories](https://attack.mitre.org/techniques/T1213/)
+ - [T1213:001: Data from Information Repositories:Confluence](https://attack.mitre.org/techniques/T1213/001/)
+ - [T1213:002: Data from Information Repositories:Sharepoint](https://attack.mitre.org/techniques/T1213/002/)
+
+### Resources
+
+- [How to use predefined content detectors - Google Workspace Admin Help](https://support.google.com/a/answer/7047475#zippy=%2Cunited-states)
+- [Get started as a Drive labels admin - Google Workspace Admin Help](https://support.google.com/a/answer/9292382?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CHAT.6.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu -\> Security -\> Access and data control -\> Data protection**.
+3. Click **Manage Rules**. Then click **Add rule** -\> **New rule** or click **Add rule** -\> **New rule from template**. For templates, select a template from the Templates page.
+4. In the **Name** section, add the name and description of the rule.
+5. In the **Scope** section, apply this rule only to the entire domain or to selected organizational units or groups, and click **Continue**. If there's a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
+6. In the **Apps** section, choose the trigger for **Google Chat, Message Sent or File Upload**, and click **Continue**.
+7. In the **Conditions** section, click **Add Condition**.
+8. Configure appropriate content definition(s) based upon the agency's individual requirements and click **Continue**.
+9. Select the appropriate action to warn or block sharing, based upon the agency's individual requirements.
+10. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
+11. Review the rule details, mark the rule as **Active**, and click **Create.**
diff --git a/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..0b932c77
--- /dev/null
+++ b/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,192 @@
+# CISA Google Workspace Security Configuration Baseline for Google Classroom
+
+Google Classroom is a service to streamline assignments, boost collaboration, and foster communication. This service allows for the creation of classes, creating and grading assignments, student collaboration, communication with teachers and students, and integration with other Google products.
+
+Google Classroom is designed and intended for implementation for Education Institutions. Google Classroom is available with the Google Workspace for Education Edition, and is included with all tiers of GWS for Education including Fundamentals, Standard, and Plus. CISA's Secure Configuration Baseline Classroom policies and guidance are written to the Plus edition.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Classroom](https://support.google.com/edu/classroom/?hl=en#topic=10298088) and addresses the following:
+
+- [Class Membership](#1-class-membership)
+- [Classroom API](#2-classroom-api)
+- [Roster Import](#3-roster-import)
+- [Student Unenrollment](#4-student-unenrollment)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Class Membership
+
+This section covers who has the ability to join classes and what classes the users in your domain can join.
+
+### Policy
+
+#### GWS.CLASSROOM.1.1v0.1
+Who can join classes in your domain SHALL be set to Users in your domain only.
+
+- Rationale
+ - Allowing users to join from outside your domain creates the potential for an unauthorized data leak.
+- Last Modified: September 27, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.CLASSROOM.1.2v0.1
+Which classes users in your domain can join SHALL be set to Classes in your domain only.
+
+- Rationale
+ - Joining a class from outside your domain could allow for data to be exfiltrated to entities outside the control of the organization creating a significant security risk.
+- Last Modified: September 27, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+### Resources
+- [Google Workspace Admin Help: Control User Access to Classroom](https://support.google.com/edu/classroom/answer/6023715)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Class Membership:
+
+#### Policy Group 1 Common Implementation:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Class Settings**.
+4. Select **About Class Membership**.
+
+#### GWS.CLASSROOM.1.1v0.1 Instructions
+1. For Who can join classes in your domain, select **Users in your domain only**.
+2. Select **Save**.
+
+#### GWS.CLASSROOM.1.2v0.1 Instructions
+1. For Who can join classes in your domain, select **Classes in your domain only**.
+2. Select **Save**.
+
+## 2. Classroom API
+
+This section covers policies related to the Google Classroom API.
+
+### Policy
+
+#### GWS.CLASSROOM.2.1v0.1
+Users SHALL NOT be able to authorize apps to access their Google Classroom data.
+
+- Rationale
+ - Allowing ordinary users to authorize apps to access to classroom data opens a possibility for data loss. Only admins should be allowed to authorize apps.
+- Last Modified: September 28, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Classroom data access](https://support.google.com/edu/classroom/answer/6250906?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Classroom API:
+
+#### GWS.CLASSROOM.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Data Access**.
+4. Uncheck **Users can authorize apps to access their Google Classroom data**.
+5. Select **Save**.
+
+## 3. Roster Import
+
+This section covers policies related to importing rosters from Clever.
+
+### Policy
+
+#### GWS.CLASSROOM.3.1v0.1
+Roster import with Clever SHOULD be turned off.
+
+- Rationale
+ - If your organization does not use Clever, allowing roster import could create a way to for data to be inputted into the organization's environment which allows from unauthorized data in the system. In addition, it could allow for unauthorized data leak as well.
+- Last Modified: September 28, 2023
+- Note:
+ - Only to be set to on if your organization uses Clever
+
+- MITRE ATT&CK TTP Mapping
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+ - [T1048: Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Get Started with SIS Roster Import](https://support.google.com/edu/classroom/answer/10495270?visit_id=638337540290677144-1371568967&p=sis_overview&rd=1)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Roster Import:
+
+#### GWS.CLASSROOM.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Roster Import**.
+4. Select **OFF**.
+5. Select **Save**.
+
+## 4. Student Unenrollment
+
+This section covers policies related to unenrolling a student from a class.
+
+### Policy
+
+#### GWS.CLASSROOM.4.1v0.1
+Only teachers SHALL be allowed to unenroll students from classes.
+
+- Rationale
+ - Only allowing teachers to unenroll students helps ensure that there is no potential for unintentional data loss or inconsistency between Google and Clever, if applicable.
+- Last Modified: September 28, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control Student Unenrollment Settings](https://support.google.com/edu/classroom/answer/11189334?visit_id=638326465630147042-2696822563&p=student_unenrollment&rd=1)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Student Unenrollment:
+
+#### GWS.CLASSROOM.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Student unenrollment**.
+4. Select **Teachers Only**.
+5. Select **Save**.
diff --git a/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..0adc74e4
--- /dev/null
+++ b/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,484 @@
+# CISA Google Workspace Secure Configuration Baseline for Google Drive and Docs
+
+Google Drive and Docs are collaboration tools in Google Workspace that support document management and storage, access, and sharing of files. Drive and Docs allow administrators to control and manage their files and documents. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Drive and Docs security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Overview: Manage Drive for an organization](https://support.google.com/a/answer/2490026?hl=en) and addresses the following:
+
+- [Sharing Outside the Organization](#1-sharing-outside-the-organization)
+- [Shared Drive Creation](#2-shared-drive-creation)
+- [Security Updates for Files](#3-security-updates-for-files)
+- [Drive SDK](#4-drive-sdk)
+- [User Installation of Drive and Docs Add-Ons](#5-user-installation-of-drive-and-docs-add-ons)
+- [Drive for Desktop](#6-drive-for-desktop)
+- [DLP Rules](#7-dlp-rules)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Sharing Outside the Organization
+
+This section covers whether users can share files outside of the organization, whether Google checks a shared file to ensure that recipients have access, and which users have permission to distribute content outside of the organization to include uploading or moving content to shared drives owned by another organization. These files include Google Docs, Sheets, Slides, My Maps, folders, and anything else stored in Drive.
+
+### Policies
+
+#### GWS.DRIVEDOCS.1.1v0.1
+Agencies SHOULD disable sharing outside of the organization's domain.
+
+- Rationale
+ - To have the tightest control over access to documents created within the organization, agencies should disable sharing from outside the organization. Disabling external sharing will block any collaboration from outside the organization and will prevent disseminating documents outside the organization.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy restricts information sharing
+ - This policy prevents data leakage outside of the organization
+ - If this policy is enforced, then follow Policy 1.2
+ - If this policy is not enforced, then follow Policies 1.3 and 1.4
+ - Regardless, policies 1.5 through 1.8 must be followed
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.2v0.1
+If disabling sharing outside of the organization's domain, then agencies SHOULD also disable users' receiving files from outside of the organization's domain.
+
+- Rationale
+ - If the agency decides that external sharing should be disabled, users should not be able to receive files from outside the organization as well. Disabling external sharing ensures that all communication stays within the organization, which helps mitigate risk from malicious files from an external source.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if sharing outside was disabled in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.3v0.1
+Warnings SHOULD be enabled when a user is attempting to share something outside the domain.
+
+- Rationale
+ - In the case that a user is going to share something outside the domain, a warning should be given. The warning ensures that the user is aware that they are sharing something externally, and doing so purposefully.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if external sharing was allowed in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.4v0.1
+If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account.
+
+- Rationale
+ - To ensure that all shared documents are secured, and that agencies are able to control dissemination of the files, agencies shall only share files with individuals using a google account.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if external sharing is allowed in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.5v0.1
+Agencies SHALL disable making files and published web content visible to anyone with the link.
+
+- Rationale
+ - We want to ensure that only approved individuals are able to access and view the document. If content was visible to anyone with a link, that link could be forwarded to anyone, and agencies would no longer have control over who can view the specific document. By disabling file access to anyone with a link, agencies and individuals will have tighter control over who can view files and published web content.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.6v0.1
+Agencies SHALL enable access checking for file sharing outside of Docs or Drive.
+
+- Rationale
+ - Enabling access checking for sharing files outside of Drive/Docs helps ensure that the documents are shared with approved individuals, organizations, or external domains only.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.7v0.1
+Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organizations.
+
+- Rationale
+ - To control access to content owned by the organization, users should not be able to distribute content to a shared drive owned by another organization. Once a document is moved outside the organization's drives, it no longer has control over the dissemination of the document. By not allowing users to distribute content to external shared drives, the organization maintains more control over the document.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.8v0.1
+Agencies SHALL set newly created items to have Private to the Owner as the default level of access.
+
+- Rationale
+ - All newly created items should default to private. Any sharing of the document needs to be explicitly applied by the owner of the document.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+ - [T1538: Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Drive users' sharing permissions](https://support.google.com/a/answer/60781?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Sharing options:
+
+#### Policy Group 1 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Drive and Docs**.
+4. Follow implementation for each individual policy
+5. Select **Save**
+
+#### GWS.DRIVEDOCS.1.1v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Sharing outside of your domain** -\> **OFF – Files owned by users in your domain cannot be shared outside of your domain**
+
+#### GWS.DRIVEDOCS.1.2v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **Allow users to receive files from users or shared drives outside of the organization**
+
+#### GWS.DRIVEDOCS.1.3v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Warn when files owned by users or shared drives in your organization are shared outside of your organization.**
+
+#### GWS.DRIVEDOCS.1.4v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **Allow users or shared drives in your organization to share items with people outside of your organization who aren't using a Google account.**
+
+#### GWS.DRIVEDOCS.1.5v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **When sharing outside of your organization is allowed, users in your organization can make files and published web content visible to anyone with the link.**
+
+#### GWS.DRIVEDOCS.1.6v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Access Checker** -\> **Recipients only, or suggested target audience.**
+
+#### GWS.DRIVEDOCS.1.7v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Distributing content outside of your domain** -\> **Only users in your organization.**
+
+#### GWS.DRIVEDOCS.1.8v0.1 Instructions
+1. Select **Sharing settings -\> General access default.**
+2. Select **When users in your organization create items, the default access will be -\> Private to the owner.**
+
+## 2. Shared Drive Creation
+
+This section covers whether users can create new shared drives to share with other users, including those external to their organization. Even if users cannot create new shared drives, they can still be added to shared drives owned by other users. This control also determines which users, both internal and external to the organization, can access files in shared drives.
+
+### Policies
+
+#### GWS.DRIVEDOCS.2.1v0.1
+Agencies SHOULD enable shared drive creation to allow for effective collaboration.
+
+- Rationale
+ - Disabling shared drives would make collaboration difficult. Shared drives allow users in the organization to work together on one or multiple documents concurrently.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.2v0.1
+Agencies SHOULD NOT allow members with manager access to override shared drive creation settings.
+
+- Rationale
+ - The settings outlined in the SCBs should not be able to be overwritten by anyone, even those with manager access. Not allowing anyone to change shared drive creation settings ensures that security best practices are being followed.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.3v0.1
+Agencies SHOULD NOT allow users outside of their organization to access files in shared drives.
+
+- Rationale
+ - To control access to documents within the organization, agencies should not allow users outside the organization to access files in shared drives. Blocking external access to shared drives helps prevent documents shared within the organization from being shared outside the organization without explicit knowledge and approvals.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.4v0.1
+Agencies SHALL allow users who are not shared drive members to be added to files.
+
+- Rationale
+ - When users who are not shared drive members are not allowed to be added to file, administrators would need to add them as drive members in order to facilitate access which would provide access to all files within the drive, not just the file intended to be shared.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.5v0.1
+Agencies SHALL NOT allow viewers and commenters to download, print, and copy files.
+
+- Rationale
+ - All existing access control settings are circumvented once a file is downloaded and taken out of the GWS tenant which creates the possibility for data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+- [Google Workspace Admin Help: Set Drive users' sharing permissions](https://support.google.com/a/answer/60781?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Shared drive creation:
+
+##### Policy Group 2 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Drive and Docs**.
+3. Select **Sharing settings -\> Shared drive creation**.
+4. Follow the implementation for each individual policy.
+5. Select **Save**
+
+#### GWS.DRIVEDOCS.2.1v0.1 Instructions
+1. Uncheck the **Prevent users in organization from creating new shared drives** checkbox.
+
+#### GWS.DRIVEDOCS.2.2v0.1 Instructions
+1. Uncheck the **Allow members with manager access to override the settings below** checkbox.
+
+#### GWS.DRIVEDOCS.2.3v0.1 Instructions
+1. Uncheck the **Allow users outside organization to access files in shared drives** checkbox.
+
+#### GWS.DRIVEDOCS.2.4v0.1 Instructions
+1. Check the **Allow people who aren't shared drive members to be added to files** checkbox.
+
+#### GWS.DRIVEDOCS.2.5v0.1 Instructions
+1. Check the **Allow viewers and commenters to download, print, and copy files** checkbox.
+
+## 3. Security Updates for Files
+
+This section covers whether a security update issued by Google will be applied to make file links more secure. When sharing files using a link, users must not remove the resource key parameter, as doing so may result in unexpected file access requests.
+
+### Policies
+
+#### GWS.DRIVEDOCS.3.1v0.1
+Agencies SHALL enable security updates for Drive files.
+
+- Rationale
+ - Allowing security updates to be applied to all affected files will help keep the GWS tenant secure from potential security risks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Security update for Google Drive](https://support.google.com/drive/answer/10729743?hl=en#zippy=%2Care-any-file-types-not-impacted%2Cwhat-happens-if-i-dont-apply-the-security-update-to-my-files%2Chow-will-this-security-update-change-access-to-my-impacted-files)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Security update for files:
+
+##### GWS.DRIVEDOCS.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Sharing settings -\> Security update for files.**
+4. Select **Apply security update to all impacted files.**
+5. Uncheck the **Allow users to remove/apply the security update for files they own or manage** checkbox.
+6. Select **Save**.
+
+## 4. Drive SDK
+
+This section covers whether users have access to Google Drive with the Drive SDK API, which allows third party applications to work on the files that are stored in Google Drive. The Drive SDK API is used by developers to access Google Drive through third party applications that they have created.
+
+### Policies
+
+#### GWS.DRIVEDOCS.4.1v0.1
+Agencies SHOULD disable Drive SDK access to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - The Drive SDK allows third-party external applications to access data and files from within Drive. Disabling the Drive SDK prevents third party applications from accessing the files and data from within the organization, which protects against data leakage and unintentional information sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+### Resources
+
+- [Google Drive for Developers](https://developers.google.com/drive/)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Drive SDK:
+
+#### GWS.DRIVEDOCS.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Features and Applications -\> Drive SDK.**
+4. Uncheck the **Allow users to access Google Drive with the Drive SDK API** checkbox.
+5. Select **Save**.
+
+## 5. User Installation of Drive and Docs Add-Ons
+
+This section covers whether users can use add-ons in file editors within Google Drive, such as Docs, Sheets, Slides, and Forms. These add-ons include those available through Google Workspace Marketplace that have been built by other developers.
+
+### Policies
+
+#### GWS.DRIVEDOCS.5.1v0.1
+Agencies SHALL disable Add-Ons with the exception of those that are approved within the organization.
+
+- Rationale
+ - Google Docs Add-Ons can pose a great security risk based on the permissions the add-on is given. Add-ons can be given full access to the google drive, permission to add or edit existing documents, share documents, connect to external services, and more. Any add-on needs to be fully vetted before given access to the google workspace. Therefore, unapproved add-ons need to be disabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow or restrict add-ons in Docs editors](https://support.google.com/a/answer/4530135?product_name=UnuFlow&visit_id=637843582622955886-2417503403&rd=1&src=supportwidget0)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for add-ons:
+
+#### GWS.DRIVEDOCS.5.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Features and Applications -\> Add-Ons.**
+4. Uncheck the **Allow users to install Google Docs add-ons from add-ons stor**e checkbox.
+5. Select **Save**.
+
+## 6. Drive for Desktop
+
+This section covers that Google Drive for Desktop, if not disabled entirely, should only be allowed on authorized devices.
+
+### Policies
+
+#### GWS.DRIVEDOCS.6.1v0.1
+Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.
+
+- Rationale
+ - Saving directly to the cloud reduces the risk of potentially losing data, which is beneficial when dealing with sensitive information and when trying to retain certain files.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Use Google Drive for desktop - Google Drive Help](https://support.google.com/drive/answer/10838124?sjid=7721208110884477761-NA&visit_id=638192503824884459-786860809&rd=1)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.DRIVEDOCS.6.1v0.1 Instructions
+To Disable Google Drive for Desktop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu-\>Apps-\>Google Workspace-\>Drive and Docs-\>Google Drive for Desktop**.
+3. Uncheck the **Allow Google Drive for desktop in your organization box** checkbox or
+4. Ensure **Allow Google Drive for desktop in your organization box** and **Only allow Google Drive for desktop on authorized devices** is checked.
+4. Select **Save.**
+
+To limit Google Drive for Desktop to authorized devices:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select Menu-\>Apps-\>Google Workspace-\>Drive and Docs-\>Features and Applications.
+3. Uncheck the Allow Google Drive for desktop in your organization checkbox.
+4. Check the Only allow Google Drive for desktop on authorized devices checkbox.
+5. Ensure authorized devices are added to [company-owned inventory](https://support.google.com/a/answer/7129612?hl=en).
+6. Select Save.
+
+Alternatively, [Context-Aware access policies](https://support.google.com/a/answer/9275380?hl=en) can be configured for more granular controls around authorized devices. The access level applied to Google Drive must have the "Apply to Google desktop and mobile apps" enabled to meet this requirement. For additional guidance, see the *Common Controls Minimum Viable Secure Baseline*, section "Context-Aware Access for All Devices that Connect to GWS SHOULD be Implemented."
+
+## 7. DLP rules
+
+This recommendation applies only to agencies that allow external sharing (see [Sharing Outside the Organization](#1-sharing-outside-the-organization)).
+
+Using data loss prevention (DLP), you can create and apply rules to control the content that users can share in files outside the organization. DLP gives you control over what users can share and prevents unintended exposure of sensitive information.
+
+DLP rules can use predefined content detectors to match PII (e.g., SSN), credentials (e.g., API keys), or specific document types (e.g., source code). Custom rules can also be applied based upon regex match or document labels.
+
+### Policies
+
+#### GWS.DRIVEDOCS.7.1v0.1
+Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.
+
+- Rationale
+ - Data Loss Prevention (DLP) rules trigger scans of files to look for sensitive content and restrict sharing of documents that may contain sensitive content. Configuring DLP rules helps agencies protect their information, by determining what data and/or phrasing might be sensitive, and restricting the dissemination of the documents containing that data. Examples include PII, PHI, portion markings, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [How to use predefined content detectors - Google Workspace Admin Help](https://support.google.com/a/answer/7047475#zippy=%2Cunited-states)
+- [Get started as a Drive labels admin - Google Workspace Admin Help](https://support.google.com/a/answer/9292382?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.DRIVEDOCS.7.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu -\> Security -\> Access and data control -\> Data protection**.
+3. Click **Manage Rules**. Then click **Add rule** -\> **New rule** or click **Add rule** -\> **New rule from template**. For templates, select a template from the Templates page.
+4. In the **Name** section, add the name and description of the rule.
+5. In the **Scope** section, apply this rule only to the entire domain or to selected organizational units or groups, and click **Continue**. If there's a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
+6. In the **Apps** section, choose the trigger for **Google Drive, File created, modified, uploaded or shared**, and click **Continue**.
+7. In the **Conditions** section, click **Add Condition**.
+8. Configure appropriate content definition(s) based upon the agency's individual requirements and click **Continue**.
+9. Select the appropriate action to warn or block sharing, based upon the agency's individual requirements.
+10. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
+11. Review the rule details, mark the rule as **Active**, and click **Create.**
diff --git a/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..ec5a9f06
--- /dev/null
+++ b/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,191 @@
+# CISA Google Workspace Security Configuration Baseline for Google Meet
+
+Google Meet is a video conferencing service in Google Workspace that supports real-time video, desktop, and presentation sharing. Meet allows administrators to control and manage their video meetings. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Meet security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected) and addresses the following:
+
+- [Meeting Access](#1-meeting-access)
+- [Internal Access to External Meetings](#2-internal-access-to-external-meetings)
+- [Host Management Meeting Features](#3-host-management-meeting-features)
+- [External Participants](#4-external-participants)
+
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Meeting Access
+
+This control limits safe meeting access to users with a Google Account or Dialing in using a phone.
+
+### Policies
+
+#### GWS.MEET.1.1v0.1
+Meeting access SHALL be restricted to users signed in with a Google Account or Dialing in using a phone.
+
+- Rationale
+ - This protects against unauthorized access to a Google meeting and helps ensures the user has been authenticated prior to joining.
+- Last Modified: June 29, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Domain Meet safety settings:
+
+#### GWS.MEET.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Domain**.
+4. Select **Only users from your organization or users dialing in using a phone** or **Users signed in with a Google account or dialing in using a phone**.
+5. Select **Save**.
+
+
+## 2. Internal Access to External Meetings
+
+This control determines which meetings users within the agency's organization can join.
+
+### Policies
+
+#### GWS.MEET.2.1v0.1
+Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace tenant or organization.
+
+- Rationale
+ - This helps ensure that organization members are not able to join meetings created externally to avoid potential data leakage or other security risks.
+- Last Modified: September 26, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Access within Meet safety settings:
+
+#### GWS.MEET.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Access**.
+4. Select **Meetings created in your organization only** or **Meetings created in any Workspace organization**.
+5. Select **Save**.
+
+## 3. Host Management Meeting Features
+
+This control enables the following features for a host to implement during their meeting: prevent participants from sharing their screen, turn chat messages on or off, end the meeting for all, and mute all. By default, this control is disabled.
+
+Note: When this feature is not enabled, any attendee that is a member of the host's organization can record the meeting.
+
+### Policies
+
+#### GWS.MEET.3.1v0.1
+Host Management meeting features SHALL be enabled so that they are available by default when a host starts their meeting.
+
+- Rationale
+ - Enabling these features does not pose any security risk and provides better collaboration features to users. If this setting was disabled then any participant could take control of the meeting.
+- Last Modified: July 3, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562:001: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+- [Record a Video Meeting](https://support.google.com/meet/answer/9308681?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To enable Host Management meeting features:
+
+#### GWS.MEET.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Host management**.
+4. Check the **Start video calls with host management turned on** checkbox.
+5. Select **Save**.
+
+## 4. External Participants
+
+This control provides a warning label for any participating a meeting who is not a member of the organization or whose identity is unconfirmed.
+
+### Policies
+
+#### GWS.MEET.4.1v0.1
+Warn for external participants SHALL be enabled.
+
+- Rationale
+ - When enabled, external or unidentified participants in a meeting are given a label. This increases situational awareness amongst meeting participants and can help prevent inadvertent data leakage.
+- Last Modified: September 26, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Manage Meet settings (for admins)](https://support.google.com/a/answer/7304109?fl=1&sjid=1761497708922707326-NA)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To enable Host Management meeting features:
+
+#### GWS.MEET.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Warn for external participants**.
+4. Check the **External or unidentified participants in a meeting are given a label** checkbox.
+5. Select **Save**.
diff --git a/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..3888482e
--- /dev/null
+++ b/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,66 @@
+# CISA Google Workspace Security Configuration Baseline for Google Sites
+
+Google Sites is a collaborative tool in Google Workspace that supports the creation of websites (i.e., internal project hubs, team sites, and public-facing websites) without the need of a designer, programmer, or IT help. Sites allow administrators to control and manage their files and documents. Google Drive manages sharing and publishing settings for new Sites. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Sites security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Sites](https://support.google.com/a/topic/6385920?hl=en&ref_topic=9197) and addresses the following:
+
+- [Sites Service Status](#1-sites-service-status)
+
+Google is currently transitioning from classic Sites to new Sites, [Google Workspace Admin Help: Transition from classic Sites to new Sites](https://support.google.com/a/answer/9958187?hl=en&ref_topic=25684#zippy=%2Cstarting-july-previously-january-classic-sites-transition%2Cstarting-june-previously-december-editing-of-remaining-classic-sites-will-be-disabled). Starting December 1, 2022, classic Sites will no longer be editable. And starting January 1, 2023, classic Sites will no longer be viewable unless converted to new Google Sites. All remaining classic Sites will be automatically archived as HTML files, saved to the site owner's Google Drive, and replaced with a draft in new Sites to be reviewed and published.
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Sites Service Status
+
+This section covers whether users are able to access Google Sites.
+
+### Policy
+
+#### GWS.SITES.1.1v0.1
+Sites Service SHOULD be disabled for all users.
+
+- Rationale
+ - This helps to minimize attack surface. Not every user within an organization needs access to Google Sites. If this capability is needed, it can be enabled and configured for those users based on user's assigned organizational unit (OU) and by exception as required by the organization to meet specific needs.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1526: Cloud Service Discovery](https://attack.mitre.org/techniques/T1526/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Manage users' access in Sites](https://support.google.com/a/answer/6399230?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Site creation and editing:
+
+#### GWS.SITES.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Sites**.
+3. Select **Service Status**
+4. Select **OFF for everyone**.
+5. Select **Save**.
diff --git a/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..504e5455
--- /dev/null
+++ b/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,305 @@
+# CISA Google Workspace Security Configuration Baseline for Groups for Business
+
+Groups for Business is a Google Workspace collaboration tool that supports storage, access, and sharing of files, document management, and email. Groups for Business allows administrators to control and manage collaboration efforts among groups within their organizations. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Groups security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Set up and manage Groups for Business](https://support.google.com/a/topic/9400092?hl=en&ref_topic=25838) and addresses the following:
+
+- [External Group Access](#1-external-group-access)
+- [Adding External Members](#2-adding-external-members)
+- [Allowing Posting by External Members](#3-allowing-posting-by-external-members)
+- [Group Creation](#4-group-creation)
+- [Default Permissions for Viewing Conversations](#5-default-permissions-for-viewing-conversations)
+- [Ability to Hide Groups from the Directory](#6-ability-to-hide-groups-from-the-directory)
+- [New Groups](#7-new-groups)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+
+# Baseline Policies
+
+## 1. External Group Access
+
+This control determines whether users outside of an agency's organization can view, search for, or post to groups internal to an agency.
+
+Note: Even with this setting configured, group owners can still explicitly add external POCs to a group ([Adding External Members](#2-adding-external-members)), or explicitly allow posting to a group by an external POC who has not been added to said group ([Allowing Posting by External Members](#3-allowing-posting-by-external-members)).
+
+### Baseline Policies
+
+#### GWS.GROUPS.1.1v0.1
+Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner.
+
+- Rationale
+ - Who can externally view groups internal to the organization should be carefully controlled and their access vetted as needed.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.1.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Accessing groups from outside this organization** -\> **Private**.
+5. Select **Save**.
+
+## 2. Adding External Members
+
+This section covers whether or not the owner of the group has the ability to add external members to the group.
+
+### Policies
+
+#### GWS.GROUPS.2.1v0.1
+Group owners' ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment.
+
+- Rationale
+ - The ability to add external members should be left to the organization/agency to protect the agency from potential data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.2.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can allow external members** checkbox.
+5. Select **Save**.
+
+## 3. Allowing Posting by External Members
+
+This section covers whether or not an owner of a group has the ability to allow an external non-member to post to the group.
+
+### Policies
+
+#### GWS.GROUPS.3.1v0.1
+Group owners' ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment.
+
+- Rationale
+ - External member posting would create unnecessary security risks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.3.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can allow incoming mail from outside the organization** checkbox.
+5. Select **Save**.
+
+## 4. Group Creation
+
+This section covers who has the ability to create a new group within the organization.
+
+### Policies
+
+#### GWS.GROUPS.4.1v0.1
+Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment.
+
+- Rationale
+ - The organization should have some control over the organizational groups created and the purpose they are for.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1069: Permission Groups Discovery](https://attack.mitre.org/techniques/T1069/)
+ - [T1069:003: Permission Groups Discovery: Cloud Groups](https://attack.mitre.org/techniques/T1069/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.4.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Creating groups** -\> **Only organization admins can create groups**.
+5. Select **Save**.
+
+## 5. Default Permissions for Viewing Conversations
+
+This section covers the default permissions assigned to the viewing of conversations within a group.
+
+### Policies
+
+#### GWS.GROUPS.5.1v0.1
+The default permission to view conversations SHOULD be set to All Group Members.
+
+- Rationale
+ - Conversation viewing by default should be restricted as a security best practice but can be expanded by exception for certain groups on a need-to-know basis.
+- Last Modified: July 10, 2023
+- Note: This setting can be changed by group owners and group managers.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.5.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Default for permission to view conversations** -\> **All group members**.
+5. Select **Save**.
+
+## 6. Ability to Hide Groups from the Directory
+
+This section covers whether or not the owner of a group can hide the group from the directory.
+
+### Policies
+
+#### GWS.GROUPS.6.1v0.1
+The Ability for Groups to be Hidden from the Directory SHALL be disabled.
+
+- Rationale
+ - Provide group visibility at the directory level to help reduce the potential for undetected data exfiltration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.6.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can hide groups from the directory** checkbox.
+5. **Ensure** that the **hide newly created groups from the directory** checkbox is not selected.
+6. Select **Save**.
+
+## 7. New Groups
+
+This section covers the access type setting for new groups that are created.
+
+### Policies
+
+#### GWS.GROUPS.7.1v0.1
+New Groups SHOULD be created with an Access type of Restricted unless necessary for agency mission fulfillment.
+
+- Rationale
+ - This helps protect against unauthorized access to groups
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1069: Permission Groups Discovery](https://attack.mitre.org/techniques/T1069/)
+ - [T1069:003: Permission Groups Discovery: Cloud Groups](https://attack.mitre.org/techniques/T1069/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Create a group in your organization](https://github.com/mitre/CISA-SCuBA-GWS-SCB)
+
+### Prerequisites
+
+- This control only applies to agencies with Google Groups for Business enabled.
+
+### Implementation
+
+#### GWS.GROUPS.7.1v0.1 Instructions
+To configure Access type for a Google Group:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Directory** -\> **Groups.**
+3. Select **Create group.**
+4. Fill in the details for the new group and click **Next.**
+5. In the **Access type** section, select the **Restricted** radio button.
+6. If the group needs to receive messages from non-members, select the appropriate checkboxes in the **Who can post** row.
+7. Select **Next.**
+8. Select **Create Group.**
diff --git a/download_opa.py b/download_opa.py
new file mode 100644
index 00000000..ff6cb45e
--- /dev/null
+++ b/download_opa.py
@@ -0,0 +1,216 @@
+'''
+This is script used to download OPA executables of varied versions and operating systems.
+
+Run python download_opa.py -h to see arguments
+
+Minimum OPA version supported: 0.42.2
+'''
+import urllib.request
+import hashlib
+import argparse
+import ssl
+
+OPA_VERSION_SHA256_HASHES = {
+ '0.42.2': {
+ 'windows': '2200de1f85e21a6566c9d2bd341af1d4dfc410baae0c2ec692a35135eef12bbb',
+ 'macos': '03a14125ef038c8e8c71925316044f5d144c5cf6daa82724a1dae07258972459',
+ 'linux': '2b59001ef6657281863e1719783f6204c16f0d8ec53de5854d2549451bdf1dc0'
+ },
+ '0.43.1': {
+ 'windows': 'a9a859e24e79ff942792c7ae6aa71ac89d86159393dd486df9bfd954c27004ff',
+ 'macos': '2c68fb04ae4908b1dd315c24ab282a1e46ca16cc83c52e7b6862bc06aa01b8b5',
+ 'linux': 'daf578c643654c17e97da8a33d9b9c3cad56804d6eca5dc65a011fbefc7f7b67'
+ },
+ '0.44.0': {
+ 'windows': 'e8179cf589e5dceb684fafcc3444506f776b8ba61e01da495c2a70410e3cdf3f',
+ 'macos': 'b51b26865c0a99d021f173ca34172440485024d77d0fa69f0110365474d5841c',
+ 'linux': '5ddb21d3fcfca130a47a42e730c05f055c68af6c1b37465879f6c59b10527eae'
+ },
+ '0.45.0': {
+ 'windows': '31b12b954900584e8aa9103235adf192dd4c92e0039416eaec7d84e2f66fcf3e',
+ 'macos': '1d76713a65c11771bd86fe44d8ace17d79f1660e5bb00219d4f3c9b0f966f6e5',
+ 'linux': 'fb17d142d05c371e668440b414e41ccffc90c1e3d8f4984cf0c08e64fdd99a03'
+ },
+ '0.46.3': {
+ 'windows': '7ce4b97f2718a0af9f3796d36c12c4d12196e778ddf8b49679263a14c918150f',
+ 'macos': 'd1f2a921a45863ab1e98a5af012d107a3b3a280ba34fbb3a83bdce249d1ecece',
+ 'linux': '6c9c5294518d2be672a57fd8e1701405d0ebd7691ace3114b3c123331885d383'
+ },
+ '0.47.4': {
+ 'windows': '1f4285c743949b9c52ec644334ea315972fa4a200b5239c4ed1932ee6968e20d',
+ 'macos': 'b84ccf9608706e1496051442c866f5b755684033b6913eaab1870f9baadfd69e',
+ 'linux': '563f8f8146dbcccb22d8f98968c180db51fc8c9d3c2a1290ad93959859945886'
+ },
+ '0.48.0': {
+ 'windows': 'e27c533ca9c9a7a44064f879bcfccd327a95d6c84002f0d422137ffe62bd493f',
+ 'macos': '1554312fe5376ed8c34aa6404b85a1d3722971e7d5b8950f1888e62821ab73e3',
+ 'linux': 'ba2dcf3e0902f1c2da46679e30c5ceb2abefd6a1d5aa4bf3839426317dc28b7f'
+ },
+ '0.49.2': {
+ 'windows': 'de3f5406783f7e2cd98251e0801fb7184acc5ee6c2618748b88d68c3c6cec521',
+ 'macos': 'bcb69f7b01a70b7c1fd1d165142e0329c1e746bcfdf1cf2590613aa90f49557f',
+ 'linux': '40ed9de929162b13caf7b2d064f4c653c12a1a8cd15b80627cfb8d8fef5a4fc0'
+ },
+ '0.50.2': {
+ 'windows': '6c88953e54f4b5b2bd5189740a4718a61065c8f4b79df845a20c5ae5d150e8e5',
+ 'macos': '3d3c4ba4da7697606b1784ffa74a528902edb76726648f1de0539c83393e0250',
+ 'linux': '5697d0260cc7da8f15be195e61a2025907f3149a1dd5f84e0003ed9e9dea4970'
+ },
+ '0.51.0': {
+ 'windows': '34be29ebbcf256dc87f00ce91792e53edbf5ab631e31b14b8b712b70c50921da',
+ 'macos': '6b7c30eed9204409bc240091da560199343d731f3ed90947a19152d471621cfb',
+ 'linux': '9aef4d16e07f4169d22068c21a2d3559d193fee439364992e0f45fc3745ac5fd'
+ },
+ '0.52.0': {
+ 'windows': '6f0a952ebd0fd544bf27a13686a0f3494e9be102654a58996bedfe3bcc6f61ab',
+ 'macos': 'f40c0f2d4f864b09e30a30bb66ae3d1610405927176caffa12531aaf80dcbd53',
+ 'linux': 'a3ff21f3b16632d3868e49bdb52f6affbd97ec382d5310d1bbbe7627e8e5c8f6'
+ },
+ '0.53.1': {
+ 'windows': '3b8c30bb7a2df3f9f5e89dfbc1a963fb2aca2c646b8f697dd9fb95efd36b1b40',
+ 'macos': '73a76e498c1f9ec0442787efa056599fc11845301e4e3f03f436be6c31c3f7aa',
+ 'linux': '54e58abab85d125038152476f7c7987d352ca314c5e49e1f10d8e6800e6f6bef'
+ },
+ '0.54.0': {
+ 'windows': '25284b69e1dd7feaa17446e49b1085b61dca0b496dc868304153eb64b422c7eb',
+ 'macos': 'a33e829306cd2210ed743da7f4f957588ea350a184bb6ecbb7cbfd77ae7ca401',
+ 'linux': '633829141f8d6706ac24e0b84393d7730a975a17cc4a15790bf7fad959a28ec3'
+ },
+ '0.55.0': {
+ 'windows': '23b4300fc0e9a9af7c5cf6f955e91e3dd34edfe6b40e2ffca480f892f0538101',
+ 'macos': '4513f3bbb07c5915a7b5b70c951012327f9c1b6491b1ebab98d83149528599db',
+ 'linux': '388af161328871b943306f1ba7948658810a9fcf9c3c0a27bdfac6e8086617a9'
+ },
+ '0.56.0': {
+ 'windows': '8b2aab7e968245b178c2480e4843ad8d0b6551283306a9ce155545b2f72782db',
+ 'macos': 'f46e1a37bf6e3ad98523bd12ad51fe3b9f1ea660dfb3e9131ae1c84eece6dd57',
+ 'linux': '623771025227588898af1788998d5b5f29068a887682cd8b8e9699136d4cf121'
+ },
+ '0.57.1': {
+ 'windows': '9a6d3ef2279760efbcead6a7095393e04adaa1be3c7458eb62a2b79d93df4bc3',
+ 'macos': '54a2d229638baddb0ac6f7c283295e547e6f491ab2ddcaf714fa182427e8421d',
+ 'linux': '59e8c6ef9ae2f95b76aa79344eb81ca6f3950a0fd7a23534c4d7065f42fda99f'
+ },
+ '0.58.0': {
+ 'windows': 'da61c5745c545b64047efe6c5a730f38f63dfa1d07c29e1f1297fe235a28ddd7',
+ 'macos': 'c9b11f32e2adcb0783275be0f1ee69c2d78b3496b4992d64a3f41f4f3f678685',
+ 'linux': '7bb75b14c9bcb5798d42bed5fc45c438ee5bb783894733ce553ba3445f66034f'
+ }
+}
+
+def download_file(url, filename, disablessl):
+ '''
+ Downloads a file from the given url
+
+ :param url: The url we are downloading the file from
+ :param filename: The name of the output file
+ '''
+
+ # pylint: disable=protected-access
+ context = ssl._create_unverified_context() if disablessl else None
+
+ with urllib.request.urlopen(url, context=context) as response:
+ file_size = int(response.headers["Content-Length"])
+ downloaded_size = 0
+ block_size = 1024 # 1 KB
+ mb_size = 1024 * 1024
+
+
+ file_size_mb = file_size / mb_size
+ with open(filename, 'wb') as file:
+ while True:
+ buffer = response.read(block_size)
+ if not buffer:
+ break
+
+ file.write(buffer)
+ downloaded_size += len(buffer)
+ downloaded_size_mb = downloaded_size / mb_size
+ print(f'Download Progress: \
+ {downloaded_size_mb:.2f}/{file_size_mb:.2f} MB' , end='\r')
+
+ print(f"\nDownload is complete. OPA executable is named: {filename}")
+
+
+def verify_hash(filename, expected_hash):
+ '''
+ Checks if the SHA256 Hash of a file matches an expected SHA256 Hash
+
+ :param filename: The file we're hashing
+ :param expected_hash: The SHA256 hash we're expecting the file to hash to
+ '''
+ sha256 = hashlib.sha256()
+ with open(filename, 'rb') as file:
+ while True:
+ data = file.read(65536)
+ if not data:
+ break
+ sha256.update(data)
+ file_hash = sha256.hexdigest()
+ return file_hash == expected_hash
+
+def main():
+ '''
+ Takes in user arguments for downloading an OPA executable
+ '''
+ supported_opa_versions = list(OPA_VERSION_SHA256_HASHES)
+ parser = argparse.ArgumentParser(add_help = True,
+ description="Download executable the OPA executable" \
+ " file required to run this SCuBA tool.")
+ parser.add_argument('-v', default='0.57.1', choices=supported_opa_versions,
+ help='What version of OPA to download: Default version: 0.57.1')
+ parser.add_argument('-os', default='windows', choices=['windows', 'macos', 'linux'],
+ help='Operating system version of OPA to download. Default os: windows')
+ parser.add_argument('--disablessl', action='store_true',
+ help='If there are proxy errors,\
+ try adding this switch to disable ssl verification')
+
+ args = parser.parse_args()
+ base_url = 'https://openpolicyagent.org/downloads/'
+ base_url = base_url + "v" + args.v + "/"
+ filename_base = 'opa'
+
+ if args.os == 'windows':
+ url = base_url + 'opa_windows_amd64.exe'
+ filename = filename_base + '_windows_amd64.exe'
+ elif args.os == 'macos':
+ url = base_url + 'opa_darwin_amd64'
+ filename = filename_base + '_darwin_amd64'
+ elif args.os == 'linux':
+ url = base_url + 'opa_linux_amd64_static'
+ filename = filename_base + '_linux_amd64_static'
+ else:
+ print('Invalid operating system. Please provide a valid OS (windows, macos, or linux)')
+
+ try:
+ expected_hash = OPA_VERSION_SHA256_HASHES[args.v][args.os]
+ except Exception as exc:
+ print("Untested OPA version the download will continue but hash verification will fail."\
+ "Proceed with caution", exc)
+ expected_hash = 'thisShallFail'
+
+ try:
+ print(f"Downloading OPA executable version {args.v} for {args.os}",)
+ download_file(url, filename, args.disablessl)
+ except Exception as exc:
+ print("An exception occurred while trying to download the OPA executable. " \
+ "This may be due to a proxy error." \
+ "Please retry or see the README for how to manually download OPA", exc)
+
+ try:
+ print('Verifying SHA256 hash...')
+ if verify_hash(filename, expected_hash):
+ print("File hash verified successfully." \
+ " You are ready to start running this SCuBA Tool with OPA")
+ else:
+ print("File hash verification failed." \
+ "The downloaded file may be corrupted or " \
+ "has not been verified by us. " \
+ "See instructions for downloading OPA manually if you verify the file is corrupted. " \
+ "Proceed with caution.")
+ except Exception as exc:
+ print("An exception occurred while trying to verify OPA hash." \
+ "The file may be corrupted or currently not supported.", exc)
+
+if __name__ == '__main__':
+ main()
diff --git a/drift-rules/GWS Drift Monitoring Rules - Calendar.csv b/drift-rules/GWS Drift Monitoring Rules - Calendar.csv
new file mode 100644
index 00000000..9ecb93c6
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Calendar.csv
@@ -0,0 +1,9 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CALENDAR.1.1v0.1,"External Sharing Options for Primary Calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs1clzmpm,JK 07-28-23 @ 12:08
+GWS.CALENDAR.1.2v0.1,External sharing options for primary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.CALENDAR.2.1v0.1,External invitations warnings SHALL be enabled to prompt users before sending invitations.,Admin Log Event,Change Calendar Setting,ENABLE_EXTERNAL_GUEST_PROMPT,true,rules/00gjdgxs26jpj72,JK 07-28-23 @ 12:20
+GWS.CALENDAR.3.1v0.1,"External sharing options for secondary calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs3ob14fv,JK 07-28-23 @ 12:32
+GWS.CALENDAR.3.2v0.1,External sharing options for secondary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.CALENDAR.4.1v0.1,Calendar Interop SHOULD be disabled unless agency mission fulfillment requires collaboration between users internal and external to an organization who use both Microsoft Exchange and Google Calendar.,Admin Log Event,Change Calendar Setting,ENABLE_EWS_INTEROP,false,rules/00gjdgxs3yipjmt,JK 07-28-23 @ 14:42
+GWS.CALENDAR.4.2v0.1,OAuth 2.0 SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment.,N/A,N/A,N/A,N/A,N/A,"Not able to create rule due to bug in rule wizard. Applicable log event exists, but is not selectable within rule wizard."
+GWS.CALENDAR.5.1v0.1,Appointment Schedule with Payments SHALL be disabled.,Admin Log Event,Change Application Setting,CalendarAppointmentSlotAdminSettingsProto payments_enabled,false,rules/00gjdgxs3oppjwl,JK 09-08-23 @ 10:47
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Chat.csv b/drift-rules/GWS Drift Monitoring Rules - Chat.csv
new file mode 100644
index 00000000..e603f8e4
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Chat.csv
@@ -0,0 +1,11 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CHAT.1.1v0.1,Chat history SHOULD be enabled for information traceability.,Admin Log Event,Change Application Setting,DynamiteOTRSettingsProto off_the_record_state,ALWAYS_ON_THE_RECORD,rules/00gjdgxs1svgvm3,JK 08-01-23 @ 06:36
+GWS.CHAT.1.2v0.1,Users SHALL NOT be allowed to change their history setting.,Admin Log Event,Change Application Setting,DynamiteOTRSettingsProto off_the_record_state,ALWAYS_ON_THE_RECORD,rules/00gjdgxs18ozqwd,JK 08-01-23 @ 06:51
+GWS.CHAT.2.1v0.1,External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing.,Admin Log Event,Change Application Setting,DynamiteFileSharingSettingsProto external_file_sharing_setting,NO_FILES,rules/00gjdgxs2l93fr0,JK 08-01-23 @ 07:01
+GWS.CHAT.3.1v0.1,Space history SHOULD be enabled for traceability of information.,Admin Log Event,Change Application Setting,RoomOtrSettingsProto otr_state,"ALWAYS_ON_THE_RECORD
+OR
+DEFAULT_ON_THE_RECORD",rules/00gjdgxs13kc3ei,JK 08-01-23 @ 11:58
+GWS.CHAT.4.1v0.1,"Allow users to send messages outside of Domain SHALL be set to ""On""",Admin Log Event,Change Application Setting,RestrictChatProto restrictChatToOrganization,false,rules/00gjdgxs3vz76ij,JK 08-01-23 @ 13:17
+GWS.CHAT.4.2v0.1,Only allow this for allowlisted domains SHALL be enabled.,Admin Log Event,Change Application Setting,RestrictChatProto externalChatRestriction,TRUSTED_DOMAINS,rules/00gjdgxs3exvv2u,JK 08-01-23 @ 13:27
+GWS.CHAT.5.1v0.1,User-level ability to install Chat apps SHALL be disabled.,Admin Log Event,Change Application Setting,Chat app Settings - Chat apps enabled,false,rules/00gjdgxs2g5w3mm,JK 08-01-23 @ 10:27
+GWS.CHAT.6.1v0.1,Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.,N/A,N/A,N/A,N/A,N/A,Not Alertable
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Classroom.csv b/drift-rules/GWS Drift Monitoring Rules - Classroom.csv
new file mode 100644
index 00000000..71cc6a79
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Classroom.csv
@@ -0,0 +1,6 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CLASSROOM.1.1v0.1,Who can join classes in your domain SHALL be set to Users in your domain only,Admin Log Events,Change Application Setting,ClassMembershipSettingProto who_can_join_classes,1,rules/00gjdgxs1c0jzhh,JK 10-20-23 @ 13:18
+GWS.CLASSROOM.1.2v0.1,Which classes can users in your domain join SHALL be set to Classes in your domain only,Admin Log Events,Change Application Setting,ClassMembershipSettingProto which_classes_can_users_join,1,rules/00gjdgxs0hj2dit,JK 10-20-23 @ 13:23
+GWS.CLASSROOM.2.1v0.1,Classroom API SHALL be disabled for users,Admin Log Events,Change Application Setting,ApiDataAccessSettingProto api_access_enabled,false,rules/00gjdgxs3aafl8p,JK 10-20-23 @ 13:31
+GWS.CLASSROOM.3.1v0.1,Roster import with Clever SHOULD be turned off,Admin Log Events,Change Application Setting,RosterImportSettingsProto sis_integrator,SIS_INTEGRATOR_NONE,rules/00gjdgxs25t0l8g,JK 10-20-23 @ 13:42
+GWS.CLASSROOM.4.1v0.1,Who can unenroll students from classes SHALL be set to Teachers Only,Admin Log Events,Change Application Setting,StudentUnenrollmentSettingsProto who_can_unenroll_students,ONLY_TEACHERS_CAN_UNENROLL_STUDENTS,rules/00gjdgxs44rgreu,JK 10-20-23 @ 13:50
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv b/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv
new file mode 100644
index 00000000..2134f716
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv
@@ -0,0 +1,42 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.COMMONCONTROLS.1.1v0.1,Phishing-Resistant MFA SHALL be required for all users.,Admin Log Event,Enforce 2-Step Verification,No Setting Name,true,rules/00gjdgxs3twm54g,JK 08-02-23 @ 06:51
+GWS.COMMONCONTROLS.1.2v0.1,New user enrollment period SHALL be set to 1 week.,Admin Log Event,Change 2-Step Verification Enrollment Period Duration,No Setting Name,1 week,rules/00gjdgxs19shvvu,JK 08-02-23 @ 07:04
+GWS.COMMONCONTROLS.1.3v0.1,Allow users to trust the device SHALL be disabled.,Admin Log Event,Change 2-Step Verification Frequency,No Setting Name,ENABLE_USERS_TO_TRUST_DEVICE,rules/00gjdgxs15t2155,JK 08-02-23 @ 07:10
+GWS.COMMONCONTROLS.1.4v0.1,"If phishing-resistant MFA is not yet tenable, an MFA method from the following list SHALL be used in the interim.",Admin Log Event,Change Allowed 2-Step Verification Methods,No Setting Name,NO_TELEPHONY,rules/00gjdgxs3t3ug07,JK 08-02-23 @ 14:53
+GWS.COMMONCONTROLS.2.1v0.1,Policies restricting access to GWS based on signals about enterprise devices SHOULD be implemented.,Admin Log Event,Context Aware Access Enablement,No Setting Name,ENABLED,rules/00gjdgxs1qrcqvm,JK 08-02-23 @ 07:49
+GWS.COMMONCONTROLS.2.2v0.1,"Use of context-aware access for more granular controls, including using Advanced Mode (CEL), MAY be maximized and tailored if necessary.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.3.1v0.1,Login Challenges SHALL be enabled when third party SAML SSO is in use.,Admin Log Event,Change Application Setting,SsoPolicyProto challenge_selection_behavior,PERFORM_CHALLENGE_SELECTION,rules/00gjdgxs0o76pk2,JK 08-02-23 @ 07:59
+GWS.COMMONCONTROLS.4.1v0.1,Users SHALL be forced to re-authenticate after an established 12-hour GWS login session has expired.,Admin Log Event,Change Application Setting,Session management settings - Session length in seconds,43200,rules/00gjdgxs1j87x46,JK 08-02-23 @ 08:11
+GWS.COMMONCONTROLS.5.1v0.1,User password strength SHALL be enforced.,Admin Log Event,Change Application Setting,Password Management - Enforce strong password,on,rules/00gjdgxs2rh5fry,JK 08-02-23 @ 08:21
+GWS.COMMONCONTROLS.5.2v0.1,User password length SHALL be at least 12 characters.,Admin Log Event,Change Application Setting,Password Management - Minimum password length,12,rules/00gjdgxs0ogcs3x,JK 08-02-23 @ 08:51
+GWS.COMMONCONTROLS.5.3v0.1,Password policy SHALL be enforced at next sign-in.,Admin Log Event,Change Application Setting,Password Management - Enforce password policy at next login,true,rules/00gjdgxs0p7tza1,JK 08-02-23 @ 09:00
+GWS.COMMONCONTROLS.5.4v0.1,User passwords SHALL NOT be reused.,Admin Log Event,Change Application Setting,Password Management - Enable password reuse,false,rules/00gjdgxs0tbqklj,JK 08-02-23 @ 09:05
+GWS.COMMONCONTROLS.5.5v0.1,User passwords SHALL NOT expire.,Admin Log Event,Change Application Setting,Password Management - Password reset frequency,0,rules/00gjdgxs1k1llys,JK 08-02-23 @ 09:09
+GWS.COMMONCONTROLS.6.1v0.1,"Agencies SHALL ensure that all accounts with highly privileged roles are separate administrative accounts, distinct from the ordinary day to day accounts of those personnel.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.6.2v0.1,All highly privileged accounts SHALL leverage Google Account authentication with phishing-resistant MFA and not the agency’s authoritative on-premises or federated identity system.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.7.1v0.1,A minimum of two and maximum of four separate and distinct Super Admin users SHALL be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.8.1v0.1,Account conflict management SHALL be configured to replace conflicting unmanaged accounts with managed ones.,N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log event being produced
+GWS.COMMONCONTROLS.9.1v0.1,"A second, “break-glass” Super Admin account SHALL be created and physically secured for each individual Super Admin user to mitigate account access issues resulting from catastrophic credential loss or compromise.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.9.2v0.1,"Account self-recovery for Super Admins SHALL be disabled, forcing Super Admin users who have lost their login credentials to contact another Super Admin to recover their account.",Admin Log Event,Change Application Setting,AdminAccountRecoverySettingsProto Enable admin account recovery,false,rules/00gjdgxs2rlm6cr,JK 08-02-23 @ 09:16
+GWS.COMMONCONTROLS.9.3v0.1,“Break-glass” account credentials SHALL be used only if all Super Admins have lost their credentials.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.9.4v0.1,A geographically separate and secure location SHOULD be planned and implemented to store “break-glass” account credentials for Super Admins.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.10.1v0.1,Highly privileged accounts SHALL be enrolled in the GWS Advanced Protection Program.,Admin Log Event,Change Application Setting,Advanced Protection Program Settings - Enable user enrollment,true,rules/00gjdgxs2mq8dv5,JK 08-02-23 @ 09:20
+GWS.COMMONCONTROLS.10.2v0.1,All sensitive user accounts SHOULD be enrolled into the GWS Advanced Protection Program. This control enforces more secure protection of sensitive user accounts from targeted attacks. Sensitive user accounts include political appointees and other Senior Executive Service (SES) officials whose account compromise would pose a level of risk prohibitive to agency mission fulfillment.,Admin Log Event,Change Application Setting,Advanced Protection Program Settings - Enable user enrollment,true,rules/00gjdgxs2mq8dv6,JK 08-02-23 @ 09:21
+GWS.COMMONCONTROLS.11.1v0.1,Agencies SHALL develop and implement a process to explicitly allow-list (trust) third-party app access to GWS services.,Admin Log Event,API Access Allowed,No Setting Name,No Value,rules/00gjdgxs1qiup12,
+GWS.COMMONCONTROLS.11.2v0.1,Agencies SHALL use GWS application access control policies to restrict access to all GWS services by third party apps.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.11.3v0.1,Agencies SHALL NOT allow users to consent to access to low-risk scopes.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.11.4v0.1,Agencies SHALL NOT trust unconfigured internal apps.,Admin Log Event,"Allow Google Sign-in only third party API access
+OR
+ All third party API access unblocked",No Setting Name,No Value,rules/00gjdgxs0xcbmu1,
+GWS.COMMONCONTROLS.11.5v0.1(a),Agencies SHALL NOT allow users to access unconfigured third-party apps.,Admin Log Event,All third party API access unblocked,No Setting Name,No Value,rules/00gjdgxs0zd46an,JK 09-22-23 @ 14:15 (works only from Don't allow)
+GWS.COMMONCONTROLS.11.5v0.1(b),Agencies SHALL NOT allow users to access unconfigured third-party apps.,Admin Log Event,Allow Google Sign-in only third party API access,No Setting Name,No Value,rules/00gjdgxs3b25o0w,JK 09-22-23 @ 14:15 (works only from Don't allow)
+GWS.COMMONCONTROLS.12.1v0.1,Policy SHOULD be established dictating the app review and approval process.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.12.2v0.1(a),Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.,Admin Log Event,Change Application Setting,Apps Access Setting Allowlist access,ALLOW_SPECIFIED,rules/00gjdgxs0o3dzli,JK 09-12-23 @ 13:33
+GWS.COMMONCONTROLS.12.2v0.2(b),Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.,Admin Log Event,Change Application Setting,Apps Access Setting allow_all_internal_apps,false,rules/00gjdgxs3f0ca00,JK 11-14-23 @ 07:37
+GWS.COMMONCONTROLS.13.1v0.1,Access to Google Workspace applications by less secure apps that do not meet security standards for authentication SHALL be prevented.,Admin Log Event,Less Secure Apps Access Setting Changed,No Setting Name,DISABLED,rules/00gjdgxs2y7rekk,JK 09-20-23 @ 06:51
+GWS.COMMONCONTROLS.14.1v0.1,Google Takeout services SHALL be disabled for users.,Admin Log Event,Toggle Service Enabled,N/A,false,rules/00gjdgxs3wksszz,JK 09-12-23 @ 13:19
+GWS.COMMONCONTROLS.15.1v0.1,"Required system-defined alerting rules, as listed in the Policy section, SHALL be active, with alerts enabled when available. Any system-defined rules not are considered optional but ought to be reviewed for consideration.",Admin Log Event,System Defined Rule Updated,N/A,N/A,rules/00gjdgxs1x4hrff,Needs Manual Verification of Status
+GWS.COMMONCONTROLS.16.1v0.1,The following critical logs SHALL be sent at a minimum.,Admin Log Event,Change Application Setting,"Data Sharing Settings between GCP and Google Workspace ""Sharing Options""",ENABLED,rules/00gjdgxs0yu1jgq,JK 09-19-23 @ 06:40
+GWS.COMMONCONTROLS.16.2v0.1,"Audit logs SHALL be maintained for at least 6 months in active storage and an additional 18 months in cold storage, as dictated by OMB M-21-31. The logs SHALL be sent to the agency’s Security Operations Center (SOC) for monitoring.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.17.1v0.1,"The data storage region SHALL be set to be the United States for all users in the agency's GWS environment.",Admin Log Event,Change Application Setting,Location Policy,US,rules/00gjdgxs2k8ieyq,JK 12-05-23 @ 15:57
+GWS.COMMONCONTROLS.18.1v0.1,"The supplemental data storage region SHALL NOT be set to 'Russian Federation'.",Admin Log Event,Change Data Localization for Russia,N/A,false,rules/00gjdgxs3rufh17,Not Tested
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv b/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv
new file mode 100644
index 00000000..a252f85a
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv
@@ -0,0 +1,20 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.DRIVEDOCS.1.1v0.1,Agencies SHOULD disable sharing outside of the organization’s domain.,Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_NOT_ALLOWED,rules/00gjdgxs10es4se,JK 08-02-23 @ 12:25
+GWS.DRIVEDOCS.1.2v0.1,"If disabling sharing outside of the organization's domain, then agencies SHALL also disable users' receiving files from outside of the organization's domain.",Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_NOT_ALLOWED,rules/00gjdgxs10es4se,JK 08-02-23 @ 12:26
+GWS.DRIVEDOCS.1.3v0.1,"If sharing outside of the organization, then agencies SHALL enable warnings for users when they are about to share something outside of their domain.",Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_ALLOWED_WITH_WARNING,rules/00gjdgxs0qwshr5,
+GWS.DRIVEDOCS.1.4v0.1,"If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account.",N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log evemt
+GWS.DRIVEDOCS.1.5v0.1,Agencies SHALL disable making files and published web content visible to anyone with the link.,Admin Log Event,Change Drive Setting,PUBLISHING_TO_WEB,NOT_ALLOWED,rules/00gjdgxs2l9hukl,JK 08-02-23 @ 12:16
+GWS.DRIVEDOCS.1.6v0.1,Agencies SHALL enable access checking for file sharing outside of Docs or Drive.,Admin Log Event,Change Drive Setting,SHARING_ACCESS_CHECKER_OPTIONS,DOMAIN_OR_NAMED_PARTIES,rules/00gjdgxs2qv9x6y,JK 08-02-23 @ 12:59
+GWS.DRIVEDOCS.1.7v0.1,Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organizations.,Admin Log Event,Change Drive Setting,SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS,CROSS_DOMAIN_FROM_INTERNAL_ONLY,rules/00gjdgxs2bll5l2,JK 09-26-23 @ 09:24
+GWS.DRIVEDOCS.1.8v0.1,Agencies SHALL ensure that newly created items assume the default access level of Private to the Owner.,Admin Log Event,Change Drive Setting,DEFAULT_LINK_SHARING_FOR_NEW_DOCS,PRIVATE,rules/00gjdgxs1jfq3ds,JK 08-02-23 @ 13:28
+GWS.DRIVEDOCS.2.1v0.1,Agencies SHOULD enable shared drive creation to allow for effective collaboration.,Admin Log Event,Change Application Setting,Shared Drive Creation CanCreateSharedDrives,true,rules/00gjdgxs3nclhql,JK 08-02-23 @ 13:37
+GWS.DRIVEDOCS.2.2v0.1,Agencies SHOULD NOT allow members with manager access to override shared drive creation settings.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_admin_only,true,rules/00gjdgxs418trv6,JK 08-02-23 @ 13:44
+GWS.DRIVEDOCS.2.3v0.1,Agencies SHOULD NOT allow users outside of their organization to access files in shared drives.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_cross_domain_access,true,rules/00gjdgxs1o31qud,JK 08-02-23 @ 14:12
+GWS.DRIVEDOCS.2.4v0.1,Agencies SHALL allow users who are not shared drive members to be added to files.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_direct_access,true,rules/00gjdgxs3mcxcll,JK 08-02-23 @ 14:23
+GWS.DRIVEDOCS.2.5v0.1,"Agencies SHALL NOT allow viewers and commenters to download, print, and copy files.",Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_download,true,rules/00gjdgxs18yk89t,JK 08-02-23 @ 14:30
+GWS.DRIVEDOCS.3.1v0.1,Agencies SHALL enable security updates for Drive files.,Admin Log Event,Change Application Setting,Link Security Update Settings less_secure_link_option,REMOVE_LESS_SECURE_LINKS,rules/00gjdgxs0mrpx7o,JK 08-02-23 @ 14:41
+GWS.DRIVEDOCS.4.1v0.1,Agencies SHOULD disable Drive SDK access to restrict information sharing and prevent data leakage.,Admin Log Event,Change Drive Setting,ENABLE_DRIVE_APPS,true,rules/00gjdgxs1mm4n4i,JK 08-02-23 @ 14:49
+GWS.DRIVEDOCS.5.1v0.1,Agencies SHALL disable Add-Ons with the exception of those that are approved within the organization.,Admin Log Event,Change Drive Setting,ENABLE_DOCS_ADD_ONS,false,rules/00gjdgxs4d794jn,JK 08-02-23 @ 15:14
+GWS.DRIVEDOCS.6.1v0.1(a),Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.,Admin Log Event,Change Application Setting, DriveFsSettingsProto drive_fs_enabled,false,rules/00gjdgxs0yziufl,JK 10-19-23 @ 13:47
+GWS.DRIVEDOCS.6.1v0.1(b),Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.,Admin Log Event,Change Application Setting,DriveFsSettingsProto company_owned_only_enabled,true,rules/00gjdgxs4ghyiin,JK 10-19-23 @ 14:01
+GWS.DRIVEDOCS.7.1v0.1,Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.,N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log event
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Gmail.csv b/drift-rules/GWS Drift Monitoring Rules - Gmail.csv
new file mode 100644
index 00000000..a9ded599
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Gmail.csv
@@ -0,0 +1,67 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.GMAIL.1.1v0.1,Mail delegation SHALL be disabled for all users by default.,Admin Log Event,Change Email Setting,ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN,false,rules/00gjdgxs1dj2igu,JK 07-28-223 @ 13:40
+GWS.GMAIL.2.1v0.1,DKIM SHOULD be enabled for agencies’ mail enabled domain.,No Log,No Log,No Log,No Log,No Log,Cannot create rule due to no log event generated
+GWS.GMAIL.3.1v0.1,Agencies SHALL determine which IP addresses are approved senders for their domain(s).,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.3.2v0.1,Agencies SHALL publish SPF policy(s) that designate these (and only these) addresses as approved senders for their domain(s).,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.1v0.1,Agencies SHALL publish a DMARC policy.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.2v0.1,"Agencies SHALL set their policy to message rejection (i.e., “p=reject”).",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.3v0.1,Agencies SHALL include reports@dmarc.cyber.dhs.gov as a point of contact for aggregate reports.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.4v0.1,Agencies SHOULD include an agency point of contact for aggregate and/or failure reports in their policy.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.5.1v0.1,Protect against encrypted attachments from untrusted senders SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: protect against encrypted attachments from untrusted senders,true,rules/00gjdgxs0qglwig,JK 07-31-23 @ 06:54
+GWS.GMAIL.5.2v0.1,Protect against attachments with scripts from untrusted senders SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: protect against attachments with scripts from untrusted senders,true,rules/00gjdgxs3ag9f69,JK 07-31-23 @ 06:54
+GWS.GMAIL.5.3v0.1,Protect against anomalous attachment types in emails SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: Protect against anomalous attachment types in emails,true,rules/00gjdgxs1rx81d3,JK 07-31-23 @ 07:05
+GWS.GMAIL.5.4v0.1,Google SHOULD be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Attachment safety Enable: automatically enables all future added settings,true,rules/00gjdgxs13a7n9n,JK 07-31-23 @ 07:15
+GWS.GMAIL.5.5v0.1(a),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Encrypted attachment protection setting action,Show warning,rules/00gjdgxs0hkfqd2,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.5v0.1(b),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Attachment with scripts protection action,Show warning,rules/00gjdgxs0qfhyzm,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.5v0.1(c),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Anomalous attachment protection setting action,Show warning,rules/00gjdgxs3hwhm6r,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.6v0.1,Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.6.1v0.1,Identify links behind shortened URLs SHALL be Enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: identify links behind shortened URLs,true,rules/00gjdgxs3af5hnf,JK 07-31-23 @ 08:00
+GWS.GMAIL.6.2v0.1,Scan linked images SHALL be enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: scan linked images,true,rules/00gjdgxs44inn5a,JK 07-31-23 @ 08:08
+GWS.GMAIL.6.3v0.1,Show warning prompt for any click on links to untrusted domains SHALL be enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: show warning prompt for click on links to unstrusted domains,true,rules/00gjdgxs2jnxxd3,JK 07-31-23 @ 08:22
+GWS.GMAIL.6.4v0.1,Google SHALL be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Links and external images safety Enable: automatically enables all future added settings,true,rules/00gjdgxs4hxtj4b,JK 07-31-23 @ 08:33
+GWS.GMAIL.6.5v0.1,Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.7.1v0.1,Protect against domain spoofing based on similar domain names SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names,true,rules/00gjdgxs324jgpv,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.2v0.1,Protect against spoofing of employee names SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against spoofing of employee names,true,rules/00gjdgxs3w81m7q,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.3v0.1,Protect against inbound emails spoofing your domain SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain,true,rules/00gjdgxs226brg1,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.4v0.1,Protect against any unauthenticated emails.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against any unauthenticated emails,true,rules/00gjdgxs3ai9pb5,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.5v0.1,Protect your Groups from inbound emails spoofing your domain.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain,true,rules/00gjdgxs2dw9t9x,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.6v0.1(a),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against domain spoofing based on similar domain names action,Show warning,rules/00gjdgxs0sndbln,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(b),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against spoofing of employee names action,Show warning,rules/00gjdgxs2flhnf2,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(c),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against inbound emails spoofing your domain action,Show warning,rules/00gjdgxs0uqrxmv,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(d),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against any unauthenticated emails action,Show warning,rules/00gjdgxs1jhp3jp,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(e),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain - group type,All groups,rules/00gjdgxs3793brc,JK 07-31-23 @ 10:14
+GWS.GMAIL.7.6v0.1(f),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain action,Show warning,rules/00gjdgxs1jvvvfs,JK 07-31-23 @ 10:20
+GWS.GMAIL.7.7v0.1,Google SHALL be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: automatically enables all future added settings,true,rules/00gjdgxs2puldi0,JK 07-31-23 @ 10:26
+GWS.GMAIL.7.8v0.1,Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.8.1v0.1,User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment.,Admin Log Event,Change Email Setting,ENABLE_EMAIL_USER_IMPORT,false,rules/00gjdgxs1vu7fnv,JK 07-31-23 @ 10:52
+GWS.GMAIL.9.1v0.1(a),POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.,Admin Log Event,Change Email Setting,IMAP_ACCESS,DISABLED,rules/00gjdgxs3ynriy0,JK 07-31-23 @ 11:07
+GWS.GMAIL.9.1v0.1(b),POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.,Admin Log Event,Change Email Setting,ENABLE_POP_ACCESS,false,rules/00gjdgxs16dhzcn,JK 07-31-23 @ 11:07
+GWS.GMAIL.9.2v0.1,POP and IMAP access MAY be enabled on a per-user and per-application basis as needed.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.10.1v0.1,Google Workspace Sync SHOULD be disabled.,Admin Log Event,Change Email Setting,ENABLE_OUTLOOK_SYNC,false,rules/00gjdgxs2caikn5,JK 07-31-23 @ 11:39
+GWS.GMAIL.10.2v0.1,Google Workspace Sync MAY be enabled on a per-user basis as needed.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.11.1v0.1,"Automatic forwarding SHOULD be disabled, especially to external domains.",Admin Log Event,Change Email Setting,ENABLE_EMAIL_AUTOFORWARDING,false,rules/00gjdgxs3bfgdir,JK 07-31-23 @ 11:50
+GWS.GMAIL.12.1v0.1,Image URL proxy whitelists SHOULD be enabled to avoid broken links to images that are dependent on internal IP addresses within an organization’s domain.,Admin Log Event,Change Email Setting,NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS,DEFAULT,rules/00gjdgxs1eu3lea,JK 08-01-23 @ 11:32
+GWS.GMAIL.13.1v0.1,Using a per-user outbound gateway that is a mail server other than the Google Workspace mail servers SHALL be disabled.,Admin Log Event,Change Email Setting,OUTBOUND_RELAY_ENABLED,false,rules/00gjdgxs0wkcpwf,JK 07-31-23 @ 11:38
+GWS.GMAIL.14.1v0.1,Unintended external reply warnings SHALL be enabled to avoid unintentional replies and remind users to treat external messages with caution.,Admin Log Event,Change Application Setting,OutOfDomainWarningProto disable_untrusted_recipient_warning,true,rules/00gjdgxs0o6v2pe,JK 07-31-23 @ 13:56
+GWS.GMAIL.15.1v0.1,An email allowlist SHOULD not be implemented.,Admin Log Event,Change Email Setting,EMAIL_SPAM_ALLOWLIST,[],rules/00gjdgxs17hggqa,JK 08-01-23 @ 11:36
+GWS.GMAIL.15.2v0.1,A connection filter policy to create a Blocked Senders list MAY be implemented.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.16.1v0.1,Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing.,Admin Log Event,Change Application Setting,DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email,true,rules/00gjdgxs0z436wh,JK 07-13-23 @ 15:18
+GWS.GMAIL.16.2v0.1,Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.17.1v0.1,Security sandbox SHOULD be enabled to provide additional protections for their email messages.,Admin Log Event,Change Application Setting,AttachmentDeepScanningSettingsProto deep_scanning_enabled,true,rules/00gjdgxs2e64nj2,JK 07-13-23 @ 15:42
+GWS.GMAIL.17.2v0.1,Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.1v0.1,A spam approved senders list SHOULD be configured to ensure legitimate emails are not sent to the spam folder.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.2v0.1,An allowed senders list MAY be added but SHOULD NOT add allowed domains.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.3v0.1,Any third-party or outside application selected for spam approved senders’ lists SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.4v0.1,Addresses added to the allowed senders list SHALL be set to require authentication.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.19.1v0.1,A blocked senders list SHOULD be configured to prevent emails from known malicious sources.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.19.2v0.1,Blocked senders or domains MAY be added to the blocked senders list.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.20.1v0.1,Comprehensive mail storage SHOULD be enabled to ensure information can be tracked across applications.,Admin Log Event,Change Gmail Setting,COMPREHENSIVE_MAIL_STORAGE,No Value,rules/00gjdgxs388y21u,
+GWS.GMAIL.21.1v0.1,Content filtering SHOULD be enabled within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.21.2v0.1,Any third-party or outside application selected for advanced email content filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.21.3v0.1,"Gmail or third-party applications SHALL be configured to protect PII and sensitive information as defined by the agency. At a minimum, credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) SHALL be blocked.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.22.1v0.1,Word lists SHOULD be enabled to filter objectionable content within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.22.2v0.1,Any third-party or outside application selected for objectionable content filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.1v0.1,Attachment compliance SHOULD be enabled to filter specific attachments within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.2v0.1,The attachment filter SHOULD attempt to determine the true file type and assess the file extension.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.3v0.1,The set of disallowed file types SHALL be determined.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.4v0.1,Any third-party or outside application selected for attachment compliance filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
diff --git a/drift-rules/GWS Drift Monitoring Rules - Groups.csv b/drift-rules/GWS Drift Monitoring Rules - Groups.csv
new file mode 100644
index 00000000..ebcb954f
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Groups.csv
@@ -0,0 +1,8 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.GROUPS.1.1v0.1,Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto collaboration_policy,CLOSED,rules/00gjdgxs2kgaq5a,JK 08-01-23 @ 14:13
+GWS.GROUPS.2.1v0.1,Group owners’ ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto owners_can_allow_external_members,false,rules/00gjdgxs4b8984a,JK 08-01-23 @ 14:41
+GWS.GROUPS.3.1v0.1,"Group owners’ ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment.",Admin Log Event,Change Application Setting,GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public,false,rules/00gjdgxs0lw54bd,JK 08-01-23 @ 14:52
+GWS.GROUPS.4.1v0.1,Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto who_can_create_groups,ADMIN_ONLY,rules/00gjdgxs35vsmz6,JK 08-01-23 @ 15:06
+GWS.GROUPS.5.1v0.1,The default permission to view conversations SHALL be set to All Group Members.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto default_view_topics_access_level,MEMBERS,rules/00gjdgxs24dq6r2,JK 08-01-23 @ 15:14
+GWS.GROUPS.6.1v0.1,Group owners’ ability to hide groups from the directory SHOULD be disabled unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto allow_unlisted_groups,false,rules/00gjdgxs0zbb0ae,JK 08-01-23 @ 15:22
+GWS.GROUPS.7.1v0.1,New Groups SHOULD be created with an Access type of Restricted unless necessary for agency mission fulfillment.,N/A,N/A,N/A,N/A,N/A,Not Alertable
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Meet.csv b/drift-rules/GWS Drift Monitoring Rules - Meet.csv
new file mode 100644
index 00000000..3b81f3ee
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Meet.csv
@@ -0,0 +1,5 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.MEET.1.1v0.1,Meeting access SHALL be restricted to users signed in with a Google Account or Dialing in using a phone.,Admin Log Event,Change Application Setting,SafetyDomainLockProto users_allowed_to_join,LOGGED_IN,rules/00gjdgxs1wv8d7g,JK 08-02-23 @ 15:58
+GWS.MEET.2.1v0.1,Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace tenant or organization.,Admin Log Event,Change Application Setting,SafetyAccessLockProto meetings_allowed_to_join,WORKSPACE_DOMAINS,rules/00gjdgxs0rw9s95,JK 08-02-23 @ 16:02
+GWS.MEET.3.1v0.1,Host Management meeting features SHALL be enabled so that they are available by default when a host starts their meeting.,Admin Log Event,Change Application Setting,SafetyModerationLockProto host_management_enabled,true,rules/00gjdgxs3bvxawy,JK 08-02-23 @ 16:05
+GWS.MEET.4.1v0.1,Warn for external participants SHALL be enabled.,Admin Log Event,Change Application Setting,Warn for external participants External or unidentified participants in a meeting are given a label,true,rules/00gjdgxs2yp7uet,JK 10-16-23 @ 07:32
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Sites.csv b/drift-rules/GWS Drift Monitoring Rules - Sites.csv
new file mode 100644
index 00000000..b9f1b0d7
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Sites.csv
@@ -0,0 +1,2 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.SITES.1.1v0.1,Sites Service SHOULD be disabled for all users.,Admin Log Event,Toggle Service Enabled,No Setting Name,FALSE,rules/00gjdgxs3gdgxe3,JK 07-28-23 @ 11:12
\ No newline at end of file
diff --git a/guides/CONTENTSTYLEGUIDE.md b/guides/CONTENTSTYLEGUIDE.md
new file mode 100644
index 00000000..14c9e831
--- /dev/null
+++ b/guides/CONTENTSTYLEGUIDE.md
@@ -0,0 +1,361 @@
+# Content style guide for SCuBA
+
+Welcome to the content style guide for [SCuBA](https://www.cisa.gov/scuba).
+
+These guidelines are specific to style rules for PowerShell and OPA Rego code. For general style questions or guidance on topics not covered here, ask or go with best guess and bring up at a later meeting.
+
+Use menu icon on the top left corner of this document to get to a specific section of this guide quickly.
+
+## The SCuBA approach to style
+
+- Our style guide aims for simplicity. Guidelines should be easy to apply to a range of scenarios.
+- Decisions aren’t about what’s right or wrong according to the rules, but about what’s best practice and improves readability. We're flexible and open to change while maintaining consistency.
+- When making a style or structure decision, we consider the readability, maintainability and ability for consitancy in a range of situations.
+- When a question specific to help documentation isn’t covered by the style guide, we think it through using these principles, then make a decision and bring it up in the next meeting for deliberation.
+
+## OPA Rego
+
+Because there isn't a standard style guide for the Rego language, we are creating one from scratch. For consistency, we will be using many of the same style rules as PowerShell. There are also a few best practice rules that this program will follow. These best practices were deliberated on and chosen to enhance readability. We recognize that the code is in a constant state of improvement, so the best practices are subject to change.
+
+### Test Cases
+
+Test names will use the syntax `test_mainVar_In/correct_*V#` to support brevity in naming that highlights the primary variable being tested. Furthermore, for tests with more than one version, the first test will also include a version as `_V1`. Consistent use of a version number promotes clarity and signals the presence of multiple test versions to reviewers. Version numbers are not used if there is only a single test of a given variable and type (Correct/Incorrect)
+
+```
+test_ExampleVar_Correct_V1 if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as {
+ "example_policies" : [
+ {
+ "Example3" : "ExampleString",
+ "Example2" : false
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Example output"
+}
+
+test_ExampleVar_Correct_V2 if {
+ ...
+}
+
+test_ExampleVar_Incorrect if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as {
+ "example_policies" : [
+ {
+ "Example3" : "ExampleString",
+ "Example2" : true
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Example output"
+}
+```
+
+### Not Implemented
+
+If the policy bullet point is untestable at this time, use the templates below.
+
+#### Config
+
+The first one directs the user to the baseline document for manual checking. The second instructs the user to run a different script because the test is in another version. However, if they are unable to run the other script, they are also directed to the baseline like in the first template.
+
+```
+# At this time we are unable to test for X because of Y
+tests[{
+ "Requirement" : "The matching policy bulletpoint from the baseline document goes here",
+ "Control" : "Example 2.1",
+ "Criticality" : "Shall/Not-Implemented",
+ "Commandlet" : "",
+ "ActualValue" : [],
+ "ReportDetails" : "Currently cannot be checked automatically. See (Product) Secure Configuration Baseline policy 2.# for instructions on manual check",
+ "RequirementMet" : false
+}] {
+ true
+}
+```
+
+```
+# At this time we are unable to test for X because of Y
+tests[{
+ "Requirement" : "The matching policy bulletpoint from the baseline document goes here",
+ "Control" : "Example 2.1",
+ "Criticality" : "Shall/3rd Party",
+ "Commandlet" : "",
+ "ActualValue" : [],
+ "ReportDetails" : "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
+ "RequirementMet" : false
+}] {
+ true
+}
+```
+#### Testing
+
+```
+test_NotImplemented_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as { }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Currently cannot be checked automatically. See (Product) Secure Configuration Baseline policy 2.# for instructions on manual check"
+}
+```
+```
+test_3rdParty_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as { }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check"
+}
+```
+
+### Naming
+
+PascalCase - capitalize the first letter of each word. This is the same naming convention that is used for PowerShell.
+
+```
+ExampleVariable := true
+```
+
+### Brackets
+
+One True Brace - requires that every braceable statement should have the opening brace on the end of a line, and the closing brace at the beginning of a line. This is the same bracket style that is used for PowerShell.
+
+```
+test_Example_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Requirement String"
+
+ Output := tests with input as {
+ "example_tag" : {
+ "ExampleVar" : false
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Requirement met"
+}
+```
+
+### Indentation
+
+Indentation will be set at 4 spaces, make sure your Tabs == 4 spaces. We are working on finding a tool that will replace Tabs with spaces and clean up additional spacing mistakes. Until then it is checked manually in code review. Be kind to your reviewer!
+
+### Spacing
+
+1) A blank line between each major variable: references & rules
+
+```
+Example[Example.Id] {
+ Example := input.ExampleVar[_]
+ Example.State == "Enabled"
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == 15
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+...
+```
+
+2) Two blank lines between subsections
+
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == 15
+}
+
+
+################
+# Baseline 2.2 #
+################
+...
+```
+
+### Comments
+
+1) Indicate beginning of every policy: 2.1, 2.2, etc.
+
+```
+################
+# Baseline 2.1 #
+################
+```
+2) Indicate the beginning of every policy bullet point.
+
+```
+#
+# Baseline 2.#: Policy #
+#--
+```
+
+3) Indicate the end of every policy bullet point.
+
+```
+#--
+```
+
+4) Indicate why placeholder test is blank/untestable
+
+```
+# At this time we are unable to test for X because of Y
+```
+
+### Booleans
+
+In the interest of consistency across policy tests and human readability of the test, boolean-valued variables should be set via a comparison test against a boolean constant (true/false).
+
+#### Correct
+
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.1",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == false
+}
+```
+
+#### Incorrect
+
+```
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar # Mising == true
+}
+
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == false
+}
+```
+
+### Taking input
+
+We will always store the input in a variable first thing. It can sometimes be easier to only use `input.ExampleVar` repeatedly, but for consistancy this is best practice. the `[_]` is added to the end for when you are anticipating an array, so the program has to loop through the input. There are other ways to take in input, but OPA Documents states `input.VariableName` is recommended. As such we will only use this method for consistancy. If there is a problem, it can be taken up on a case by case basis for disscussion.
+
+```
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar[_]
+ Status := "Example" in ExampleVar
+}
+
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+
+### ActualValue
+
+It can be tempting to put the status variable in the ActualValue spot when you are anticipating a boolean. DON'T! For consistancy and as best practice put `ExampleVar.ExampleSetting`.
+
+#### InCorrect
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.1",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : Status,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+
+#### Correct
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+## Python
+[PEP 8](https://peps.python.org/pep-0008/)
\ No newline at end of file
diff --git a/guides/GithubFlowDemo.pdf b/guides/GithubFlowDemo.pdf
new file mode 100644
index 00000000..a2643bd4
Binary files /dev/null and b/guides/GithubFlowDemo.pdf differ
diff --git a/images/Change Management.JPG b/images/Change Management.JPG
new file mode 100644
index 00000000..6b0f98c1
Binary files /dev/null and b/images/Change Management.JPG differ
diff --git a/images/GWS Update Workflow.JPG b/images/GWS Update Workflow.JPG
new file mode 100644
index 00000000..ab00043d
Binary files /dev/null and b/images/GWS Update Workflow.JPG differ
diff --git a/images/MFA.PNG b/images/MFA.PNG
new file mode 100644
index 00000000..30155928
Binary files /dev/null and b/images/MFA.PNG differ
diff --git a/rego/Calendar.rego b/rego/Calendar.rego
new file mode 100644
index 00000000..a189ae78
--- /dev/null
+++ b/rego/Calendar.rego
@@ -0,0 +1,503 @@
+package calendar
+import future.keywords
+import data.utils.ReportDetailsOUs
+import data.utils.NoSuchEventDetails
+
+OUsWithEvents contains Event.OrgUnit if {
+ some Event in SettingChangeEvents
+}
+
+FilterEvents(SettingName) := FilteredEvents if {
+ # Filter the events by SettingName
+ Events := SettingChangeEvents
+ FilteredEvents := [Event | some Event in Events; Event.Setting == SettingName]
+}
+
+FilterEventsOU(ServiceName, OrgUnit) := FilteredEvents if {
+ # If there exists at least the root OU and 1 more OU
+ # filter out organizational units that don't exist
+ input.organizational_unit_names
+ count(input.organizational_unit_names) >=2
+
+ # Filter the events by both ServiceName and OrgUnit
+ Events := FilterEvents(ServiceName)
+ FilteredEvents := [
+ Event | some Event in Events;
+ Event.OrgUnit == OrgUnit;
+ Event.OrgUnit in input.organizational_unit_names
+ ]
+}
+
+FilterEventsOU(SettingName, OrgUnit) := FilteredEvents if {
+ # If only the root OU exists run like normal
+ input.organizational_unit_names
+ count(input.organizational_unit_names) < 2
+
+ # Filter the events by both SettingName and OrgUnit
+ Events := FilterEvents(SettingName)
+ FilteredEvents := [Event | some Event in Events; Event.OrgUnit == OrgUnit]
+}
+
+FilterEventsOU(SettingName, OrgUnit) := FilteredEvents if {
+ # If OUs variable does not exist run like normal
+ not input.organizational_unit_names
+
+ # Filter the events by both SettingName and OrgUnit
+ Events := FilterEvents(SettingName)
+ FilteredEvents := [Event | some Event in Events; Event.OrgUnit == OrgUnit]
+}
+
+GetTopLevelOU() := name if {
+ # Simplest case: if input.tenant_info.topLevelOU is
+ # non-empty, it contains the name of the top-level OU.
+ input.tenant_info.topLevelOU != ""
+ name := input.tenant_info.topLevelOU
+}
+
+GetTopLevelOU() := name if {
+ # input.tenant_info.topLevelOU will be empty when
+ # no custom OUs have been created, as in this case
+ # the top-level OU cannot be determined via the API.
+ # Fortunately, in this case, we know there's literally
+ # only one OU, so we can grab the OU listed on any of
+ # the events and know that it is the top-level OU
+ input.tenant_info.topLevelOU == ""
+ count(SettingChangeEvents) > 0
+ name := GetLastEvent(SettingChangeEvents).OrgUnit
+}
+
+GetTopLevelOU() := name if {
+ # Extreme edge case: no custom OUs have been made
+ # and the logs are empty. In this case, we really
+ # have no way of determining the top-level OU name.
+ input.tenant_info.topLevelOU == ""
+ count(SettingChangeEvents) == 0
+ name := ""
+}
+
+SettingChangeEvents contains {
+ "Timestamp": time.parse_rfc3339_ns(Item.id.time),
+ "TimestampStr": Item.id.time,
+ "NewValue": NewValue,
+ "Setting": Setting,
+ "OrgUnit": OrgUnit,
+ "DomainName": DomainName
+}
+if {
+ some Item in input.calendar_logs.items # For each item...
+ some Event in Item.events # For each event in the item...
+
+ # Does this event have the parameters we're looking for?
+ "SETTING_NAME" in {Parameter.name | some Parameter in Event.parameters}
+ "NEW_VALUE" in {Parameter.name | some Parameter in Event.parameters}
+ "ORG_UNIT_NAME" in {Parameter.name | some Parameter in Event.parameters}
+ "DOMAIN_NAME" in {Parameter.name | some Parameter in Event.parameters}
+
+ # Extract the values
+ Setting := [Parameter.value | some Parameter in Event.parameters; Parameter.name == "SETTING_NAME"][0]
+ NewValue := [Parameter.value | some Parameter in Event.parameters; Parameter.name == "NEW_VALUE"][0]
+ OrgUnit := [Parameter.value | some Parameter in Event.parameters; Parameter.name == "ORG_UNIT_NAME"][0]
+ DomainName := [Parameter.value | some Parameter in Event.parameters; Parameter.name == "DOMAIN_NAME"][0]
+}
+
+GetLastEvent(Events) := Event if {
+ # Because CalendarSharingEvents returns a set instead
+ # of an array, we can't just index it and get the last
+ # value
+ MaxTs := max([Event.Timestamp | some Event in Events])
+ some Event in Events
+ Event.Timestamp == MaxTs
+}
+
+
+################
+# Baseline 1 #
+################
+
+#
+# Baseline GWS.CALENDAR.1.1v0.1
+#--
+NonCompliantOUs1_1 contains OU if {
+ some OU in OUsWithEvents
+ Events := FilterEventsOU("SHARING_OUTSIDE_DOMAIN", OU)
+ count(Events) > 0 # Ignore OUs without any events. We're already
+ # asserting that the top-level OU has at least one event; for all
+ # other OUs we assume they inherit from a parent OU if they have
+ # no events.
+ LastEvent := GetLastEvent(Events)
+ LastEvent.NewValue != "SHOW_ONLY_FREE_BUSY_INFORMATION"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+tests contains {
+ "PolicyId": "GWS.CALENDAR.1.1v0.1",
+ "Criticality": "Shall",
+ "ReportDetails": NoSuchEventDetails(DefaultSafe, TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs.",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ DefaultSafe := false
+ TopLevelOU := GetTopLevelOU()
+ Events := FilterEventsOU("SHARING_OUTSIDE_DOMAIN", TopLevelOU)
+ count(Events) == 0
+}
+
+tests contains {
+ "PolicyId": "GWS.CALENDAR.1.1v0.1",
+ "Criticality": "Shall",
+ "ReportDetails": ReportDetailsOUs(NonCompliantOUs1_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ TopLevelOU := GetTopLevelOU()
+ Events := FilterEventsOU("SHARING_OUTSIDE_DOMAIN", TopLevelOU)
+ count(Events) > 0
+ Status := count(NonCompliantOUs1_1) == 0
+}
+#--
+
+#
+# Baseline GWS.CALENDAR.1.2v0.1
+#
+tests contains {
+ "PolicyId": "GWS.CALENDAR.1.2v0.1",
+ "Criticality": "May/Not-Implemented",
+ "ReportDetails": "Currently not able to be tested automatically; please manually check.",
+ "ActualValue": "",
+ "RequirementMet": false,
+ "NoSuchEvent": true
+}
+#--
+
+################
+# Baseline 2 #
+################
+
+#
+# Baseline GWS.CALENDAR.2.1v0.1
+#--
+NonCompliantOUs2_1 contains OU if {
+ some OU in OUsWithEvents
+ Events := FilterEventsOU("ENABLE_EXTERNAL_GUEST_PROMPT", OU)
+ count(Events) > 0 # Ignore OUs without any events. We're already
+ # asserting that the top-level OU has at least one event; for all
+ # other OUs we assume they inherit from a parent OU if they have
+ # no events.
+ LastEvent := GetLastEvent(Events)
+ LastEvent.NewValue == "false"
+}
+
+tests contains {
+ "PolicyId": "GWS.CALENDAR.2.1v0.1",
+ "Criticality": "Shall",
+ "ReportDetails": NoSuchEventDetails(DefaultSafe, TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ DefaultSafe := false
+ TopLevelOU := GetTopLevelOU()
+ Events := FilterEventsOU("ENABLE_EXTERNAL_GUEST_PROMPT", TopLevelOU)
+ count(Events) == 0
+}
+
+tests contains {
+ "PolicyId": "GWS.CALENDAR.2.1v0.1",
+ "Criticality": "Shall",
+ "ReportDetails": ReportDetailsOUs(NonCompliantOUs2_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ TopLevelOU := GetTopLevelOU()
+ Events := FilterEventsOU("ENABLE_EXTERNAL_GUEST_PROMPT", TopLevelOU)
+ count(Events) > 0
+ Status := count(NonCompliantOUs2_1) == 0
+}
+#--
+
+
+################
+# Baseline 3 #
+################
+
+ExtSharingSecondaryCalSettingDetailsStr(LastEvent) := Description if {
+ LastEvent.NewValue == "SHOW_ONLY_FREE_BUSY_INFORMATION"
+ Description := concat("", ["
+
+ SCuBA GWS Security Baseline Conformance Reports
+| Customer Name | Customer Domain | Customer ID | Report Date |
|---|---|---|---|
| Org Name | example.org | ABCDEFG | 12/06/2023 11:15:27 Pacific Daylight Time |
+
| Baseline Conformance Reports | +Details | +
|---|---|
| Google Calendar | +4 tests passed 1 warning 3 manual checks needed |
+
| Google Chat | +6 tests passed 1 test failed 1 manual check needed |
+
| Google Classroom | +3 tests passed 2 tests failed |
+
| Common Controls | +30 tests passed 1 warning 14 tests failed 31 manual checks needed |
+
| Google Drive and Docs | +8 tests passed 6 warnings 3 tests failed 1 manual check needed |
+
| Gmail | +22 tests passed 4 warnings 6 tests failed 11 manual checks needed |
+
| Groups for Business | +6 tests passed 1 warning |
+
| Google Meet | +4 tests passed |
+
| Rules | +22 tests passed 18 manual checks needed |
+
| Google Sites | +1 test passed |
+
+ +
