| name | cis-gworkspace-3.1.2.1.1.4 |
| description | Ensure users are warned when they share a file with users in an allowlisted domain |
| category | cis-gworkspace |
| version | 1.3.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","google-workspace","drive","docs","sharing","file-access"] |
| cis_id | 3.1.2.1.1.4 |
| cis_benchmark | CIS Google Workspace Foundations Benchmark v1.3.0 |
| tech_stack | ["gcp","google-workspace"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
3.1.2.1.1.4 Ensure users are warned when they share a file with users in an allowlisted domain
Level
L2
Profile Applicability
Type
Manual
Description
Warn the user when they try and share a file and/or shared drive with users in an allowlisted domain.
Rationale
The user may not realize the potential account is external to the organization. Providing a warning allows the user an opportunity to know this and possibly reassess this sharing.
Impact
None, except an additional warning. Sharing can still occur.
Audit
To verify this setting via the Google Workspace Admin Console:
- Log in to
https://admin.google.com as an administrator
- Select
Apps
- Select
Drive and Docs
- Select
Sharing Settings
- Select
Sharing Options
- Under
Sharing outside of <Company>
- Ensure
ALLOWLISTED DOMAINS - Files owned by users or shared drives in BMDT-Group can be shared with Google accounts in compatible allowlisted domains is checked. Also, ensure the sub-setting Warn when files owned by users or shared drives in <Company> are shared with users in allowlisted domains is checked.
Remediation
To configure this setting via the Google Workspace Admin Console:
- Log in to
https://admin.google.com as an administrator
- Select
Apps
- Select
Drive and Docs
- Select
Sharing Settings
- Select
Sharing Options
- Under
Sharing outside of <Company>
- Set
ALLOWLISTED DOMAINS - Files owned by users or shared drives in BMDT-Group can be shared with Google accounts in compatible allowlisted domains. to checked. Also, set the sub-setting Warn when files owned by users or shared drives in <Company> are shared with users in allowlisted domains to checked.
- Select
Save
Default Value
For files owned by users in <Company> warn when sharing outside of <Company> is
