cis-gworkspace-3-1-4-2-1

name	cis-gworkspace-3.1.4.2.1
description	Ensure Google Chat externally is restricted to allowed domains
category	cis-gworkspace
version	1.3.0
author	cyberstrike-official
tags	["cis","gcp","google-workspace","google-chat","external-chat"]
cis_id	3.1.4.2.1
cis_benchmark	CIS Google Workspace Foundations Benchmark v1.3.0
tech_stack	["gcp","google-workspace"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Google Chat externally is restricted to allowed domains (Manual)

Description

Control how users chat with people outside of your organization. If you allow your users to chat externally, you can also allow them to create and join spaces with people outside your organization.

Rationale

Restricting external chat to only approved domains potentially limits the spread of company information.

Impact

Users will not be able to chat with users in any external domain, only approved domains. This will require some admin-level approval and allowlist maintenance.

Audit Procedure

Using Google Workspace Admin Console

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Chat and classic Hangouts
4. Select External Chat Settings
5. Select Chat externally
6. Verify Allow users to send messages outside <company> is ON
7. Verify Only allow this for allowlisted domains is checked

Expected Result

Allow users to send messages outside <company> should be ON, and Only allow this for allowlisted domains should be checked.

Remediation

Using Google Workspace Admin Console

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Chat and classic Hangouts
4. Select External Chat Settings
5. Select Chat externally
6. Set Allow users to send messages outside <company> to ON
7. Set Only allow this for allowlisted domains to checked
8. Select Save

Default Value

• Allow users to send messages outside <company> is set to ON
• Only allow this for allowlisted domains is unchecked

CIS Controls

Controls Version	Control