If you run a business in Cocoa, Rockledge, Merritt Island, or Viera, Google Workspace is probably where your email, files, and calendars live. That makes it the front door to your company.
Google already provides strong default protections. The gap is the Admin console work that does not happen on its own: enforcing two step verification, tightening Gmail phishing settings, limiting how files get shared, and making sure you can recover data if something is deleted. That work needs a monthly pass, which is the kind of Google Workspace support a managed IT partner handles for you.
Start With Accounts and Two Step Verification
A stolen password is still a common way a Workspace account gets taken over. Two step verification, which Google calls 2-Step Verification, adds a second check after the password, such as a prompt on your phone, an authenticator app, or a security key.
Google recommends that everyone use it, and that you enforce it for admins and anyone who handles financial or employee records. Allowing it is not the same as enforcing it, and Google is moving to require it on administrator accounts. In the Admin console, go to Security, then Authentication, then 2-step verification.
- Enforce two step verification for every user, not just offer it
- Have each person generate backup codes and store them somewhere safe
- Keep at least two super administrator accounts, each used by a different person
- Give super admins a separate account for daily email, and sign out of the super admin account when the work is done
- Add a recovery phone and email to each admin account
- Prefer a security key, a Google prompt, or an authenticator app. Google discourages text message codes because they can be intercepted
See Protect your business with 2-Step Verification for the methods and why enforcement matters.
Tighten Gmail Phishing Protection
Phishing email is how many businesses lose a mailbox or a wire payment. Gmail already scans incoming mail, but you can add stronger checks in the Admin console.
Turn on enhanced pre-delivery message scanning so Gmail can inspect risky messages before they reach the inbox. Then review Advanced phishing and malware protection, under Apps, then Google Workspace, then Gmail, then Safety. Turn on extra checks for suspicious attachments, shortened links and linked images, warnings for links to untrusted domains, and messages that mimic your domain or an employee's name. You can also apply future recommended settings automatically.
Set up SPF, DKIM, and DMARC for your domain so other mail systems can tell your messages are really from you. Without those records, your mail is more likely to land in spam, and it is easier for someone to impersonate your domain.
Google documents the Gmail safety options in Advanced phishing and malware protection.
Control Drive and Calendar Sharing
The risk is often a folder that was shared too broadly months ago and never reviewed.
In Drive, set the default so only the person who creates a file can open it until they share it. Google describes this as turning Link Sharing off. If your team shares files outside the company, turn on the warning that asks them to confirm first. For Calendar, limit external sharing to free and busy times only, so outsiders cannot read event titles and details.
Then sweep existing shares. Look for files open to anyone with the link, old client folders that still include a former vendor, and calendars that show more than they should.
Offboard People Before You Delete the Account
When someone leaves a Cocoa or Melbourne office, suspend their Google account promptly so they cannot sign in. Transfer company email, Drive files they own, and important calendars to someone who is staying, then delete the account.
Google retains some deleted user data for 20 days, and you can restore the user during that window. After that, the data can be gone. If you need to keep a mailbox for records, archive or suspend first rather than deleting in a hurry.
Do Not Treat Google's Recycle Window as a Backup
Google keeps its own copies of Workspace data for disaster recovery, but those copies are not something you can request as a restore. If a file is emptied from Drive trash, an admin can usually recover it for 25 days. After that, Google purges it. Recover deleted files and folders for Drive users explains that limit.
Google Vault, if your edition includes it, is for retention and legal holds, not a daily backup. The Data Export tool is a one time export, not an ongoing restore plan. For recovery after a deletion, a ransomware event, or a bad sync, you need a backup you control, plus a test that the restore actually works.
A Short Monthly Checklist
Review this each month:
- Two step verification is enforced for every user, and people still have a working second factor and backup codes
- Two super admin accounts exist, used only for admin work, with recovery information on file
- Former employees are suspended, and their files and email have been transferred
- Enhanced pre-delivery scanning and the advanced Gmail safety settings are on
- SPF, DKIM, and DMARC are in place, including for any new tool that sends mail
- Default Drive link sharing is off, and external shares and calendar visibility are still tight
- Third party apps with access to company Google data still need that access
- You know how you would get a key file or mailbox back, and you have confirmed that recently
Google also publishes a shorter security checklist for small businesses. These settings drift, which is why Google Workspace support for a Brevard County business works better as a monthly habit than as a weekend project.
How RAIT Helps
RAIT Services is a Cocoa based team that handles managed IT and practical AI automation for growing businesses across Brevard County. RAIT manages Microsoft 365 and Google Workspace for clients, along with cybersecurity and support, so Workspace settings are not handled in isolation from the rest of your systems.
If you already use Workspace, we can start with the Admin console: who has access, whether two step verification is enforced, how mail and file sharing are configured, and whether recovery would actually work.
Frequently Asked Questions
Doesn't Google already protect my Workspace account?
Google provides strong baseline protections, but some Admin console settings stay off until you turn them on. Enforcing two step verification and the extra Gmail safety checks are your responsibility, or your IT partner's.
Is two step verification enough on its own?
It is the most important first step, and it should be enforced, not optional. It does not replace careful sharing, offboarding, phishing protections, or a real backup.
Does Google back up my Drive files and Gmail automatically?
Google keeps copies for its own disaster recovery, and admins have a short window to recover recently deleted Drive files. That is not a backup you can restore from after a serious loss.
Can I do this checklist myself?
Yes, if you have Admin console access and time to stay current. Many Space Coast business owners and office managers prefer a partner to handle the monthly review.
Start With a Free IT and AI Audit
If you want a clear picture of your Google Workspace setup, start with RAIT's free IT and AI audit. We will look at how your accounts, mail, and files are configured and give you a short list of what would actually help. No pressure tour of your stack, just a practical next step.
Get My Free IT and AI Audit