Securing Google Workspace for SMEs: MFA, Context-Aware Access and Drive Hardening

For many SMEs, Google Workspace is the digital backbone: email, calendar, Drive, Meet, Docs, all in one subscription. What often gets overlooked is that out of the box, it isn't locked down as tightly as it should be. Buying the licence is one thing; configuring it securely is another story. This guide shows you exactly which settings to change to make Gmail, Drive and the rest of Workspace resilient against the attacks hitting SMEs hardest in 2026: targeted phishing, password theft, stolen sessions and accidentally shared documents.

Why Workspace security needs special attention

Google delivers a strong platform, but the default configuration is deliberately low-friction. That's handy for getting started quickly, and a problem when your business data can't afford the risk. A few concrete defaults that are switched off or set loosely when you have just created a new Workspace tenant: two-factor authentication is not enforced for all users, Drive files can be shared with "anyone with the link" by default, and context-aware access (restricting behaviour based on device, location and network) is not turned on.

In the Netherlands in 2026, Google Workspace costs from around €6.80 per user per month for Business Starter (annual contract, excluding VAT). Business Standard starts at €13.60 and Business Plus at €21.10. If you want to lock security down properly, you will quickly end up on Business Plus for the extra controls (Vault, more advanced endpoint management, context-aware access). We'll come back to that shortly. Still torn between Google and Microsoft? Read our comparison of Google Workspace and Microsoft 365 first.

Enforce 2SV for everyone, phishing-resistant for admins

Two-factor authentication, which Google calls 2-Step Verification or 2SV, is the most important lever you have. Accounts with MFA are compromised orders of magnitude less often than accounts without it. Since 2025, Google automatically enforces 2SV for all administrator accounts, but for regular users you have to switch it on yourself.

Step by step:

1. Turn on 2SV enforcement in the Admin console for the whole organisation or per organisational unit.
2. Allow an enrolment period of 7 to 14 days so employees can register their second factor.
3. After that, make 2SV mandatory for new sessions.
4. Don't allow SMS or voice as a second factor; they are not resilient enough against SIM swapping and phishing relay attacks. Use Google Prompt, a security key or a passkey.

For super admins and delegated admins, go one step further. Enrol these accounts in Google's Advanced Protection Program. This enforces passkeys or hardware security keys, blocks access from untrusted apps and strengthens recovery procedures. Passkeys block phishing relay attacks because the credential itself verifies that it is talking to the real google.com domain before it responds.

Our broader guide to rolling out MFA explains how to handle this organisationally without swamping the helpdesk.

Configure context-aware access

Context-Aware Access is Google's implementation of zero trust: access is determined not only by "do you know the password?" but also by "from which device, which network, which location and with which risk profile?". Examples of policies you can build with it:

• Only devices with encryption and a screen lock can access Gmail and Drive.
• Sessions from unfamiliar countries (outside the Netherlands/EU) require additional verification.
• External suppliers only get access to specific apps, not to everything.
• Certain sensitive apps (for example the Admin console, HR shared drives) are only reachable from managed devices.

This feature is included in Business Plus and higher. For many SMEs, that is the reason to choose Plus over Standard. Find out more about the broader approach in our guide to zero trust for SMEs.

Lock down Drive sharing

The most common misconfiguration in Workspace is "anyone with the link can view" as the default in Drive. In an average SME, that means hundreds of documents that are accidentally public. What to do:

• Set the organisation default to "Off (restricted)" for new files.
• Limit sharing outside your domain to specific email addresses (no link sharing).
• Set expiry dates on external shares (for example 30 or 60 days), so old shared links expire automatically.
• Don't publish files to the public web unless there is an explicit business reason to do so.
• Monitor Drive audit logs for mass downloads and for sharing with external accounts.

For businesses that handle a lot of customer or supplier documents (think construction drawings, financial reports, medical records), this is not a luxury. It is the line between being GDPR-compliant and suffering a data breach you never saw coming.

Email: get SPF, DKIM and DMARC in order

Workspace filters spam and phishing well, but it won't stop phishing emails that pretend to come from your own employees (spoofing). That's what SPF, DKIM and DMARC are for. In short:

• SPF tells the recipient which servers are allowed to send on behalf of your domain.
• DKIM digitally signs outgoing mail so the recipient can verify that it hasn't been tampered with.
• DMARC ties the two together and tells the recipient what to do if something doesn't add up.

Start DMARC at p=none to monitor, then move to p=quarantine and finally p=reject once you're sure all legitimate mail passes SPF/DKIM. Our separate explainer on SPF, DKIM and DMARC walks you through it step by step.

In Workspace, also turn on "Enhanced pre-delivery message scanning", together with external image stripping for incoming mail with attachments. For targeted phishing and business email compromise that gets past your basic filter, staff awareness training is the most important additional layer. Find out more in our guide to advanced email security.

Endpoints and mobile: only managed devices get access to your data

Google's endpoint management (built into Workspace) lets you enforce basic security on the devices that access your data: screen lock, encryption, mandatory updates, and remote wipe if a device is lost. Business Plus gives you advanced management with more control over Android and iOS, and the option to allow only managed devices via context-aware access.

The practical minimum for SMEs:

• Mandatory screen lock with a strong PIN or biometrics.
• Mandatory encryption on mobile devices and laptops.
• A work profile on Android or a Managed Apple ID on iPhone to separate business data from personal data.
• Remote wipe available if a device is lost or an employee leaves.

For a broader device strategy for SMEs, our guide to endpoint management is a good starting point.

Backup: Google doesn't lose data, but you can

A common misconception: "Google runs in the cloud, so my data is safe, right?" Google's infrastructure does indeed rarely lose data through hardware failures. But you can still lose your data through:

• An employee deleting a shared folder that everyone had access to.
• Ransomware on a local laptop encrypting files that then sync.
• A hacked account emptying mailboxes.
• A former employee wiping content before their account is deactivated.

Google offers Vault (in Business Plus and higher) for retention policies and eDiscovery: that helps with compliance and legal matters, but it is not a full backup. For genuine recovery within a reasonable time, you want a third-party Workspace backup (SpinOne, Datto SaaS Protection, BackupVault or similar) that protects Gmail, Drive, Contacts and Calendar every day. This typically costs €3 to €8 per user per month. Read more about backup strategy in our complete backup guide for SMEs.

Passwords, apps and OAuth

If your team still reuses passwords for their Google accounts, choose a business password manager that can integrate with Workspace single sign-on. Restrict third-party OAuth apps in the Admin console: every app that asks for Gmail or Drive access is a potential leak. Work with an allowlist of approved apps and remove unused tokens periodically.

Alerts, logs and the Alert Center

In the Alert Center, turn on notifications for the events that matter: suspicious sign-in attempts, flagged phishing emails, mass external sharing in Drive, unusual admin actions. Route them to a shared security mailbox or to a SIEM/SOC environment. Smaller SMEs without their own security team often opt for a managed detection and response service that picks up these alerts.

What it will cost and where the gains are

The hardening doesn't add huge sums on top of your Workspace licence, but it does take discipline:

• Upgrading from Business Standard to Business Plus if you're serious about context-aware access and Vault: around €7.50 extra per user per month.
• Third-party Workspace backup: €3 to €8 per user per month.
• Security keys for admins: a one-off €50 to €80 per key, two per super admin (primary and backup).
• A one-off implementation project by an IT partner: typically one to three working days for an SME with 10 to 50 users.

The gain is that you eliminate the most common Workspace incidents in one go: hijacked accounts, accidentally shared documents, phishing that arrives looking like it came from your own managing director, and lost data with no way to recover it.

Frequently asked questions about securing Google Workspace

What is the difference between 2SV and MFA in Google Workspace? Google calls its two-factor authentication "2-Step Verification" (2SV); functionally, it is the same as MFA elsewhere. The difference lies in which second factor you allow. Google Prompt and passkeys/security keys are phishing-resistant; SMS and voice are not. For regular users, 2SV with Prompt is already a big step forward; for admins, you want passkeys or hardware keys.

Do I really need Business Plus for security? Not necessarily, but you do for some important controls. Business Standard gives you the basics (2SV, Drive audit, spam/phishing scanning), but context-aware access and Vault retention are only available in Business Plus. If you fall under a compliance regime (for example strict GDPR requirements, NEN 7510 in Dutch healthcare, or the KNB rules for Dutch notaries), Plus is usually unavoidable.

Can I use Workspace securely on employees' personal phones? Yes, provided you enforce a work profile (Android) or use a Managed Apple ID (iPhone). This separates business data from personal apps, and when someone leaves you can wipe only the work profile without touching the employee's photos and family chats. For sensitive roles (finance, HR, management), we recommend a managed company device.

Do I need to set up SPF, DKIM and DMARC if I use Workspace? Yes. Workspace configures a lot automatically, but SPF, DKIM and DMARC are tied to your domain at your DNS provider, and you have to set them up yourself. Without DMARC with a strict policy, attackers can impersonate your domain towards your customers and suppliers, even if the rest of your Workspace is locked down tight.

What should I do if an account appears to have been taken over? Sign in as an admin immediately, force a password reset, sign out all active sessions, revoke suspicious OAuth tokens, check inbox forwarding rules (a classic attacker trick: mail is secretly forwarded elsewhere) and check the audit logs for Drive downloads and external sharing. Report it internally according to your incident protocol and, if personal data has been leaked, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.

What if I'm migrating from Microsoft 365 to Workspace or the other way round? Keep both environments secured temporarily during the migration. In the new environment, get the identity basics right first (2SV, admin hardening, context-aware access) before moving any data. Migrate mail, Drive/OneDrive and calendars in waves, not all at once. Decide beforehand whether the switch makes sense based on functionality and licence costs; our comparison above is a good starting point.

Conclusion

Google Workspace can be made secure for SMEs, but it doesn't happen by itself. The key steps: mandatory 2SV for everyone, phishing-resistant MFA for admins, context-aware access switched on, Drive sharing locked down to restricted, DMARC at reject, managed mobile devices, and a third-party backup for your Workspace data. Put that package in place in the right order and you are resilient against the attacks that hit SMEs most often in 2026.

TRON Group helps Dutch SMEs with exactly this kind of hardening: from 2SV rollout and context-aware access to Drive audits, DMARC configuration, endpoint management and Workspace backup. Want to know whether your Workspace configuration passes the basic checks? Call +31 85 303 5869 or visit our managed IT services page. We'll run the scan together and change the settings that make the real difference.