Gmail Baseline Report

### Secure Cloud Business Applications (SCuBA)

### Baseline Documents

# Gmail Baseline Report

Customer Name | Customer Domain | Customer ID | Report Date | Baseline Version | Tool Version
--- | --- | --- | --- | --- | ---
Cool Example Org | example.org | ABCDEFG | 06/26/2025 16:02:22 Pacific Daylight Time | 0.5 | v0.5.0

## GMAIL-1 Mail Delegation

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.1.1v0.5 | Mail Delegation SHOULD be disabled. | Warning | Should | The following OUs are non-compliant: Michael Carey's OU: Mail delegation is enabled

## GMAIL-2 DomainKeys Identified Mail

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.2.1v0.5 | DKIM SHOULD be enabled for all domains. | Warning | Should | 1 of 2 agency domain(s) found in violation: carroll.com.

## GMAIL-3 Sender Policy Framework

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.3.1v0.5 | An SPF policy SHALL be published for each domain that fails all non-approved senders. | Fail | Shall | 2 of 2 agency domain(s) found in violation: example.org, carroll.com.

## GMAIL-4 Domain-based Message Authentication, Reporting, and Conformance

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.4.1v0.5 | A DMARC policy SHALL be published for every second-level domain. | Fail | Shall | 1 of 2 agency domain(s) found in violation: example.org.
GWS.GMAIL.4.2v0.5 | The DMARC message rejection option SHALL be p=reject. | Fail | Shall | 1 of 2 agency domain(s) found in violation: example.org.
GWS.GMAIL.4.3v0.5 | The DMARC point of contact for aggregate reports SHALL include `reports@dmarc.cyber.dhs.gov`. | Fail | Shall | 1 of 2 agency domain(s) found in violation: example.org.
GWS.GMAIL.4.4v0.5 | An agency point of contact SHOULD be included for aggregate and failure reports. | Warning | Should | 1 of 2 agency domain(s) found in violation: example.org.

## GMAIL-5 Attachment Protections

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.5.1v0.5 | Protect against encrypted attachments from untrusted senders SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.5.2v0.5 | Protect against attachments with scripts from untrusted senders SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.5.3v0.5 | Protect against anomalous attachment types in emails SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.5.4v0.5 | Google SHOULD be allowed to automatically apply future recommended settings for attachments. | Pass | Should | Requirement met in all OUs and groups.
GWS.GMAIL.5.5v0.5 | Emails flagged by the above attachment protection controls SHALL NOT be kept in inbox. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.5.6v0.5 | Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please check manually.

## GMAIL-6 Links and External Images Protection

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.6.1v0.5 | Identify links behind shortened URLs SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.6.2v0.5 | Scan linked images SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.6.3v0.5 | Show warning prompt for any click on links to untrusted domains SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.6.4v0.5 | Google SHALL be allowed to automatically apply future recommended settings for links and external images. | Pass | Should | Requirement met in all OUs and groups.
GWS.GMAIL.6.5v0.5 | Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please manually check.

## GMAIL-7 Spoofing and Authentication Protection

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.7.1v0.5 | Protect against domain spoofing based on similar domain names SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.7.2v0.5 | Protect against spoofing of employee names SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.7.3v0.5 | Protect against inbound emails spoofing your domain SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.7.4v0.5 | Protect against any unauthenticated emails SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.7.5v0.5 | Protect your Groups from inbound emails spoofing your domain SHALL be enabled. | Pass | Shall | Requirement met in all OUs and groups.
GWS.GMAIL.7.6v0.5 | Emails flagged by the above spoofing and authentication controls SHALL NOT be kept in inbox. | Fail | Shall | The following OUs are non-compliant: Cool Example Org: domain, domain name, employee name, groups, unauthenticated spoof emails not removed from inbox
GWS.GMAIL.7.7v0.5 | Google SHALL be allowed to automatically apply future recommended settings for spoofing and authentication. | Warning | Should | The following OUs are non-compliant: Cool Example Org: Automatically enable all future added settings is set to: disabled
GWS.GMAIL.7.8v0.5 | Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please manually check.

## GMAIL-8 User Email Uploads

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.8.1v0.5 | User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment. | Pass | Shall | Requirement met in all OUs and groups.

## GMAIL-9 POP and IMAP Access for Users

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.9.1v0.5 | POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients. | Fail | Shall | The following OUs are non-compliant: Michael Carey's OU: IMAP and POP access are enabled Cool Example Org: IMAP and POP access are enabled

## GMAIL-10 Google Workspace Sync

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.10.1v0.5 | Google Workspace Sync SHOULD be disabled. | Pass | Shall | Requirement met in all OUs and groups.

## GMAIL-11 Automatic Forwarding

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.11.1v0.5 | Automatic forwarding SHOULD be disabled, especially to external domains. | Pass | Shall | Requirement met in all OUs and groups.

## GMAIL-12 Per-user Outbound Gateways

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.12.1v0.5 | Using a per-user outbound gateway that is a mail server other than the Google Workspace mail servers SHALL be disabled. | Pass | Shall | Requirement met in all OUs and groups.

## GMAIL-13 Unintended External Reply Warning

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.13.1v0.5 | Unintended external reply warnings SHALL be enabled. | Fail | Shall | The following OUs are non-compliant: Cool Example Org: Warn for external participants is set to disabled Log-based check. See limitations.

## GMAIL-14 Email Allowlist

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.14.1v0.5 | An email allowlist SHOULD not be implemented. | Pass | Should | Email allowlists are disabled in Cool Example Org.

## GMAIL-15 Enhanced Pre-Delivery Message Scanning

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.15.1v0.5 | Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing. | Fail | Shall | The following OUs are non-compliant: Cool Example Org: Enhanced pre-delivery message scanning is disabled
GWS.GMAIL.15.2v0.5 | Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please manually check.

## GMAIL-16 Security Sandbox

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.16.1v0.5 | Security sandbox SHOULD be enabled to provide additional protections for their email messages. | No events found | Should | No relevant event in the current logs for the top-level OU, Cool Example Org. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended. Log-based check. See limitations.
GWS.GMAIL.16.2v0.5 | Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please manually check.

## GMAIL-17 Comprehensive Mail Storage

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.17.1v0.5 | Comprehensive mail storage SHOULD be enabled to allow tracking of information across applications. | N/A | Should/Not-Implemented | Currently not able to be tested automatically; please manually check.

## GMAIL-18 Spam Filtering

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.GMAIL.18.1v0.5 | Domains SHALL NOT be added to lists that bypass spam filters. | N/A | Shall/Not-Implemented | Currently not able to be tested automatically; please manually check.
GWS.GMAIL.18.2v0.5 | Domains SHALL NOT be added to lists that bypass spam filters and hide warnings. | N/A | Shall/Not-Implemented | Currently not able to be tested automatically; please manually check.
GWS.GMAIL.18.3v0.5 | Bypass spam filters and hide warnings for all messages from internal and external senders SHALL NOT be enabled. | N/A | Shall/Not-Implemented | Currently not able to be tested automatically; please manually check.