Google Drive and Docs Baseline Report

### Secure Cloud Business Applications (SCuBA)

### Baseline Documents

# Google Drive and Docs Baseline Report

Customer Name | Customer Domain | Customer ID | Report Date | Baseline Version | Tool Version
--- | --- | --- | --- | --- | ---
Cool Example Org | example.org | ABCDEFG | 06/26/2025 16:02:22 Pacific Daylight Time | 0.5 | v0.5.0

## DRIVEDOCS-1 Sharing Outside the Organization

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.1.1v0.5 | Agencies SHOULD disable sharing outside of the organization's domain. | Warning | Should | The following OUs are non-compliant: Cool Example Org: Files owned by users or shared drives can be shared outside of the organization
GWS.DRIVEDOCS.1.2v0.5 | Agencies SHOULD disable users' receiving files from outside of the organization's domain. | Pass | Should | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.3v0.5 | Warnings SHALL be enabled when a user is attempting to share something outside the domain. | Pass | Shall | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.4v0.5 | If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account. | Pass | Shall | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.5v0.5 | Agencies SHALL disable making files and published web content visible to anyone with the link. | Fail | Shall | The following OUs are non-compliant: Cool Example Org: Published web content can be made visible to anyone with a link
GWS.DRIVEDOCS.1.6v0.5 | Agencies SHALL set access checking to recipients only. | Fail | Shall | The following OUs are non-compliant: Glenn Mahoney's OU: Access Checker allows users to share files to recipients only, suggested target audience, or public (no Google account required) Cool Example Org: Access Checker allows users to share files to recipients only, suggested target audience, or public (no Google account required)
GWS.DRIVEDOCS.1.7v0.5 | Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organization. | Pass | Shall | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.8v0.5 | Agencies SHALL set newly created items to have Private to the Owner as the default level of access. | Fail | Shall | The following OUs are non-compliant: Glenn Mahoney's OU: When users create items, the default access is set to: the primary target audience can search and find the item.

## DRIVEDOCS-2 Shared Drive Creation

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.2.1v0.5 | Agencies SHOULD NOT allow members with manager access to override shared drive creation settings. | Pass | Should | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.2v0.5 | Agencies SHOULD NOT allow users outside of their organization to access files in shared drives. | Pass | Should | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.3v0.5 | Agencies SHALL allow users who are not shared drive members to be added to files. | Pass | Shall | Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.4v0.5 | Agencies SHALL NOT allow viewers and commenters to download, print, and copy files. | Fail | Shall | The following OUs are non-compliant: Glenn Mahoney's OU: Viewers and commenters are allowed to download, print, and copy files.

## DRIVEDOCS-3 Security Updates for Files

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.3.1v0.5 | Agencies SHALL enable the security update for Drive files. | Pass | Shall | Requirement met in all OUs and groups.

## DRIVEDOCS-4 Drive SDK

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.4.1v0.5 | Agencies SHOULD disable Drive SDK access. | Pass | Should | Requirement met in all OUs and groups.

## DRIVEDOCS-5 User Installation of Drive and Docs Add-Ons

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.5.1v0.5 | Agencies SHALL disable Add-Ons. | Pass | Shall | Requirement met in all OUs and groups. Log-based check. See limitations.

## DRIVEDOCS-6 Drive for Desktop

Control ID | Requirement | Result | Criticality | Details
--- | --- | --- | --- | ---
GWS.DRIVEDOCS.6.1v0.5 | Google Drive for Desktop SHOULD be enabled only for authorized devices. | Warning | Should | The following OUs are non-compliant: Cool Example Org (group "Dr. John Meza's group"): Drive for Desktop is enabled and can be used on any device. Cool Example Org (group "Christina Nelson's group"): Drive for Desktop is enabled and can be used on any device. Cool Example Org (group "Andrew Lawson's group"): Drive for Desktop is enabled and can be used on any device.