Google Workspace

Changing Vendor-supplied Defaults (2.1)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Address Unauthorized Assets

Define Mechanisms for Communicating During Incident Response