Business Gmail Security: Best Practices for Protecting Your Company

Why business email security matters

Email remains one of the main entry points into a business. Fake invoices, phishing links, malicious attachments, supplier impersonation and credential theft often begin with a message that appears legitimate.

Using business Gmail through Google Workspace adds administration and security controls that are not available in the same way in a personal account. However, no platform can fully protect an organization when accounts are poorly configured or people do not recognize warning signs.

Email security depends on three areas:

• Technical configuration.
• User administration.
• Human behavior.

Enable two-step verification

Two-step verification adds another check beyond the password.

It can use:

• Authenticator applications.
• Security keys.
• Device prompts.
• Backup codes.
• Other methods allowed by the organization.

For a business, two-step verification should be enforced rather than left as an optional recommendation.

Before enforcing it:

• Confirm that every person has a valid method.
• Prepare backup codes.
• Define account recovery procedures.
• Test with a small group.
• Document what to do when a device is lost.

Administrative accounts should use phishing-resistant methods such as security keys whenever possible.

Reduce the number of administrators

Not everyone needs administrative privileges.

An administrator can modify users, reset passwords, change policies and access critical settings. Broad access increases the impact of mistakes and compromised accounts.

Good practice includes:

• Keeping few super administrators.
• Creating limited administrative roles for specific tasks.
• Avoiding the administrator account for daily work.
• Protecting administrative accounts with stronger verification.
• Reviewing who still has privileges.
• Maintaining more than one trusted administrator to prevent lockout.

Use unique passwords

Every account should have a unique password.

Reusing the same password across personal and business services allows an external breach to compromise company email.

A strong password should:

• Be long.
• Be difficult to guess.
• Avoid personal information.
• Not be reused.
• Be stored in a trusted password manager.

Changing passwords too frequently does not always improve security when people create predictable variations. Avoiding reuse, enabling two-step verification and responding to compromise are more important.

Recognize phishing attempts

A phishing message tries to persuade someone to provide credentials, download a file or take an urgent action.

Common warning signs include:

• A sender address that looks similar but is not identical.
• An unusual domain.
• An urgent payment request.
• An unexpected bank account change.
• A link that does not match the named website.
• An unsolicited attachment.
• A request to disable security.
• A request for a password or verification code.
• Writing that feels unusual for the supposed sender.

Before acting:

• Check the full sender address.
• Hover over links.
• Confirm through another channel.
• Never share verification codes.
• Do not open unexpected files.
• Report the message to the appropriate administrator.

Protect against supplier fraud

A common attack impersonates a supplier and requests payment to a different bank account.

Businesses should define a formal process:

• Confirm every bank change through another channel.
• Require approval from more than one person.
• Never accept a change only by email.
• Verify new details with a known contact.
• Compare invoices with orders and contracts.

Email security does not replace administrative controls.

Configure SPF, DKIM and DMARC

These records help authenticate messages sent from the domain.

SPF

SPF identifies which servers are authorized to send email for the domain.

An incomplete setup may allow impersonation. An incorrect setup may affect legitimate email.

DKIM

DKIM adds a cryptographic signature to outgoing messages.

The receiving server can verify that the message was not altered and that the signature belongs to the configured domain.

DMARC

DMARC tells receiving systems what to do when SPF or DKIM checks fail and supports reporting.

Begin with a monitoring policy, analyze reports and strengthen it gradually. Enforcing a strict policy without reviewing authorized senders may block legitimate email from forms, billing systems, CRM platforms or marketing services.

Review connected applications

People can authorize external applications to access Gmail, Drive, Calendar and other services.

An old, unnecessary or untrusted application may retain access to business data.

Businesses should:

• Review authorized applications.
• Remove unused access.
• Limit unverified applications.
• Define which services may connect.
• Evaluate requested permissions.
• Document business integrations.

Not every application needs full access to email or all files.

Check forwarding and rules

A compromised account may create filters or rules to hide messages, forward information or delete alerts.

Review:

• Forwarding addresses.
• Gmail filters.
• Inbox rules.
• Delegation.
• Automatic replies.
• Blocked addresses.
• POP and IMAP settings.

Changing the password is not enough after suspected compromise. Persistent settings must also be reviewed.

Keep recovery methods current

Phone numbers, alternate email addresses and recovery methods should belong to the correct person or organization.

When someone changes roles or leaves:

• Update recovery information.
• Remove old devices.
• Close sessions.
• Revoke tokens.
• Change service owners.
• Review aliases and groups.

Outdated recovery details may let a former worker retain access.

Protect devices

Business email also depends on the device used to access it.

Good practice includes:

• Screen lock.
• Device encryption.
• Updated operating system.
• Updated browser.
• Antivirus or equivalent protection.
• Limited application installation.
• Remote wipe capability.
• Separation between personal and work profiles.

Do not save passwords in browsers on shared computers.

Review suspicious activity

The Admin console and available logs can help review access and configuration activity.

Watch for:

• Sign-ins from unexpected locations.
• Unknown devices.
• Unrequested password changes.
• New rules or forwarding.
• Large downloads.
• New applications.
• Administrative permission changes.
• Sent messages the person does not recognize.

Exact reports and alerts depend on the Google Workspace edition.

Prepare an incident response procedure

The business should know what to do before an incident occurs.

A basic procedure may include:

• Temporarily suspend the account.
• Reset the password.
• Revoke sessions and tokens.
• Review rules, forwarding and applications.
• Check sent messages.
• Analyze shared files.
• Notify affected people.
• Record the incident.
• Correct the cause.
• Review related accounts.

Fast action reduces impact.

Train the team

Training does not need to be long to be useful.

A simple program may cover:

• Real phishing examples.
• Domain and link checking.
• Payment procedures.
• Two-step verification.
• Handling attachments.
• Reporting suspicious messages.
• Protecting verification codes.
• Information-sharing rules.

Short, regular sessions are often better than one annual training event.

Common mistakes

Sharing passwords

This removes accountability and makes secure recovery difficult.

Using one generic account for several people

Use groups, aliases, delegation or collaborative inboxes when appropriate.

Ignoring access alerts

An alert may be the first sign of a compromised account.

Keeping accounts for former workers

Offboarding should happen promptly through a documented process.

Trusting only the spam filter

Attackers adapt messages to look legitimate. Human review remains necessary.

Enforcing strict DMARC before analyzing senders

This may block legitimate forms, CRM platforms, billing systems and external services.

Business Gmail security checklist

• Two-step verification is enabled.
• Administrators use stronger protection.
• There are few super administrators.
• Passwords are unique.
• Recovery methods are current.
• Connected applications are reviewed.
• SPF is configured.
• DKIM is enabled.
• DMARC is implemented gradually.
• Bank changes are confirmed through another channel.
• Onboarding and offboarding procedures exist.
• Devices are protected.
• The team receives training.
• An incident response plan exists.

Conclusion

Business Gmail can provide a strong security foundation, but real protection depends on configuration and administration.

The most important measures are enforcing two-step verification, limiting administrators, authenticating the domain with SPF, DKIM and DMARC, reviewing applications and training the team.

Read our Google Workspace for business guide for the rest of the environment and its administration criteria.