Cis Gworkspace 3.1.2.1.1.6

3.1.2.1.1.6 Ensure only users inside your organization can distribute content externally

Level

L1

Profile Applicability

• Enterprise Level 1

Type

Manual

Description

You should control who is allowed to distribute organizational content to shared drives owned by another organization.

Rationale

Sharing and collaboration are key; however, only your users should have the authority over where company content is shared with to prevent unauthorized disclosures of information.

Impact

Only people in your organization with Manager access to a shared drive can move files from that shared drive to a Drive location in a different organization.

In addition, users in the selected organizational unit or group can copy content from their My Drive to a shared drive owned by a different organization.

Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Drive and Docs
5. Under Sharing settings, select Sharing options
6. Under Distributing content outside of <Company>, ensure Only users in <Company> is selected

Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Drive and Docs
5. Under Sharing settings, select Sharing options
6. Under Distributing content outside of <Company>, select Only users in <Company>
7. Select Save

Default Value

Distributing content outside of <Company> is Anyone

CIS Controls