Cis Gworkspace 4.2.2.1

4.2.2.1 Ensure blocking access from unapproved geographic locations

Profile Applicability

• Enterprise Level 1

Description

Restrict access to selected Google applications by geographic location.

Rationale

Restricting access to known/approved geographic locations is a simple way to limit where attacks can originate from. Especially for smaller organizations that do not need global access to applications.

Impact

Valid/approved users traveling to a geographic region outside of those defined in the Access Level will not be able to access their applications.

Audit

To verify this setting via the Google Workspace Admin Console:

Verify an appropriate Access Level has been defined

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Context-Aware Access
5. Select Access levels
6. Review the list of Access Levels displayed and determine if there is an appropriate restriction on geographic access

Verify the appropriate Access Level has been assigned to the application(s) that need the restriction

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Context-Aware Access
5. Select Assign access levels
6. Review the list of Google Applications displayed and make sure the appropriate access level for geographic access is assigned to each

NOTE: CIS recommends geographically restricting access to the following Google applications at minimum:

1. Admin Console
2. Drives and Docs
3. Gmail
4. Google Vault

Remediation

To configure this setting via the Google Workspace Admin Console:

Create an appropriate Access Level

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Context-Aware Access
5. Select Access levels
6. Select Create Access Level
7. Under Details - Name the Access Level (Suggested using a clear name - ex. "Restrict to USA")
8. Under Conditions - Select Basic
9. Under Condition 1 - Select Meet attributes
10. Under Condition 1 - Select Add Attribute
11. Click on the Add Attribute drop-down box and select Geographic origin
12. Click on the far right drop-down box and select the region, or regions, to be allowed (ex. United States)
13. Click Save

Assign the defined Access Level to the application(s) that need the restriction

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Context-Aware Access
5. Select Assign access levels
6. For each application listed that needs this restriction, select Assign
7. Under, Access is granted when a user meets conditions in at least one of the selected access levels, ensure the previously named Access Level (ex. "Restrict to USA") is checked
8. Also, ensure Apply to Google desktop and mobile apps is checked

NOTE: CIS recommends geographically restricting access to the following Google applications at minimum:

1. Admin Console
2. Drives and Docs
3. Gmail
4. Google Vault

Default Value

None

CIS Controls