Cis Gworkspace 4.2.3.1

4.2.3.1 Ensure DLP policies for Google Drive are configured

Profile Applicability

• Enterprise Level 1

Description

Enabling Data Loss Prevention (DLP) policies for Google Drive allows organizations to control the content that users can share in Google Drive files outside the organization.

Rationale

Enabling DLP policies alerts users and administrators that specific types of data should not be exposed, helping to protect the data from accidental exposure. DLP gives you control over what users can share, and prevents unintended exposure of sensitive information such as credit card numbers or identity numbers.

Impact

Configuring a DLP policy for Google Drive will detect or block sensitive information.

Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Data protection
5. Select Manage Rules
6. Ensure data protection rules exist and are enabled

Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Security
3. Select Access and Data Control
4. Select Data protection
5. Select Manage Rules
6. Select ADD RULE, then select either New rule or New rule from template

New rule

Examples can be found in Google documentation.

1. Set the rule Name
2. Optionally - Set the rule Description
3. Set the Scope as appropriate
4. Select Continue
5. Set Triggers by checking File modified under Google Drive
6. Select ADD CONDITION and configure values (Field, Comparison Operator, Content to match) - Repeat as appropriate
7. Select Continue
8. Under Actions, select the desired action to take for each incident
9. Under Alerting, select the desired severity level
10. Under Alerting, Select Send to alert center
11. Select Continue
12. Select Create

New rule from template

1. Select the desired rule template
2. Optionally set the Name as desired
3. Optionally set the Description as desired
4. Set the Scope as appropriate
5. Select Continue
6. Modify preconfigured Conditions as desired, or add additional conditions
7. Select Continue
8. Under Alerting, Select Send to alert center
9. Select Continue
10. Select Create

Default Value

No DLP policies for Google Drive are configured by default

References

1. https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F10846568%3Fvisit_id%3D638058685723082013-4065283876&product_context=10846568&product_name=UnuFlow&trigger_context=a
2. https://workspaceupdates.googleblog.com/2020/10/data-protection-dlp-reports.html

CIS Controls