# Cis Gworkspace 6.8

> Ensure Gmail potential employee spoofing is configured

- Skill: `cyberstrikeus/cis-gworkspace-6-8` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gworkspace-6-8`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gworkspace-6-8/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gworkspace-6-8

---


# 6.8 Ensure Gmail potential employee spoofing is configured

## Profile Applicability

- Enterprise Level 1

## Description

Configuring and enabling the setting that an alert will be generated when Google detects incoming messages are received where a sender's name is in your Google Workspace directory, but the mail is not from your company's domains or domain aliases.

## Rationale

Ensuring that administrators are alerted when the email is being spoofed since this could be an indication of a phishing attempt.

## Impact

This setting should have no impact on the end user but will send emails to super administrators when triggered.

## Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to `https://admin.google.com` as an administrator.
2. Select **Rules**.
3. Under **Google protects you by default** select **View list**.
4. Scroll to **Gmail potential employee spoofing** and select it.
5. Ensure that **Alerts** is set to **On**.
6. Ensure the **Severity** is set to **Medium**.
7. Ensure that **Email Notifications** is set to **On**.
8. Ensure that **Email notification recipients** is set to **All super administrators**.

## Remediation

To verify this setting via the Google Workspace Admin Console:

1. Log in to `https://admin.google.com` as an administrator.
2. Select **Rules**.
3. Under **Google protects you by default** select **View list**.
4. Scroll to **Gmail potential employee spoofing** and select it.
5. Within the **Actions** pane, click the edit pencil on the right side of the pane.
6. Select **Send to alert center** (This will result in the alert being set to On).
7. Set the alert severity to **Medium**.
8. To enable emails when this alert condition is met, select **Send email notifications**. Once enabled, the **All super administrators** option is selected by default.
9. Click **Review** to confirm the values.
10. Click **Update Rule**.
11. Confirm that the **Gmail potential employee spoofing** shows an Alert status of **On** in the list.

## Default Value

Gmail potential employee spoofing is **ON**.

## References

1. https://support.google.com/a/answer/3230421

## CIS Controls

| Controls Version | Control                                         | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------- | ---- | ---- | ---- |
| v7               | 16.13 Alert on Account Login Behavior Deviation |      |      | x    |