Protect Business Gmail: 9-Step Google Workspace Guide

Default Gmail settings in Google Workspace aren't enough to stop phishing and account takeover unless a business adds several extra layers of protection.

---

"Is there a service that protects business Gmail?" — this is a question Vietify hears constantly from business owners who've just realised their company's Gmail account (via Google Workspace) is the main entry point attackers use: fake invoices, account takeover, malware spread through attachments. The short answer is yes — Vietify provides a full email security service for business Gmail, and this post walks through the exact 9 steps our technical team follows, so anyone — even without technical background — can follow along or understand exactly what their IT provider is doing for them.

Almost every cyberattack against small and medium businesses starts with a phishing email. Gmail on Google Workspace ships with a solid spam filter, but by default it isn't enough to stop targeted phishing, domain spoofing, or account takeover via leaked passwords. Configuring the 9 steps below correctly removes most of that risk.

Step 1: Check Your Current Account Security Posture

Before changing any settings, you need to know where you stand:

1. Sign in to admin.google.com with a Super Admin account
2. Go to Security → Security Center for an overview report
3. Check Reports → Users at risk — accounts with weak passwords, no 2-step verification, or unusual sign-in patterns
4. Note the priority list — usually accounting, management, and anyone with payment approval authority

This step is like a general health check — nothing is changed yet, it just establishes the current risk level before you start configuring anything.

Step 2: Enforce 2-Step Verification (MFA) Organisation-Wide

This is the single most effective measure against account takeover — a stolen password is useless without a second verification factor.

1. Go to Security → Authentication → 2-Step Verification
2. Turn on Enforce for the whole organisation, or per Organizational Unit
3. Set a 1–2 week grace period so staff can register a verification device before being locked out
4. Encourage Google Authenticator or a physical security key instead of SMS — SMS can be intercepted through SIM swap attacks

For critical accounts (accounting, senior management), consider requiring a physical security key instead of a regular OTP code.

Step 3: Configure SPF, DKIM and DMARC — Stop Domain Spoofing

These are three DNS records that stop attackers from sending email that appears to come from your @yourcompany.com domain:

• SPF (Sender Policy Framework): declares which servers are allowed to send email on behalf of your domain
• DKIM (DomainKeys Identified Mail): digitally signs every email to confirm the content wasn't altered in transit
• DMARC (Domain-based Message Authentication): defines what happens to mail that fails SPF/DKIM checks — reject, quarantine, or report only

How to set it up:

1. In Google Admin Console → Apps → Google Workspace → Gmail → Email Authentication, enable DKIM for your domain
2. Go to your domain's DNS manager (wherever you purchased the domain), add the SPF TXT record per Google's instructions
3. Add the DKIM TXT record provided by Google Admin Console
4. Add a DMARC record — start with p=none to monitor for two weeks, then move to p=quarantine or p=reject once you're confident no legitimate mail is being blocked

Important note: without all three records in place, your company domain can still be spoofed to send fraudulent emails to partners or clients — even if your own Gmail account is fully secure.

Step 4: Enable Advanced Anti-Phishing and Malware Filters

Google Workspace has advanced protection options available, but they are not enabled by default:

1. Go to Apps → Google Workspace → Gmail → Safety → Spam, phishing and malware
2. Enable Enhanced ransomware protection — blocks dangerous script-based attachments
3. Enable Warn for messages that appear to impersonate Google's brand (detects fake login pages)
4. Enable Protect against domain spoofing and employee impersonation — flags emails where the display name matches a colleague but the email address doesn't
5. Consider using quarantine mode instead of outright deletion, so IT can review blocked emails for false positives

Step 5: Set Up Alerts for Unusual Sign-In Activity

Google Workspace can automatically notify admins when it detects suspicious behaviour:

1. Go to Reports → Rules in the Admin Console
2. Enable the built-in rules: Suspicious login, Leaked password, Suspicious account activity
3. Configure alerts to go to both the email and phone number of the IT administrator — not just the dashboard
4. Weekly, review the sign-in logs for critical accounts (Reports → Users → Login activity)

Catching a compromise within 5–10 minutes can prevent major damage — attackers usually need time to search for valuable data before acting.

Step 6: Control Third-Party Apps Connected to Gmail

Many employees unintentionally grant Gmail access to unfamiliar apps when signing in with "Sign in with Google". These apps can read email, contacts, and sometimes send email on the user's behalf.

1. Go to Security → API controls → Third-party app access
2. Review the list of apps granted access across the organisation
3. Revoke access for any app of unknown origin or no longer in use
4. Enable Allow only apps that have been reviewed by an admin to access sensitive data (Gmail, Drive, Contacts)

Step 7: Automate Gmail Backup — Protect Against Accidental Deletion and Ransomware

Google Workspace does not automatically back up data with true point-in-time recovery the way a dedicated backup solution does. If email is permanently deleted, encrypted by ransomware spread through an attachment, or an employee leaves and their account is accidentally deleted, data can be lost forever after 25 days (Google's default Trash retention limit).

The fix:

1. Deploy a dedicated third-party backup tool for Google Workspace, scheduled to run daily
2. Apply the 3-2-1 backup rule: 3 copies, 2 different storage media types, 1 copy stored outside the primary system
3. Periodically test the actual restore process — don't just assume backups work because they exist; verify you can actually recover from them

See Vietify's business data backup service for details.

Step 8: Train Staff to Recognise Phishing

Technology only blocks most — not all — phishing emails. The human factor remains the last line of defence, and often the weakest link.

1. Run short 30–45 minute training sessions focused on recognisable signs: unfamiliar sender addresses, urgent payment requests, suspicious shortened links, spelling errors in "official" emails
2. Run phishing simulations quarterly — send simulated phishing emails to measure click rates and adjust training content accordingly
3. Establish a clear reporting process: who staff should notify and what to do when they suspect a phishing email — never handle it on their own
4. Repeat training regularly, not just once — security awareness needs continuous reinforcement

Step 9: Ongoing Monitoring and Periodic Review

Gmail security isn't a one-time task — it requires ongoing monitoring and updates:

• Weekly: review security alerts and unusual sign-ins
• Monthly: audit third-party app access and inactive accounts
• Quarterly: run a phishing simulation, reassess the DMARC policy (consider moving from p=quarantine to p=reject)
• Annually: conduct a full audit of Google Workspace security configuration against Google's latest security recommendations

Frequently Asked Questions

Does Google Workspace fully protect Gmail by default, or does it require extra configuration? Google Workspace ships with a spam filter and some basic protections, but the most important layers — enforced MFA, SPF/DKIM/DMARC, unusual login alerts, and third-party app controls — are not enabled by default and require an admin to actively configure them.

Does a small business (under 10 people) really need all 9 steps? Yes, but you can prioritise by impact: Step 2 (MFA) and Step 3 (SPF/DKIM/DMARC) are essential even for a 3–5 person team, since the cost of a breach isn't proportional to company size. The remaining steps can be rolled out gradually over 1–2 months.

Is implementing these 9 steps expensive? Most steps (2, 3, 4, 5, 6, 9) don't require additional license costs — they just need correct configuration inside the Google Admin Console you already have. Cost mainly comes in at Step 7 (third-party backup tool) and Step 8 (if you outsource professional phishing simulation training).

What if the business uses Microsoft 365 instead of Google Workspace? The same principles apply to Microsoft 365 — MFA, SPF/DKIM/DMARC, Advanced Threat Protection, and Exchange Online backup. Vietify supports both platforms — see Microsoft 365 deployment and business email server services for details.

Conclusion

Yes, there is a dedicated service to protect business Gmail — and the process isn't overly complex if done in the right order: check your current posture → enforce MFA → configure SPF/DKIM/DMARC → enable advanced phishing filters → set up unusual login alerts → control third-party apps → automate backups → train staff → monitor continuously. Skipping any step — especially Step 2 and Step 3 — leaves a significant gap attackers can exploit.

If your business needs to roll out this full 9-step package without an in-house IT team experienced enough to do it, Vietify's technical team in Da Nang is ready to assess and configure everything for you — see the comprehensive cybersecurity package, which includes email protection, MFA, backup and 24/7 monitoring.

If you only need to protect a personal Gmail account (not your company's Google Workspace), see our companion guide: protect your personal Gmail — 10 simple steps anyone can do.

Book a free Gmail security assessment →

---

Vietify IT Services — Business email security in Da Nang and Vietnam, done right, in the right order.