For most small companies, one Google Workspace admin console controls email, files, calendars and every staff login, which makes it the single most valuable system to secure. Business plans cover up to 300 users, start at $7 per user per month, and all include 2-Step Verification. This guide works through the settings Google recommends for teams of 1 to 100 users and explains when a higher edition is worth paying for.
What each Workspace edition gives you for security
Google raised Business plan prices in January 2025 when it folded Gemini into Business and Enterprise editions. Annual Business Starter went from $6 to $7 per user per month, Standard from $12 to $14 and Plus from $18 to $22, with flexible monthly plans at $8.40, $16.80 and $26.40. Every edition lists 2-Step Verification, group-based policy controls and the Advanced Protection Program.
The real security differences start at Business Plus, which adds Vault for retention and eDiscovery, Secure LDAP and advanced endpoint management. Enterprise adds data loss prevention, context-aware access, data regions and S/MIME. For many small teams, Starter or Standard with the settings below is a sound baseline, and Plus becomes worth it once you need legal hold or tighter device control.
| Plan | Annual price per user per month | Flexible price | Storage per user | Security additions |
|---|---|---|---|---|
| Business Starter | $7 | $8.40 | 30 GB pooled | Base security controls, fundamental endpoint management |
| Business Standard | $14 | $16.80 | 2 TB pooled | Same security controls as Starter |
| Business Plus | $22 | $26.40 | 5 TB pooled | Vault, eDiscovery, Secure LDAP, advanced endpoint management |
| Enterprise | Contact sales | Contact sales | 5 TB, more on request | DLP, context-aware access, data regions, S/MIME |
Lock down the administrator accounts
A super admin can read any mailbox, reset any password and change DNS-linked settings, so treat these accounts as the keys to the company. Google's small business checklist asks for a second super admin so work can continue if one account is lost, recovery phone and email on every admin, and printed backup codes stored securely. It also advises against staying signed in as a super admin: sign in for a specific task, then sign out, and use a limited admin role for daily administration.
Google is also making 2-Step Verification compulsory for admins. Super admins get about 90 days' notice and other admins about 60 days. An admin who still has not enrolled loses access to Workspace apps on mobile after 15 days and to web apps after 30 days, and the rule cannot be bypassed. It is simpler to enrol every admin now than to wait for the countdown.
Enforce 2-Step Verification for every user
Stolen credentials were the initial access vector in 22% of breaches in Verizon's 2025 DBIR, more than any other route. In the Admin console, go to Security, then Authentication, then 2-Step Verification. Allow users to enrol first, check enrolment status, then schedule enforcement for each organisational unit or group, which avoids locking out staff on the day you switch it on.
Choose the strongest method people will actually use. Google Prompt and authenticator apps are better than SMS codes, and security keys or passkeys are stronger still because they resist phishing. Since July 2026 the Google Credential Provider for Windows also accepts FIDO2 security keys and phone passkeys as a second factor at the Windows sign-in screen, which helps teams that use Workspace identities on company laptops. Put finance and HR staff on security keys first.
- Security, Authentication, 2-Step Verification: allow enrolment
- Check enrolment reports before enforcing
- Schedule enforcement by organisational unit
- Enrol admins and finance staff in the Advanced Protection Program
Harden Gmail against phishing and spoofing
Phishing was the most common starting point for breaches in India in IBM's 2025 study, at 18%. Google's checklist recommends two Gmail settings worth checking: enhanced pre-delivery message scanning, which gives Gmail more time to catch phishing, and additional screening of attachments, links and external images. Both are under Apps, Google Workspace, Gmail in the Admin console.
Protect your own domain as well. Gmail's sender guidelines require SPF or DKIM from every sender and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day. Turn on DKIM signing in the Admin console, publish SPF and a DMARC record, and keep the spam rate in Postmaster Tools below 0.3%. This stops attackers sending convincing mail from your exact domain to your customers.
Control sharing in Drive and Calendar
Not every leak needs an attacker. A contract shared with anyone who has the link, or a calendar that shows client names to outsiders, exposes data just as surely. Google's checklist recommends turning off link sharing by default so a new file is visible only to its creator until it is shared, and showing a warning before anyone shares a file outside the company.
For Calendar, restrict external sharing to free or busy information only, so meeting titles and attendee lists stay internal. Review the Drive sharing report every quarter for files shared publicly or with personal Gmail addresses, and move shared files out of personal My Drive folders into shared drives so they stay with the company when someone leaves.
Devices, apps and updates
Verizon found that 46% of systems in infostealer logs holding corporate logins were unmanaged devices mixing personal and business credentials. That is the case for at least fundamental endpoint management, which every Business plan includes: require a screen lock, see which devices hold company data, and wipe company accounts from lost phones. Business Plus adds advanced management for company-owned devices.
Google's checklist also asks admins to make sure browsers and apps update automatically, or to set this centrally for Chrome. Review third-party apps connected through OAuth, block those you do not recognise, and limit which apps can request access to Gmail and Drive data. Each connected app is another vendor with a key to your data.
Baseline settings checklist
These settings come from Google's own small business checklist and its admin documentation. Together they close the main routes into a small Workspace tenant: weak logins, phishing, spoofed mail, careless sharing and lost devices. XDQ Labs reviews Workspace tenants for small teams that want a second pair of eyes on this baseline.
| Setting | Where in the Admin console | Why it matters |
|---|---|---|
| Second super admin and recovery info | Account, Admin roles | Prevents lock-out if one admin account is lost |
| 2-Step Verification enforced | Security, Authentication | Credentials started 22% of breaches in the 2025 DBIR |
| Enhanced pre-delivery scanning | Apps, Gmail, Spam, phishing and malware | Catches more phishing before delivery |
| DKIM signing and SPF | Apps, Gmail, Authenticate email | Required by Gmail sender guidelines |
| Link sharing off by default | Apps, Drive and Docs, Sharing settings | New files stay private until shared |
| External sharing warning | Apps, Drive and Docs, Sharing settings | Prompts users before files leave the company |
| Calendar free or busy only externally | Apps, Calendar, Sharing settings | Keeps meeting details internal |
| Endpoint management on | Devices, Mobile and endpoints | Lets you wipe company data from lost devices |
When to move up to Business Plus or Enterprise
Upgrade to Business Plus when you need to keep email and files for legal or regulatory reasons, because Vault gives retention rules, legal hold and eDiscovery that the cheaper plans lack. Plus is also the step for companies that hand out laptops and want advanced endpoint management. At $22 per user per month on an annual plan, the cost difference from Standard is $8 per user.
Enterprise makes sense when you handle sensitive data at scale: DLP rules can stop card numbers or ID numbers leaving in email, and context-aware access can block sign-ins from unmanaged devices or unexpected locations. With a FIDO Alliance and HID survey finding that only 13% of organisations have deployed passkeys at scale, stronger access controls remain the area where most small tenants have the most room to improve.
Frequently asked questions
Does Google Workspace Business Starter include 2-Step Verification?
Yes. Google lists 2-Step Verification, group-based policy controls and the Advanced Protection Program on every Workspace edition, including Business Starter at $7 per user per month on an annual plan. What Starter lacks are Vault, advanced endpoint management and the data loss prevention and context-aware access found in higher editions.
Is 2-Step Verification mandatory for Google Workspace admins?
Google is rolling out compulsory 2-Step Verification for all administrator accounts. Super admins get about 90 days' notice and other admins about 60 days. Admins who do not enrol lose mobile app access after 15 days and web app access after 30 days, and the requirement cannot be bypassed.
How much does Google Workspace cost per user in 2026?
Google lists Business Starter at $7, Business Standard at $14 and Business Plus at $22 per user per month on an annual plan. Flexible monthly plans cost $8.40, $16.80 and $26.40. Enterprise pricing is through sales. Business plans support up to 300 users.
Which Google Workspace plan includes Vault?
Vault is included from Business Plus upward, along with eDiscovery, Secure LDAP and advanced endpoint management. Business Starter and Business Standard do not include Vault. Enterprise editions add data loss prevention, context-aware access, data regions and S/MIME on top of what Business Plus offers.
Sources
- Google Workspace plans and pricing, Google Workspace, 2026
- Google Workspace raising prices as Gemini gets included in Business and Enterprise plans, 9to5Google, 2025
- Security checklist for small businesses (1 to 100 users), Google Workspace Admin Help, 2026
- About 2SV enforcement for admins, Google Workspace Admin Help, 2026
- Google adds FIDO2 keys and phone passkeys to Windows login via GCPW, Help Net Security, 2026
- Email sender guidelines, Gmail Help, 2026
- 2025 Data Breach Investigations Report (full report), Verizon Business, 2025
- India Records Highest Average Cost of a Data Breach: IBM Cost of a Data Breach Report 2025, IBM India Newsroom, 2025
- Microsoft and Google push passkeys deeper into workplace authentication, Biometric Update, 2026
