1. Your files
Keep files in shared drives.
A file in someone's My Drive belongs to that person's account. A file in a shared drive belongs to the organization, so it stays when they leave.
Do this: Drive → Shared drives → New. Start with one folder everyone uses, like Board or Finance.
2. Your inbox
Make info@ a group, not a login.
A shared password leaves with whoever knew it. A Google Group delivers info@ to the right people, and you add or remove someone in one click.
Do this: Admin console → Directory → Groups → Create group. Turn on Collaborative Inbox to assign messages.
3. Your logins
Require 2-Step Verification.
A stolen password stops being enough. In Google's own research, a phone prompt blocked 100% of automated attacks and 99% of bulk phishing.
Do this: Admin console → Security → Authentication → 2-step verification → Enforcement: On. Pick a date a week out so staff can enroll.
Only have time for one? Do number three. Not on Google Workspace yet? It's free for 501(c)(3)s, and the application takes about 20 minutes.
Want a second set of eyes on your setup?
Bring your Workspace questions. In 30 minutes you'll know what to fix first, and most of it you can do yourself.
Book a Free 30-Minute CallSources
- Google: transfer Drive files to a new owner — My Drive files belong to the user and must be transferred when they leave
- Google: Collaborative Inbox in Google Groups — turning a group into a shared inbox and assigning conversations
- Google: about 2-Step Verification enforcement — enforcing 2SV now or from a chosen date
- Google Security Blog: how effective is basic account hygiene — the 2019 study behind the 100% and 99% figures