Start with the decision you need help making
A useful Google Workspace security engagement should make a decision easier: which access needs tightening, which sharing exceptions are justified, what should be changed first, or who should investigate an alert. Asking only for “a secure tenant” leaves both scope and acceptance open to interpretation.
Write down your desired outcome before comparing providers. A one-time review, an implementation project and recurring operational support require different access, deliverables and pricing. If you need help defining that boundary, explore Atlant Security’s Google Workspace security partner service.
1. Ask for a scope that reflects real use
Give each provider the same short environment summary: edition, approximate users and domains, SSO and device arrangements, current IT provider, external collaborators and important connected applications. State what has prompted the request and when a decision is needed.
Then ask how the review follows business workflows. A finance team may legitimately use a third-party document tool; an external delivery partner may need access to one shared drive. The assessment should explain what access is necessary, who approves it and how unnecessary access is removed.
Google’s security checklists provide an administrator baseline. A supplier’s job should include translating that baseline into your operating context and documenting what remains unresolved.
2. Make provider access part of the proposal
Ask what evidence the provider needs and which tasks require access to your environment. Request a purpose for each administrative permission, a named access owner, an agreed duration and a removal check. Discuss supervised sessions or exports where they can meet the objective.
Avoid an engagement that starts with an unexplained request for permanent super administrator access. Equally, do not assume a limited export supports conclusions about every user, file or historical event. A credible report states what was reviewed, what could not be reviewed and what that means for confidence.
3. Include connected apps and sharing exceptions
Do not limit the discussion to user sign-in settings. Ask whether the provider will examine external collaboration, shared-drive responsibilities and applications that access Workspace data. Google’s app-access controls expose requested OAuth scopes and allow administrators to make access decisions; a business owner still needs to explain why an application is required. Google documents these app-access controls here.
For each material exception, ask for a short decision record: purpose, data involved, owner, permitted access and review date. This gives the administrator a usable maintenance task instead of a list of findings that loses relevance after handover.
4. Separate licence limits from configuration gaps
A proposal should identify your actual edition before recommending a particular investigation workflow. Access to Google’s security investigation data sources depends on Workspace edition and administrative privileges. Ask the provider to show which proposed activities are supported now and which depend on a licence or access change. Google’s data-source documentation is the reference for that distinction.
This is also a budgeting question. Separate the provider’s fees from product licences, implementation effort and recurring operations. If a desired capability is unavailable, the proposal should explain the resulting limitation and the decision required, rather than silently treating it as covered.
5. Compare evidence and ownership, not adjectives
| Ask each provider | Look for a concrete answer |
|---|---|
| What will you deliver? | A sample structure for findings, priorities, evidence, limitations and accountable actions. |
| Who changes settings? | Named customer/provider responsibilities, approval steps and a change window. |
| How do you avoid disruption? | Representative pilot users, business validation and rollback arrangements. |
| How do we accept the work? | Checks that demonstrate the agreed control and its approved exception process. |
| What happens after handover? | An owner, review cadence and route for new users, applications and exceptions. |
| What does monitoring mean? | Named data sources, operating hours, escalation contacts and containment authority. |
As an illustrative acceptance example, consider an external-sharing change. Ask the provider to demonstrate the approved collaboration scenario, an attempted prohibited share, and the process for an exception. Agree representative test accounts and harmless documents. This is a planning example, not a claim about completed client work.
6. Verify commercial claims separately
If a bidder claims Google accreditation or reseller status, ask for current evidence relevant to that claim. Also assess the people doing the work, the proposed scope, confidentiality, insurance requirements and the handover. A commercial relationship with a platform vendor and the quality of a particular security engagement are separate procurement questions.
Atlant Security provides independent security services. Our use of “Google Workspace security partner” describes supporting your organisation; it does not claim Google programme membership or endorsement. See the service scope, deliverables and engagement options.
Turn the comparison into a useful RFP
Keep the initial request short enough to review, but specific enough to price. Include the edition and scale, your current operating model, the decisions you need to make, the review or implementation boundary, the deadline, and the evidence you want at handover. Mark unknowns explicitly.
Our services RFP builder can help you organise those requirements. Select Google Workspace and the relevant service needs, review the brief, and send it with an optional NDA. You can also book a 30-minute discussion before receiving a proposal.
Discuss your Google Workspace security scope
Tell us your edition, approximate user count, current IT arrangements and the problem you want to solve.
Choose Google Workspace, then the support you need. You can attach your NDA or RFP when sending the request. Or contact Atlant Security to discuss the engagement before a proposal.
Google documentation
Published by Atlant Security. Sources, editorial policy and corrections.
