A security partner for the way your team works
Atlant Security helps organisations define and improve the controls protecting their Google Workspace environment. Start with a bounded security review, agree the changes that matter, and assign responsibility for keeping the configuration effective as people, applications and working practices change.
This service fits IT teams that need specialist support, organisations reviewing external access, and businesses that want a clear hardening plan before committing to recurring work. We can work alongside your existing Workspace administrator or managed IT provider.
Atlant Security is an independent security services provider. “Partner” describes the working relationship with your organisation; this page does not claim Google accreditation, reseller status or endorsement.
What the engagement can cover
| Workstream | Questions we examine | Output to agree |
|---|---|---|
| Identity and administration | Who has administrative power? How are sign-in protection, recovery, SSO and leaver access handled? | Privileged-access review, exceptions and an agreed account-protection plan. |
| Gmail security | Which sending services, forwarding arrangements, routing rules and business processes need protection? | Mail-flow review and a staged plan for authentication and protective settings. |
| Drive and collaboration | Which files and shared drives need external access? Who owns membership and sharing exceptions? | Sharing-boundary review with business-approved changes and ownership. |
| OAuth and connected apps | Which applications access Workspace data, for what purpose, and with whose approval? | Application-access inventory and decisions about permitted access. |
| Devices and access conditions | Which managed and personal devices are allowed, and which controls are available in your edition? | An access-policy plan with rollout dependencies and user-impact checks. |
| Logs and response readiness | What events can be reviewed, who receives alerts, and who can authorise containment? | A logging and escalation map with clear gaps and operational responsibilities. |
Google documents controls for reviewing applications and their requested OAuth scopes. Our review connects that access to business ownership and approval decisions. See Google’s app-access documentation.
Assessment, hardening and ongoing support
Choose the delivery model that addresses your current gap. An assessment identifies risks and priorities. Hardening implements agreed changes. Recurring support establishes an agreed review cadence and ownership. These are separately scoped activities, so the proposal should identify which are included.
- Establish the baseline: confirm edition, organisational structure, identities, integrations and existing policies; agree the evidence and access needed.
- Explain the findings: document the setting or process observed, its business relevance, recommended action and any uncertainty.
- Implement approved changes: use a pilot group where appropriate, name the change approver, and agree validation and rollback before broader rollout.
- Verify and hand over: check the agreed result, record remaining exceptions and assign the next review to a named owner.
If ongoing monitoring is required, define supported data sources, review hours, escalation and response authority in the proposal. A configuration assessment alone does not establish a staffed SOC or an incident-response retainer.
What you should receive
- An executive summary of the material risks and decisions.
- A prioritised technical action register tied to the evidence reviewed.
- Licence and access dependencies for each proposed improvement.
- An implementation record for changes included in the engagement.
- An exception register with owners and review dates.
- A handover session and a clear boundary between your team, Atlant Security and other providers.
Acceptance should be specific. For example, an external-sharing change needs an agreed policy, a test with representative collaborators, an approved exception path and evidence that the intended restriction works. A screenshot of a setting is not the whole acceptance check.
Work with the edition you actually have
We confirm the Workspace edition and available administrative privileges before promising specific controls or investigation workflows. Google states that investigation data-source access depends on edition and privileges. A proposal should distinguish available capabilities from changes that need additional licensing. Check Google’s data-source guidance.
Google Workspace and Google Cloud infrastructure are different scopes. If you also need workload, project or cloud IAM review, include that explicitly through our cloud security services. For a concise overview of the Workspace workstream, see Google Workspace security assessment and hardening.
Prepare for the first conversation
Bring approximate numbers and operational context: Workspace edition, users, domains, SSO provider, device-management arrangements, current administrator or MSP, material integrations and any deadline. Describe whether the priority is an initial review, implementation support, a recurring review service or response readiness.
Do not send passwords, recovery codes, tokens or mailbox contents through the website. Agree confidentiality and a suitable access method after the initial discussion. Read our guide to choosing a Google Workspace security partner for questions to use when comparing proposals.
Discuss your Google Workspace security scope
Tell us your edition, approximate user count, current IT arrangements and the problem you want to solve.
Choose Google Workspace, then the support you need. You can attach your NDA or RFP when sending the request. Or contact Atlant Security to discuss the engagement before a proposal.
Questions about the service
Can you work with our existing IT provider?
Yes. Scope the division of responsibility: who provides evidence, approves changes, implements them, verifies results and handles later exceptions. Security support does not automatically require replacing your current administrator.
Will you need super administrator access?
Access is agreed for the specific work. Start with evidence and the least privileges needed; any elevated access must have a stated purpose, approval and removal plan. Do not share administrator credentials through the enquiry form.
Is ongoing monitoring included?
Only where expressly agreed. The proposal must name coverage, data sources, alert ownership and response boundaries. A review or hardening project does not imply continuous monitoring.
What determines the price?
Edition, organisational complexity, users, domains, integrations, evidence availability and whether you need review, implementation or recurring support. We agree the scope before quoting; this page does not promise a fixed package price.
