Assured Controls Baseline Report

Assured Controls and Assured Controls Plus are paid add-ons with Google Workspace. This baseline is intended as guidance for agencies that already have these add-ons. Users that choose to implement this baseline should carefully consider the tradeoffs involved, including the potential security benefits, usability impacts, and increased licensing fees for the add-on licenses.

Customer Name	Customer Domain	Customer ID	Report Date	Baseline Version	Tool Version
Cool Example Org	example.org	ABCDEFG	07/20/2026 12:43:08 PDT	1	v1.0.0

Policy Indicators:

Automated CheckAutomatically verified by ScubaGoggles
Log-Based CheckRequires log-based verification

ASSUREDCONTROLS-1 Google Support Staff Data Access

Control ID	Requirement	Result	Criticality	Details
GWS.ASSUREDCONTROLS.1.1v1	Access Approvals SHOULD be enabled. Automated Check Log-Based Check	No events found	Should	No relevant event in the current logs for the top-level OU, Cool Example Org. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended.
GWS.ASSUREDCONTROLS.1.2v1	Agencies SHOULD restrict support access to U.S.-based Google staff only. Automated Check	Warning	Should	The following OUs are non-compliant: Cool Example Org (group katherinelopez@example.org): Access management policy is set to No preference Jose Roberts's OU (in Kristen Williams's OU): Access management policy is set to Access by EU Google staff or via EU virtual desktop

ASSUREDCONTROLS-2 Data Regions Advanced Settings

Control ID	Requirement	Result	Criticality	Details
GWS.ASSUREDCONTROLS.2.1v1	Data processing across multiple regions SHOULD be disabled for all Google Workspace products. Automated Check Log-Based Check	No events found	Should	No relevant event in the current logs for the top-level OU, Cool Example Org. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended.