Secure Cloud Business Applications (SCuBA)

Baseline Documents

Google Drive and Docs Baseline Report

Customer Name	Customer Domain	Customer ID	Report Date	Baseline Version	Tool Version
Cool Example Org	example.org	ABCDEFG	06/26/2025 16:02:22 Pacific Daylight Time	0.5	v0.5.0

DRIVEDOCS-1 Sharing Outside the Organization

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.1.1v0.5	Agencies SHOULD disable sharing outside of the organization's domain.	Warning	Should	The following OUs are non-compliant: Cool Example Org: Files owned by users or shared drives can be shared outside of the organization
GWS.DRIVEDOCS.1.2v0.5	Agencies SHOULD disable users' receiving files from outside of the organization's domain.	Pass	Should	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.3v0.5	Warnings SHALL be enabled when a user is attempting to share something outside the domain.	Pass	Shall	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.4v0.5	If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account.	Pass	Shall	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.5v0.5	Agencies SHALL disable making files and published web content visible to anyone with the link.	Fail	Shall	The following OUs are non-compliant: Cool Example Org: Published web content can be made visible to anyone with a link
GWS.DRIVEDOCS.1.6v0.5	Agencies SHALL set access checking to recipients only.	Fail	Shall	The following OUs are non-compliant: Glenn Mahoney's OU: Access Checker allows users to share files to recipients only, suggested target audience, or public (no Google account required) Cool Example Org: Access Checker allows users to share files to recipients only, suggested target audience, or public (no Google account required)
GWS.DRIVEDOCS.1.7v0.5	Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organization.	Pass	Shall	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.1.8v0.5	Agencies SHALL set newly created items to have Private to the Owner as the default level of access.	Fail	Shall	The following OUs are non-compliant: Glenn Mahoney's OU: When users create items, the default access is set to: the primary target audience can search and find the item.

DRIVEDOCS-2 Shared Drive Creation

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.2.1v0.5	Agencies SHOULD NOT allow members with manager access to override shared drive creation settings.	Pass	Should	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.2v0.5	Agencies SHOULD NOT allow users outside of their organization to access files in shared drives.	Pass	Should	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.3v0.5	Agencies SHALL allow users who are not shared drive members to be added to files.	Pass	Shall	Requirement met in all OUs and groups.
GWS.DRIVEDOCS.2.4v0.5	Agencies SHALL NOT allow viewers and commenters to download, print, and copy files.	Fail	Shall	The following OUs are non-compliant: Glenn Mahoney's OU: Viewers and commenters are allowed to download, print, and copy files.

DRIVEDOCS-3 Security Updates for Files

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.3.1v0.5	Agencies SHALL enable the security update for Drive files.	Pass	Shall	Requirement met in all OUs and groups.

DRIVEDOCS-4 Drive SDK

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.4.1v0.5	Agencies SHOULD disable Drive SDK access.	Pass	Should	Requirement met in all OUs and groups.

DRIVEDOCS-5 User Installation of Drive and Docs Add-Ons

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.5.1v0.5	Agencies SHALL disable Add-Ons.	Pass	Shall	Requirement met in all OUs and groups. Log-based check. See limitations.

DRIVEDOCS-6 Drive for Desktop

Control ID	Requirement	Result	Criticality	Details
GWS.DRIVEDOCS.6.1v0.5	Google Drive for Desktop SHOULD be enabled only for authorized devices.	Warning	Should	The following OUs are non-compliant: Cool Example Org (group "Dr. John Meza's group"): Drive for Desktop is enabled and can be used on any device. Cool Example Org (group "Christina Nelson's group"): Drive for Desktop is enabled and can be used on any device. Cool Example Org (group "Andrew Lawson's group"): Drive for Desktop is enabled and can be used on any device.