Secure the Google ecosystem with evidence, not assumptions.

What this project is for

Goog-Sec helps security engineers, cloud architects, administrators, assessors, and service providers turn broad Google security requirements into concrete implementation and validation steps.

01 Practical implementation

Configuration patterns, example commands, and verification steps for controls that must work in real environments.

02 Threat-informed guidance

Attack paths, detection considerations, and incident-response context alongside preventive configuration.

03 Control testing

NIST and FedRAMP-oriented evidence and test procedures for Google Cloud and Workspace environments.

04 Cross-product architecture

Identity, Zero Trust, threat intelligence, and security operations across product boundaries.

Explore the guidance

Start with the environment or control family you are responsible for.

Google WorkspaceIdentity, data, email, endpoints, threat hunting, incident response, and MSP operations.→Google CloudIAM, networks, compute, storage, GKE, monitoring, Security Command Center, SAIF, and compliance.→Google ChromeEnterprise policy, extension security, filtering, authentication, and Zero Trust browsing.→Cross-product securityFederated identity, coordinated defense, security operations, and shared threat intelligence.→NIST and FedRAMPAssessment-oriented checklists, evidence expectations, and Google-specific control tests.→ContributingAuthoring standards for sourced, testable, and public-safe security guidance.→

Trust model

This project provides community guidance. It does not claim that a configuration is universally secure, compliant, or appropriate for every Google tenant. Each guide should make prerequisites, permissions, evidence, limitations, and rollback expectations visible so readers can make informed changes.

Use the page provenance panel, edit links, and issue tracker to inspect or improve the guidance.