Google Workspace

Remember when they wanted people to apply for SS through X? Yeah these people have no idea how the real world works or how to serve the public. More on reddit.com

This is a friendly reminder that r/smallbusiness is a question and answer subreddit. You ask a question about starting, owning, and growing a small business and the community answers. Posts that violate the rules listed in the sidebar will be removed. A permanent or temporary ban may also be issued if you do not remove the offending post. Seeing this message does not mean your post was automatically removed. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com

I've recently purchased my domain, which is @lastname.me, I'll look at porting emails to this over the Christmas break. I believe it is a great idea to have your own domain for even personal emails. Both Google and Microsoft offer varying feature sets though. I am actually looking at using fastmail, it feels very intuitive and simple while also being rather flexible in what it can do. More on reddit.com

Brain dump... Learn to use GAM (the advanced version , check out the wiki ) - this will help with a huge amount of things. Also check out GYB ( wiki ), made by the same person behind the original GAM - it's used for creating/restoring a Gmail backups. If you have Vault licensing, configure the retention rules now. You can use labels to keep/purge data based on label date values - useful for GDPR (6 years +1) etc. If you have DLP, configure detectors (there are predefined ones.. or you can use regex) for PII/finance data and set up rules for alerts (Gmail & Drive) as well as for applying labels (Drive only). For example, create a Drive label for PII data, add fields for PII status (suspected, present, absent) and type (name, location, dob, passport, health, address etc...), then set the DLP rule for any PII hits to apply the PII label with a status of suspected and get users to review periodically by searching drives using the label filter for the 'suspected' PII status. This helps if you ever have subject access requests and with any ISO27001 audits. Setup some email spoofing/phishing protection with DNS records for: SPF - control which servers/IP addresses can send mail for your domain. DKIM - authenticate/digitally sign emails from your domain DMARC - publish a policy for servers receiving emails from your domain (including your own instance of Google Workspace, i.e. if someone tries to phish your finance team) of quarantining/rejecting suspect emails that fail SPF/DKIM checks. Also set up DMARC reporting using rua (standard) and ruf (forensic) tags to analyse mail flow/health. There are many paid for reporting services, but also free open source ones, if you know what you're doing. If your company has money to burn, set up BIMI as a further protection. Use custom user profile attribute schemas to store extra user profile data to help with various organisational groupings, such as: multiple internal company brands/subsidiaries more practical skill descriptors (Finance, Account Management, Senior Management, Facilities, IT) than conventional culturally descriptive departments that other staff might use and want referenced in email signatures employment types (permanent, temp, part-time, intern etc.) region/location Consider using those custom attributes in dynamic group queries , which themselves can be used for mail distribution, drive shares, admin console configuration policies (use security groups). That last point really can help onboarding by automating access to data/comms as well as correct policy enforcement. USE GOOGLE GROUPS for: shared accounts forwarding/redirecting mail (use aliases on groups and/or recipient address maps for mail routing to groups) mail box archiving (using GYB, explained further below) Try to avoid account delegation: it can lead to other users accidentally or purposefully (tampering) removing data, which although not necessarily gone (Vault) can make data searching/management more difficult further down the line without having to resort to more complex, Vault dependant searches. It may reveal sensitive personal data (even if they were previously warned not to use it for personal reasons... also legitimate things such as HR data, pay rises, disputes can be exposed) and could become a GDPR issue. Favour using Vault searches, GYB selective backups etc... but that's not always practical depending on requirements. Promote the use of Shared Drives to keep good filing/data management (keep important/operationally critical data easily discoverable) enforce appropriate access controls (via groups) avoid later transfer of files from departing users' My Drives to incumbent users' My Drives... Where they departing users have My Drive data, consider moving that to a shared drive (explain further below) More on reddit.com