SOC 2 · Google Workspace
Fix failing SOC 2 tests in Google Workspace
Deixic enforces MFA, suspends people who have left, and trims admin roles in your Google Workspace, then re-runs the test that failed.
Tests Deixic fixes in Google Workspace
Criteria touched: CC6.1 Logical access, including MFA, CC6.2 Provisioning and deprovisioning, CC6.3 Access modification and least privilege.
Failing testWhat Deixic doesCriterion
MFA enforced for all usersTurns on 2-step verification enforcement for the organizational unit and lists the accounts that had not enrolled.CC6.1
Offboarding revokes accessSuspends the account of a person your HR system marks terminated.CC6.2
Admin roles limited to named peopleLists every super admin and removes admin roles from accounts your policy does not name.CC6.3
What runs, what waits, what is yours
Deixic classifies every Google Workspace action before it runs.
Runs within policy
- Enforce 2-step verification for non-admin users
- Suspend an account whose owner is terminated in your HR system
Waits for a named approver
- Removing a super admin role
- Changing the 2-step verification policy for admin accounts
Sent to you as a decision
- Deleting a user account. Deixic suspends; deletion stays with you.
- Anything on an account used in the last 180 days that your policy does not cover.
Read back and evidence
Each change is read back from Google Workspace, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The 2-step verification enrollment and enforcement state of each account
- The suspended flag on each offboarded user
- The super admin list after a role change
Your auditor gets
- Before and after state of the enforcement setting
- Accounts suspended, with the HR termination record that triggered each
- Approver and reason for any admin role removal