Securing Shared Drives for Year-End Audits (Focus on Data Loss Prevention and Context-Aware Access)

[Kristal]

How does your institution handle Data Residency and DLP governance for shared drives?  If you are comfortable, please share your framework.

Google Workspace Updates Weekly Recap - November 7, 2025 (Shared Drive Expiration) & Google Workspace Security Features

[Kim_Nilsson]

@niklasnord back from Xmas holidays yet? 🙂

This should be right up your alley. If you haven't already, they look like relevant topics to look into.

[niklasnord]

Thanks for the tag @Kim_Nilsson 🙂

We have a framework for this to store sensitive data and PIIs in shared drives. We are using it for all school forms from pre-school. At the moment it's only in Swedish though.

In short:

• All staff have forced MFA (USB-key, SMS, Authenticator)
• All staff are signed out of all sessions 4 times/week (gam user signout = mobile sessions)
• Shared drives are divided in to 2 security segments
  • [S] Secure (Normal shared drive settings)
  • [XS] Extra secure (All shared drive settings off in Google admin
• Membership for [XS] is manually assigned by an appointed user (manager) and is (should be ...) audited at least once per month
• [XS] is cleared for sensitive information and PIIs

Future plans

• DLP rules for documents in shared drives
• Explore using OUs for shared drives to increase security
• Explore the possibility of more signouts (preferrably once per day)

Wish list

• Expiration date for a membership in a shared drive
• More granular settings for memberships in shared drives
• Better management tools for shared drives

Plese feel free to ask questions 🙂

//Niklas

[Kim_Nilsson]

The scheduled signout, that's done during the night, I assume?

So it doesn't interfer with anyone working late, or early, at home.

[niklasnord]

The scheduled signouts are as follows

• Monday 06:00
• Wednesday 06:00
• Friday 06:00
• Friday 19:00