Google Workspace student-security checklist

A fast self-check for schools: whether student accounts, sharing and safeguarding are set up the way an auditor — or a worried parent — would expect. Anything you can't tick is worth fixing before the next enrollment cycle.

Accounts & lifecycle

• Provisioning is standardized — new students/staff created the same way, quickly, from one source of truth.
• Offboarding is reliable — leavers lose access promptly; no orphaned accounts linger.
• Staff ≠ student ≠ admin — clear separation of account types and policies.
• MFA on staff & admin accounts — especially anyone who can touch student records.
• Super-admin rights are minimal — counted, named, and reviewed.

Sharing & data

• Drive sharing is scoped — no "anyone with the link" on student data; external sharing controlled.
• Shared drives by role — least-privilege access for staff, students, vendors and parents.
• Student data classified — you know what counts as a record and where it lives.
• Retention policy — records kept/deleted per regulation, not forever by default.

Safeguarding & filtering

• Content filtering appropriate to age/grade, enforced on school devices.
• CIPA posture documented — you can show the policy and how it's enforced.
• Ed-tech vendors reviewed — apps touching student data vetted; consent captured.
• Takeout/alerts — logging and alerting on risky actions is on, not default-off.

Resilience

• Workspace data is backed up independently (don't assume Google = backup).
• A named owner for Workspace security and account policy.
• Second-campus consistency — new sites inherit the same setup, not a fresh improvisation.