Detections
Analytics

1.1.1 Ensure Super Admin Email Address Is Not Tied To A Single User

Information

It is recommended that the super admin role is assigned to a dedicated email address (e.g., [email protected] mailto:[email protected]) rather than to individual user email addresses (e.g., [email protected] mailto:[email protected]). The dedicated super admin email should be a separate user account used exclusively for super admin level administrative tasks.

When you first sign up for Google Workspace or Cloud Identity, the person who completes the signup process automatically becomes the first super administrator for that account. When the GCP organization resource is created, existing super administrator accounts from Google Workspace or Cloud Identity automatically gain access to manage the organization. This initial assignment typically results in an individual user's email address being assigned the super admin role by default.

The super admin role has unrestricted access to all GCP organization resources and settings. Using individual user email addresses for super admin access creates security and operational risks.

Using a dedicated email address for super admin accounts rather than individual user emails significantly reduces the risk of phishing attacks, as individual user accounts receive daily business emails and are high-value phishing targets, while a dedicated super admin email address not used for daily communications has minimal exposure to credential compromise. In addition, dedicated super admin accounts can enforce stronger authentication requirements such as hardware security keys and shorter session timeouts without impacting day-to-day productivity of regular user accounts. When employees leave the organization or change roles, super admin access remains continuous through the dedicated account rather than being tied to departing personnel, ensuring operational continuity. Separating super admin access from daily user activities prevents accidental misuse of elevated privileges and provides clear audit separation between routine work and administrative actions, supporting segregation of duties.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Google Cloud Admin Console

 -

Create a Dedicated Super Admin User Account

 - Navigate to the Google Admin console at https://admin.google.com
 - Go to Directory -> Users in the left navigation menu
 - Click Add new user
 - Configure the dedicated super admin account:

 - First name: GCP Super Admin (or similar)
 - Last name: Account
 - Primary email: [email protected](or similar dedicated address)
 - Password: Set a strong temporary password

 - Click Add new user
 - Configure additional security settings for this account, for example:

 - Enforce 2-Step Verification with hardware security key

 -

Assign Super Admin Role to the Dedicated Account

 - Still in Google Admin console at https://admin.google.com
 - Go to Account --> Admin roles in the left navigation menu
 - Click on Super Admin role
 - Click Assigned Admins --> Assign users
 - Search for and select the dedicated account created in Step 1 (e.g., [email protected])
 - Click Assign role
 - Verify the dedicated account now appears in the Super Admin role members list

 -

Remove Individual User Accounts from Super Admin Role

 - In the Super Admin role page, review all currently assigned users
 - For each individual user email address:

 - Select the user
 - Click on Unassign role
 - Confirm the removal

 - Verify that only the dedicated super admin account remains assigned to the Super Admin role

Impact:

Creating a new dedicated super admin account requires coordination with Google Workspace or Cloud Identity administrators. Existing super admin accounts tied to individual users should be replaced with the dedicated account, and individual user accounts should be removed from the super admin role once migration is complete. Multiple authorized administrators can access the dedicated super admin account when performing organization-level tasks.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(2), 800-53|AC-6(5), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: GCP

Control ID: 2fe40e302a5537c74043e80f12a1dba7c5c88c8706fb06694c485e2755ffebd5