Google Workspace security for Nepali organisations: what to switch on

Your first week: nine settings, in order

Do these before you migrate a single mailbox. Every one of them is available on Business Starter.

1. Secure the super administrator account. The account that owns your domain should have a long unique password, 2-Step Verification on, and recovery details that belong to the organisation, not to a staff member's personal phone that leaves with them.
2. Create a second super admin. One person holding the only administrator account is a single point of failure the day they resign, lose their phone or go on leave. Two is enough. Ten is not better.
3. Do not use the super admin account for daily email. Give the owner an ordinary user account for normal work and reserve the admin account for administration.
4. Enforce 2-Step Verification for everyone. Announce it, give people a fortnight to enrol, then enforce it. Security keys and the Google prompt are stronger than SMS codes, which can be intercepted through the phone network.
5. Add recovery information for every user. A recovery phone or address on each account is what stops a lockout becoming an admin ticket at midnight.
6. Set your email authentication records. SPF, DKIM and DMARC decide whether your mail is trusted and whether somebody can forge your domain. Exact values are on our setup page.
7. Decide external sharing in Drive. Choose deliberately whether files can leave your domain, and whether "anyone with the link" is allowed at all. See our Drive guide.
8. Turn on basic endpoint management. It is included in every Business edition, and it is how you wipe the work account from a phone that is lost in a taxi in Kathmandu.
9. Switch on admin alerts. Suspicious sign-in attempts, admin changes and spikes in external sharing are worth an email to the administrator on the day they happen.

What each edition gives you

The security gap between the editions is narrower than people expect. The base protections are the same everywhere. Retention, forensic search and device control are where money buys something.

Two rows deserve a note. Data loss prevention and Context-Aware Access, the controls that block a document containing a card number from leaving or refuse a login from an unmanaged device, are not in any Business edition. They belong to Enterprise, whose prices Google does not publish. If a supplier tells you Business Plus gives you DLP, they are wrong.

Google's Standard support is available around the clock, with a four-hour response objective for the highest priority cases. Enhanced support can be purchased on Standard and Plus.

Why Vault is the real security upgrade in Business Plus

Vault does three things that matter to an organisation with an audit trail to defend. It retains mail and files according to rules you set, even after a user deletes them. It holds data for a specific person or matter, so nothing is purged while a dispute is open. And it lets you search across the organisation's mail and Drive content and export what you find.

That is why the organisations in Nepal that genuinely need Business Plus tend to be the ones with external scrutiny: an NGO whose donor requires records for the life of a project, an accountancy or law firm, a company facing a contractual dispute where the email trail is the evidence. Without Vault, when a user is deleted their data is recoverable for 20 days and then gone.

The phishing that actually lands in Nepal

Google's filters stop the mass-market spam. What gets through is targeted, and it works because it looks routine.

Offboarding: the day someone leaves

1. Suspend before you delete. Suspending stops access immediately and keeps everything intact while you sort out what to keep.
2. Sign the account out everywhere and reset the password, then remove any app passwords and recovery details that point at the person.
3. Transfer Drive and Calendar data to their manager or replacement before deletion. Anything already in a Shared Drive belongs to the organisation and needs no transfer.
4. Redirect the address. Turn the departed user's address into an alias or a group member so client mail keeps arriving somewhere a human reads.
5. Remove them from groups and shared files, and check for documents they owned that colleagues still rely on.
6. Then delete, and remember the clock. After deletion the data can be restored for 20 days and no longer. On an annual plan the licence stays and can be reassigned.

The complete sequence, including handover of two-factor devices, is in our help article on offboarding employees in Nepal.

Two habits that beat any feature

First, one account per person. Shared logins destroy the audit trail, cannot be offboarded, and make 2-Step Verification impossible to run properly. A shared address like an information or sales inbox should be a group or an alias, not a paid account whose password four people know.

Second, review quarterly. Fifteen minutes checking the user list for accounts that should be gone, the admin list for people who no longer need it, and the external sharing report for anything unexpected. That review catches more than any setting does.

WebsNP supplies all three Business editions in Nepali rupees, including Business Plus with Vault at $19.53 per user per month, and sets the authentication records up with you. Compare the editions on our price page.