Google Workspace
Phishing Response Checklist
Phishing attacks can spread across your domain in minutes. The challenge is knowing what to investigate, what to remediate, and what to do next.
Download this practical checklist to help your team contain threats, investigate suspicious activity, assess potential data exposure, and respond to phishing incidents with confidence.
Why Google Admins Need This Checklist
When a phishing email reaches your users, every minute matters.
Most organizations know how to reset a password or remove a malicious email. The harder challenge is understanding what happened after the user interacted with the attack.
This checklist provides a structured investigation and remediation process for Google Workspace admins. It helps teams move quickly, document findings, and reduce the risk of overlooking critical evidence during a phishing incident.
- Contain compromised accounts and suspicious activity
- Identify and remove phishing emails from user inboxes
- Investigate Gmail, Google Drive, and third-party app activity
- Assess potential data exposure and external sharing
- Improve future response processes with training and phishing simulations