Security for your organization has many different aspects and components. Initially, it comes down to two things: what is your company's policy and what are the available controls? For example, the controls may enable you to prevent external sharing but it may be company policy to allow it. There are also times when the controls can’t meet the policy requirements. In these cases, additional security tools may be needed. Once your desired controls are implemented it is important to monitor and verify settings on a regular basis. The Google Workspace security health page helps you monitor existing settings and make changes based on recommendations from Google.