Table of contents
When a financial institution, a crypto-asset service provider or another regulated company chooses Google Workspace, the question is rarely “Business or Enterprise” – the Business editions lack the security centre, context-aware access and full DLP, so they drop out quickly. The question is whether Enterprise Standard is enough or Enterprise Plus, which costs considerably more per user, is needed.
What both editions have
Most of the controls the CIS Google Workspace Foundations Benchmark requires, and that a supervisor expects to see, are already in Enterprise Standard:
- Enforced two-step verification, including security-keys-only.
- Context-Aware Access: access only from managed devices, specified countries, specified apps.
- Data loss prevention (DLP) for Gmail, Drive and Chat with custom detectors – for example a Latvian personal code or an IBAN.
- Vault: retention rules, holds, search and export for legal purposes.
- Security centre with the security dashboard and the investigation tool (Enterprise Standard data sources).
- Alert centre with custom alert rules, custom administrator roles, audit logs.
- Data region: one tenant-wide policy for data at rest in Europe.
What Enterprise Plus adds
- Data regions reporting and finer control. Standard lets you set the region but gives no report showing where each user’s data actually sits. Plus does. If your supervisor or auditor wants evidence rather than a screenshot of a setting, that is the argument for Plus.
- Client-side encryption (CSE) for Gmail, Drive, Meet and Calendar with your own key management. Needed only if your risk assessment requires that the platform provider be technically unable to access content.
- Extended security centre – more data sources in the investigation tool and the security sandbox for attachment analysis.
- Assured Controls add-on – Access Transparency and Access Approval for actions by Google personnel, data location guarantees for support.
- Cloud Search, AppSheet Core, more storage and other features that are not security matters.
Google changes the feature list per edition, so check the current comparison on Google’s site before deciding. The above reflects the state on 07.10.2026.
How to decide
Ask three questions:
- Will your supervisor or auditor need evidence of data location, not just the setting? If yes – Plus, or an external way to evidence it.
- Does your classification require that the platform provider be technically unable to read content? If yes – Plus with CSE. If contractual and organisational safeguards suffice – Standard.
- Will you actually use the extended investigation tool, or do you have a separate SIEM that the logs are exported to? If you have a SIEM – Standard is usually enough.
In our experience a small regulated company (up to 50 users) can reach every CIS Level 1 control and most of Level 2 on Enterprise Standard. The decision for Plus most often rests on data regions reporting – and that is worth deciding together with the compliance function, not by IT alone.
Mixed editions
Google allows combining editions in one tenant by organisational unit, with conditions. In practice a regulated company is better served by one edition for everyone: it simplifies evidence and prevents a user from falling outside a control. If you are considering a mixed model, check Google’s current rules on combining editions.
We help choose the edition and configure it against the CIS Benchmark with an evidence pack for the supervisor – see the security audit page.
