Growing Your Nonprofit With Google Workspace

How can your nonprofit avoid common headaches with the free Google Workspace implementation as you grow? 

So many small nonprofits start out using the free Google Workspace platform you can set up and administer yourself. Google makes it easy! But as you grow from a one- or two-person nonprofit to a larger team you may be wondering if Google Workspace is professional enough, and whether it can handle more complex IT needs. And what about volunteers and others who need to access your files – is Google secure? What are best practices on setting up and administering Google Workspace in nonprofits with 10+ staff? Are there steps you can take now to make it easy to keep Google Workspace as you grow?

Join Community IT CEO Johan Hammerstrom for a look at what you need to know about growing your nonprofit and managing the IT to go with growth. This webinar is appropriate for nonprofit staff of any technical level, and is recommended for nonprofit managers and leaders. Learn how well-managed IT can help you achieve your mission.

Johan makes use of our expertise to give you some simple updates and changes you can make as you grow that can help avoid a lot of work later. Doing these things now can make your Google Workspace more secure and better able to accommodate you as your organization grows in complexity and your IT needs change. 

As with all our webinars, this presentation is appropriate for an audience of varied IT experience. Thanks to the Nonprofit Learning Lab for hosting us.

_______________________________
Start a conversation :)

• Register to attend a webinar in real time, and find all past transcripts at https://communityit.com/webinars/
• email Carolyn at cwoodard@communityit.com
• on LinkedIn

Thanks for listening.

Transcript

Johan Hammerstrom: Thank you for joining us for this webinar today. We’re really excited to be talking to you about how you can grow your nonprofit with Google Workspace. 

My name is Johan Hammerstrom. I’m the CEO at Community. I’ve been with the company for almost 25 years now, and during that time, I’ve worked with hundreds of nonprofit organizations on helping them to use technology to effectively do their work and accomplish their mission. And I’m very excited to be here today to tell you a little bit more about our experiences with Google Workspace. Carolyn, can you introduce yourself?

Carolyn Woodard: Sure. Hi everyone. Thank you for joining us. My name is Carolyn Woodard. I am the Outreach Director for Community IT. Before I was at Community IT, I was the IT Director for a large international nonprofit, so I’m going to put that hat on today and ask Johan some of the questions. I’m going to channel all of you and ask Johan about using Google Workspace.

We’re so glad that you joined us. Before we begin, I wanted to tell you a little bit about Community IT and thank Nonprofit Learning Labs so much for hosting us. If you’re not familiar with Community, we are a 100% employee-owned outsourced IT provider. We provide outsourced IT support, also called a Managed Services Provider. We work exclusively with nonprofit organizations around the country. And our mission is to help nonprofits achieve their missions by using well-managed IT, which is essential for any modern office to be able to do what you need to do.

We serve nonprofits across the U.S. As I said, we’ve been doing this for over 20 years. We are technology experts and we are consistently given the MSP 501 top MSP award, which is something that we got again, in 2023. I wanted to remind everyone that for presentations like this Community It is vendor-agnostic. We do consider ourselves a best of breed IT provider. That means it’s our job to know the landscape and the platforms, and tools that are widely used and reputable. With our clients, we help them make those decisions based on their budget, their business needs, all of those considerations. 

Today, we’re talking about Google Workspace. It’s one of the platforms that you can use, and something that a lot of nonprofits use, especially when they’re starting up, because it’s so easy to get into. 

Learning Objectives

Johan Hammerstrom: We’d like to start by just going over the learning objectives for today’s presentation. 

• We want to convey some of the typical IT concerns that growing nonprofits have. 
• You’ll learn the strengths of the Google Workspace platform particularly for nonprofit organizations and especially compared with the Microsoft platform. 
• We’d like you to come away with an understanding of the evolving security needs, especially in this day and age as the threat landscape continues to evolve and change. 
• And then finally, we hope you come away with steps that you can take now in administering your Google Workspace, that’ll prevent headaches down the road. So, an ounce of prevention and all that.

The IT Maturity Model

But before we get to that, I just wanted to talk a little bit about IT maturity and the IT maturity model. IT maturity is a useful way of drawing a connection between the capabilities that an organization has and the interest the organization has in executing on certain strategic objectives.

The maturity model actually goes all the way back to 1973. IT was first developed by a Harvard Business School professor, named Richard Lander. It was later adopted by the Strategic Engineering Institute. They were commissioned by the U.S. Air Force to try to understand why so many IT projects were failing. And so they ended up settling on the capability maturity model, which was one of the first maturity models that was developed.

There are now dozens of different maturity models, and if you’re a larger organization, it might make sense for you to look into adopting a maturity model in more detail. As a smaller organization, it might be helpful to understand the general direction that the maturity model goes in.

I’m just going to walk through each of the different stages here and talk a little bit about what those different stages correspond to. 

• So, the first stage, ad hoc, is where organizations are being very reactive and just responding in the moment to needs as they arise without really giving a whole lot of thought to the long-term outcomes, or impacts of the technology that’s being deployed. So, it’s very break/fix. There’s always a lot of fires to put out. And in an ad hoc stage, organizations are highly dependent on individuals to kind of come in and save the day.
• Moving up into the functional stage, organizations are starting to make some investment in people, process and in technology solutions. They’re starting to incorporate long-term planning considerations into IT implementation and they’re depending less and less on individuals and more and more on teams that are being guided by policy and process.
• Functional leads into standardized. And standardized is really our goal for all organizations. No matter what size or mission, you have a standardized approach to technology and it’s one that is going to work best. It’s going to put you in the position to succeed with your IT. And so in a standardized organization, the processes are well developed, they’re being followed by the group, individual team or department that’s responsible for IT in the organization. Long-term planning objectives are incorporated into the IT solutions that are being implemented.

From standardized, we’re looking at optimized and adaptive as stages four and five. Organizations really need to think about whether or not those stages are appropriate for the work that they’re doing as an organization.

For an in-depth discussion of IT maturity and strategic IT planning, we have some webinars that cover that. Start Up and Spin Off Nonprofit IT and Building a Foundation for IT Innovation are good webinars to start with. 

I want to encourage you to not look at the maturity model and think, well, Stage 5, that’s the highest stage. That must be our long-term objective. Because it can be very expensive to get your organization to Stage 5. That involves investing in a lot of policy and process development. It involves a very rigorous and methodical approach to technology that can also be very costly, very time-consuming. And that may not be necessary for your organization, depending on your mission and depending on the work that you’re doing.

An organization that’s very data-driven or a nonprofit that is using technology to deliver its mission might need to go to Stage 4 or Stage 5. But other organizations that don’t have the same intensity of technology requirements, may be fine with standardized, Stage 3.

As we start to turn our attention to Google Workspace, we’ll want to think about implementing Google Workspace in this context. So if you’re a brand-new organization or an organization that’s been working from an ad hoc perspective for a long time, you still need email, you still need documents, you can’t avoid rolling out IT. But understanding where you’re on the maturity scale in this maturity model gives you a sense of how much you need to be able to do. 

The other nice thing about the maturity model is it’s a nice reality check. So, if you’re an organization that’s operating from an ad hoc position, you want to set your objectives for implementing a new technology like Google Workspace that are realistic to what your organization can accomplish.

Carolyn Woodard: Thank you for saying that, Johan. It’s not really possible to jump in at a standardized or optimized or adaptive level. You do have to go through those earlier stages. But I think having that self-awareness is what we’re trying to get at. It’s not a judgment of you if you’re not at a standardized level, then you’re not able to function, because there are lots of organizations that are doing a really good job who are not standardized (yet) or are standardize in some aspects but not in everything. 

We just like to talk about it as ideally, you would like to get your organization to that standardized level. And you can use Google Workspace to get there.

Johan Hammerstrom: Yes. Honesty is the most important part of using the maturity model. Google Workspace is a technology solution that can be implemented effectively at every stage of maturity and it’s just important for you to realize what stage of maturity you are at.

Google Workspace Business Suite

Johan Hammerstrom: Google Workspace is Google’s business suite. Many of you are familiar with it. It’s been rebranded several times over the years. The one that I often hear is G-Suite. So, if you remember the days of G-Suite, it’s basically the same thing. Google is providing for business customers all of the wide range of cloud-based services that Google has. Here’s a non-exhaustive list of Google tools available in Google Workspace or that work with Google Workspace tools. 

You can use Gmail; many of us use Gmail for our personal email, but Google provides that for business use through Google Workspace. Same with Calendar, same with Docs, which are for documents, Drive to store files in; Forms, which can be used to run surveys.

Google Meet is kind of the forgotten third tenor of the virtual meeting world. Everyone’s familiar with Zoom, obviously. And many of you have probably used Microsoft Teams or have been on a Teams meeting. But Google has its own video conferencing solution called Google Meet, which runs completely in the browser and is actually pretty good. If you haven’t experienced Google Meet, it’s very Google-y. It’s just very different from Zoom and Teams, but it works really well.

Sheets is their version of Microsoft Excel. Sites can be used to build websites. I wouldn’t recommend building your public facing website with Google Sites, but generally it gets used for building internal sites like intranets. Slides is used for presentations, much like PowerPoint. Google Groups is a way of organizing your staff. It’s kind of like Microsoft Teams for those of you who are familiar with that. You can create groups of people and they have a shared workspace that they can work from.

So, those 10 applications that I just ran through are the core applications that come with Google Workspace, but there’s a whole host of other applications as well that are related. One of those is Analytics. You have to plug that into your website, but you can use it to analyze the web traffic for your website. 

YouTube obviously we’re all familiar with. There’s actually a YouTube offering in Google Workspace, so that your organization can run its own YouTube channel. Google Voice is a telephony solution. And then Gemini is Google’s AI solution, much like Copilot, which I think you people have been hearing about. 

There are other solutions as well. In fact, last night, my wife was asking about how Microsoft has a business intelligence solution called Power BI, which you can use to create data visualizations. And she was like, does Google have one? Because one of her clients that she’s working with, all of their data is in Google Sheets. And I was like, I don’t know, that’s a good question. And I googled it, and sure enough, they have one, it’s called Looker, which I think is just a hilarious name. They probably changed the name three or four times. But it just kind of goes to show that if there’s something that is in the Microsoft Suite like Power BI, there’s probably also a version of it in the Google Suite like Looker for Google Workspace. Google has put a lot of work into creating parity, at least functionally on a broad level with Microsoft’s 365 Suite.

Google Workspace in Nonprofits

Let’s talk a little bit about Google Workspaces’ role in the nonprofit sector. Google provides pricing for nonprofit organizations. In fact, it provides some deep discounts for nonprofit organizations. And Google Workspace can be a really good solution for nonprofits. For one thing, it’s very easy to start up and administer. To some degree, that means it has less granular functionality than Microsoft 365, but it’s easier to use. 

So, if you’re a small startup nonprofit that just needs to get going, Google Workspace can be pretty easy to get going and fairly easy to administer even by someone who doesn’t have a lot of technical background or experience. 

Another advantage of Google Workspace for nonprofits is that most schools and universities even use Google Workspace. And so most people are familiar with Google Workspace either from using it in school or from using it at home. And we actually have a lot of our clients that do work in the education space, and they find that even if they’re using Microsoft 365 as their main productivity suite, they find that they need to use Google for working with students, because students are just much more familiar with Google Workspace.

As I mentioned, Google offers some nonprofit pricing. I think this is a good thing to keep in mind is that it’s not all free. There are different tiers of service that Google provides for Google Workspace. 

• The Entry-level tier is free for nonprofit organizations, but you can also get more functionality with paid tiers that are deeply discounted. 
• They have a Business Standard tier that’s $3 a month per account, that’s close to 80% discount from the commercial price.
• They have a Business Plus tier, which is just over $5 a month, close to 75% discount of commercial price. 
• And then if you need Enterprise, that’s going to be a custom. You have to contact them to get that pricing. 

For example, if you’re hosting a Google Meet video, you can only have a hundred participants, which seems like a lot for a virtual meeting, but if you’re using that to run  training with hundreds of people, it’s good to know that there’s a limit on how many people can join a Google Meet if you’re hosting it with a license from that pricing tier. 

In our experience, the (Standard tier) generally meets the needs of most organizations and it’s not really necessary to go up to the higher tiers. But it’s good to be aware that that’s an option if you need it. It’s also important to note that the first three tiers, the nonprofit Business Standard and Business Plus have a maximum of 2,000 users. So, if you are a large nonprofit organization, or you’re going to add a lot of accounts maybe for constituents that you serve, do be mindful of that 2,000 user limit.

Carolyn Woodard: So when you’re first starting up Google Workspace, you might start with that free tier. But what you were just saying is that for most nonprofits, as they mature and add staff and get bigger, they probably will only need that first paid tier. Is that what you meant?

Johan Hammerstrom: Yes.

Carolyn Woodard: I know that we recommend that a lot. There are just a lot of features to it that you won’t get in the free version.

Is Google Workspace Professional?

Johan Hammerstrom: Yep. So, just to highlight some differences between personal Google and professional Google. The take home message is that some people who are familiar with personal Google think that it’s not really professional. And it’s not that if you try to run your nonprofit organization on a Google Workspace, people aren’t going to take you seriously or think that you’re trying to do it with free tools. Back in the day, people wouldn’t use aol.com email addresses for their main email address for their business or their organization. But the reality is that once you sign up for a Google Workspace tenant, the fact that you’re using Google is somewhat invisible to the outside world.

When you sign up for Google Workspace tenant for your organization, the email is coming not from gmail.com, but from your organization’s domain name. And so it’s getting sent as if by the organization. There are no ads in the email interface when you log into your Google Workspace as part of your nonprofit organization.

A part of the reason that people feel that Google is not as professional, is that Google is kind of well-known as a consumer-focused search tool and these office tools were added later on. And so it’s sort of seen as a secondary part of their business. But the reality is they’ve done a really good job of building out a fully functional suite of professional business tools and lots of businesses, and even large nonprofit organizations, use Google Workspace to run their business. This is particularly true in Silicon Valley, where a lot of startups tend to gravitate towards Google rather than Microsoft for their productivity suite. 

And then finally, when you sign up for Gmail, when you’re using Google Docs or Google Sheets, all of that data, your emails, the content of your emails, that’s all going into Google’s massive data, I don’t even know what to call it. I mean, Data Warehouse seems to not quite give it justice. It’s a huge data collection effort happening at Google. And they use that data basically to run their ad business. Google makes money from selling ads and they target those ads based on the data that they’re collecting from a wide range of sources, primarily search, also in their browser, the websites that you visit, also in your Gmail, the content of your emails.

So, all of that is going into Google’s data collection effort. That’s true on the personal side, NOT true on the professional side. So, if you are using Google Workspace for your organization, all of the content of your email remains the property of your organization. It’s not being used by Google to run their ad business. It’s important to note that distinction. It’s also important that if you decide to use Google for your organization, that you do go to this step of setting up a Google Workspace tenant, and that you don’t just start creating personal@gmail.com accounts and try to use those to run your organization.

Google Workspace and/or Microsoft 365

Carolyn Woodard: That makes a lot of sense. Johan. I know that in this webinar, we really wanted to focus on Google Workspace, but I know that a lot of people have questions about the differences between using Google Workspace and using the Microsoft suite of products.

Johan Hammerstrom: It’s important to note, as I mentioned before, that both Google Workspace and Microsoft 365 are solid platforms. 

Among the 200 or so nonprofits that we support, I would say two thirds use Microsoft 365 and a third use Google Workspace. Especially newer and smaller nonprofit organizations and organizations that are involved in the education space tend to gravitate a little bit more towards Google Workspace. 

It is important to make an intentional decision from the beginning. You’re going to cause yourself a lot of pain if you start with one and then switch to the other. Although increasingly, we’re seeing organizations that use both. That could be an acceptable strategy. 

But if you’re a new organization looking to make this decision about which platform to use, I would encourage you to think about your organization over the next two to five years. How large do you think the organization is going to be? What types of staff are you going to be hiring? Are they more likely to need the kind of document support that is provided in Microsoft 365? Are they more likely to use the kind of document support that’s provided by Google Workspace? So, just give that as much thought as you can, so that when you make that decision, you’re making a decision that will hopefully last for the life of the organization.

It’s not impossible to switch. But the migration path is not entirely straightforward. The way that Google handles email, for example, is very different from how Microsoft handles it. So even just migrating your email involves a lot of retraining of staff and a lot of data cleaning. It ends up being pretty expensive. Don’t get paralyzed into thinking, oh, if I make the wrong decision that’s it for this organization. It is possible to change, but just make sure that you’re really making a thoughtful decision about which is going to be the best solution long term.

Google Storage Updates

We have some updates to pass along. Google recently updated its storage limit. So previously, they had allowed 30 gigabytes per person. And that was it. Once you used up your 30 gigabytes, you ran out of space or you had to purchase more space or increase the license tier in order to get more space. But Google recently switched to a hundred terabytes for nonprofit organizations.

So, if you have any nonprofit licenses at all in your Google Workspace, you get a hundred terabytes of storage capacity for the entire organization, which we found to be pretty significant. 

Some of the previous concerns that you may have heard around Google storage have been addressed through that. For example, something that organizations used to do is just add a bunch of dummy accounts, so that they could get their storage. You no longer need to do that. 

Microsoft Nonprofit Pricing Updates

And then Microsoft, one of the things to keep in mind about Microsoft is that it’s constantly changing its pricing model and its licensing model. So, for example, they had previously offered a license called Enterprise E2, which was free for nonprofit organizations. They recently discontinued that license and replaced it with Business Basic, which is also free, but works a little bit different from Enterprise E2.

It’s just important to keep in mind if you go the Microsoft route that you stay on top of the constantly changing license environment that Microsoft has. We have a lot more information about both of these topics in our Community IT webinar series.

Carolyn Woodard: Yeah. In this webinar, we can only touch on some of these things, but we have articles on our website that go into more detail on both the Google storage and the Microsoft discount. So, if you are feeling a little lost, we have more resources on our website which is www.CommunityIT.com. And we do have other free webinar videos that cover some of these topics, also. So, go ahead and check out those free resources.

Is Google Workspace Safe and Secure?

Johan Hammerstrom: So let’s talk a little bit about cybersecurity and how cybersecurity is handled in Google Workspace. 

Cybersecurity is something that every nonprofit organization should be mindful of. I don’t want to say concerned about, although it’s definitely an area of concern. The threat landscape, as I mentioned earlier, continues to evolve and there are a lot of threats facing nonprofit organizations in the area of cybersecurity.

And so one of the ways that the threat landscape is experienced most directly is when organizations go to apply for a cybersecurity liability policy from their insurance carrier. Five or six years ago, it was possible to have cybersecurity included as part of your general liability insurance policy. That is no longer really an option. There may be a few carriers that still offer that, but it’s pretty rare. 

In our experience, especially for larger organizations, in order for you to get adequate coverage against cybersecurity risks, you need to have a specific cybersecurity policy from your insurance provider. Obtaining that policy is going to require you to complete a much more involved application than was previously needed.

So again, five or six years ago, a cybersecurity addition rider to a general liability policy might have involved a half-page application, where you just answer a few brief questions. What we’re seeing now is much more involved – seven, eight-page long questionnaires. Sometimes the questionnaires need to be completed online. They can involve up to a hundred questions and the questions are all related to the protections that the organization has in place related to cybersecurity risk.

Understanding how your platform, your software applications, and the different protections that they offer, is really important because when it comes time to renew your cyber liability policy, you’ll need to fill out the application and attest to the different cybersecurity protections that you have in place.

The takeaway here is that Google Workspace is a very secure solution. And so if you’re concerned about security for specific reasons, because of the work that your organization does, or just for general reasons, because of all of the cyber threats that are out there now, you want to make sure that you’re able to get your cyber liability insurance renewed. Google Workspace can be secured as much as Microsoft 365 can. 

The policies for securing Google Workspace need to be implemented at the administration level. So, when you’re setting up Google Workspace for the first time, don’t just assume that out of the box, it is as secure as it needs to be. Don’t just assume out of the box that Google Workspace is secure in a way that complies with your cyber liability requirements. Those things need to be proactively set up in user administration. So, just be aware of that. 

We also strongly recommend user training and there’s some training resources that Google provides in Google Workspace. But in general, that’s an area where you’re probably better off using a third-party solution for your training.

Carolyn Woodard: I think that’s also useful, Johan. We always say that you can use any system insecurely. So, that’s where it really comes into making sure that as you’re growing and as everyone is using Google Workspace, that all of your staff know not to share their passwords and some basic things like that and you need to make sure you’re doing that training.

Johan Hammerstrom: Absolutely. The training is critical. You can have all the security protections in the world and if your staff aren’t trained, it really won’t matter at all. So, training is the most important part of an effective cybersecurity posture.

Q and A

Carolyn Woodard: We have some questions that we get fairly often from our clients and from other webinars that we do. One of the big ones is:

Should you discourage use of Outlook? If you have part of your staff that wants to use Microsoft and part that wants to use Google Workspace, what do we usually recommend for that?

Johan Hammerstrom: That’s a good question. These are some of the questions that have come up over the years as we worked with organizations on implementing Google Workspace. In some ways, one of the biggest reasons behind these questions of should we go with Google Workspace or should we go with Microsoft 365, or some of these questions around trying to get one system to work with the other, boil down to the personal preference of individual staff.

You have a lot of modern workers that are used to Outlook and are very productive in Outlook and want to use Outlook. And you have other workers, who are used to the Gmail interface and want to use that and feel very productive in that. Oftentimes, when organizations are trying to make this decision between these two solutions or are thinking about switching from one to the other, it’s because they have some staff who are very vocal and dislike the system that they currently have.

Let’s say an organization has Google Workspace, but they have staff who are much more productive in Outlook. You can try to accommodate that situation by basically setting Outlook up to synchronize with the Google email. It’s possible and you can configure Outlook to work with Gmail, but it’s not recommended. We don’t recommend it. We discourage the use of Outlook to check Gmail.

There are two fundamentally different systems in terms of their philosophy around email, labels and folders for example. Google Workspace uses labels, emails get labeled, you can apply multiple labels to an email. Outlook has folders. You can put the email in one folder and only one folder. Those two approaches are fundamentally incompatible. That’s just one example. There’s many, many others. 

Basically, when you try to use Outlook to access and manage your Gmail, you’re going to run into issues. You’re going to run into conflicts that come from those fundamentally different philosophies around what email is and how email should be managed. This is kind of tough medicine, but I would say to your staff who miss the system that they’re more productive in, they just need to learn how to use the other system to do their work. 

I kind of look at it similar to an enterprise software package. You may use Salesforce to manage your CRM, you may use a proprietary database system for case management. If you’re in a school, you may have a student information system. When you hire someone to come work at your organization, the expectation is that they’re going to learn how to use that system. Someone doesn’t come into a school having worked with a different student information system and say, well, I really like that other system and that’s what I’d like to be using instead of this one. 

You have to look at your productivity platform in the same way. That can be a very difficult conversation to have. I understand if we’re talking about an executive leader like the CEO. And there’s no easy way around if you find yourself in a position where your CEO is going to use Outlook to check their Gmail. That just may be the reality.

Carolyn Woodard: That’s more complicated. Hopefully, some of the people in this webinar are in the situation of having started with the free Google Workspace suite. And then that’s what you’re in as you’re growing. If you’ve always been in Google, you can stick with Google as you’re growing. 

What are Google shared drives and how do you use them in Google?

Johan Hammerstron: This question speaks to the nature of Google Workspace. A lot of it’s driven by Google’s philosophy, and I know that sounds kind of abstract, but it’s true. 

Originally, when Google set up its document management system, Google Docs, Google Sheets, the document was owned by the person who created the document. There were no shared documents. I mean, you could share documents, but they were always owned by an individual.

Let’s say you’re a small organization and you have a communications director, and they started creating all of these different files, presentations, communication collateral, et cetera. In Google Workspace, they’re creating that in their Google Drive. They can share it with other people. Because of how Google sets that up, it may look like it’s in a third party location that anybody can access, but when that person leaves, their account gets disabled. And suddenly, all of those documents are no longer available. This was a huge problem that organizations were having. 

Most organizations depend on having documents that are in a “third-party location,” that are owned not by any one individual, but by the organization itself and administered by the organization itself. For years, this was not possible in Google. 

You had to have all these workarounds when someone who created all these documents left the organization. You had to jump through a lot of hoops to make sure that their documents were still available. Google finally, within the last few years, developed a solution called Google shared drives, which is basically their version of the shared document libraries in Microsoft SharePoint. So, you can create a shared drive, you can create Google Docs and Google Sheets in it. You can upload documents that have been created in Microsoft’s document solution into it. And it’s not owned by any one individual. It’s owned and administered by the organization as a whole.

The best practice is for organizations to think about what shared drives do we need to create? Typically, different departments would have their own shared drives, like one for the finance team, one for a program team and then one for the development team. And then you’d have the administrator create those shared drives and then assign permissions to them to the appropriate groups.

Carolyn Woodard: I think that touches on something we’ve not really talked about yet, which is, you can set up the free version of Google Workspace so easily as a non-IT person, but then as you move into having more complex IT needs, you really need to have an administrator and use the administration more. That can be more of a challenge.

For Google shared drives, you want to have somebody in a position of authority deciding which teams have shared drives set up for them and what that architecture looks like. 

How do I off-board users and why is it important? 

Also, for offboarding users, Johan, you mentioned that it used to be that you would create these dummy accounts like emails that weren’t for anyone, so you’d have more storage. But actually, you get charged for each of those accounts. 

So, it’s not only important from a security standpoint, if somebody has left your organization, you deactivate their Google account, but also just in terms of your costs. Can you talk about that a little bit?

Johan Hammerstrom: The advantage of Google Workspace, especially for smaller organizations is that it’s very easy to set up. But the danger of Google Workspace is that it gets set up and then if whoever set it up walks away, then no one’s maintaining or managing it over time. And that can create a lot of issues and problems. 

So, it’s really important, and this gets back to the maturity model, that there be a person of authority who has on their job description, ownership of IT and that that person either directly or through delegation, manages the Google Workspace over time. Because someone needs to be responsible for creating new accounts when new people join the organization. And it’s also very important that you disable accounts when people leave the organization.

We’ve seen lots of instances, especially with smaller organizations, where Google Workspace was set up, but then no one was given responsibility for it over time. And all of these departed staff still had active accounts in the organization’s Google Workspace. In some cases, they were still accessing their work email, even though they no longer were working for the organization. Having a basic set of processes in place for managing Google Workspace long-term is a critical part to using the solution effectively.

Carolyn Woodard: I feel like the next question too, about the third-party backup and third-party mail filtering is another security issue. 

Third Party Backups for Google Workspace

Google Workspace doesn’t require you to back up what you’re doing, it’s in the cloud, right? But as a growing organization, you would want to have more ability to restore from backup than that. Is that correct?

Johan Hammerstrom: You really want to have centralized administrative control over your Google Workspace. And Google has improved the ability to do that. But it’s still not as strong as the Microsoft platform. So, having a third-party solution plugged into your Google Workspace can be helpful. Like, if you have a situation where you have a disgruntled employee, they could delete all of their email and then permanently delete it. And if they had the right level of access, delete it beyond recovery. Or, someone could delete it and then five or six months later realize there was a critical piece of grant information that only went to this person and now their mailbox has been deleted, because they left five months ago, and there’s no way to recover it at that point.

So, third-party backup solutions are really helpful in those situations. They ensure that the organization has point in time access to all of the data that’s being stored and created in Google Workspace over a timeframe that they control. Google doesn’t give you control over retention in the same way that a third party backup solution can.

Carolyn Woodard: One of the questions that we get a lot that relates back to this is:

Who’s in charge of your Google Workspace? What are governance best practices and policies that you might need to manage your Google Workspace?

Johan Hammerstrom: Well, the most basic governance best practice is that somebody needs to own IT in the organization. There needs to be a clear ownership of IT. It needs to be a part of somebody’s job description and it needs to report up to senior leadership.

Typically, it’s whoever’s in charge of operations. Sometimes it’ll be finance, but I think nowadays it’s more common that the top operational leader in the organization is at least nominally in charge of it. And then they should be supervising the person who is directly or indirectly managing it. That’s one of the most important best practices around governance. 

In terms of policies, we’d recommend an acceptable use policy of which there are many examples out there on the internet. It is important to outline for staff what is acceptable for them to do with their computers and their IT systems and what the expectations are for them around the use of those systems.

It’s also important to make sure that security is part of that policy. Security policies can include the controls that are put in place for monitoring risk levels and preventing risk levels. 

Of course, now AI is becoming front of mind for a lot of people and that can be either baked into your acceptable use policy or it can be set up as its own standalone policy.

Carolyn Woodard: Community IT will be having a free webinar on governance and policy documents that you might need. We also have an AI acceptable use policy. 

What about device management using Google Workspace? Is that something people need to worry about?

Johan Hammerstrom: It’s not great. Device management applies to Chromebooks and Android devices. We would definitely not recommend using Google Workspace’s device management tools to manage Windows, Macs, iPads or iPhones. It’s somewhat basic and if you really want to manage Chromebooks or Android devices effectively, it’s worth looking at third-party solutions. 

Generally, since most organizations are using Mac or Windows, we found that either a third-party solution or Microsoft’s endpoint manager tends to work better for managing devices.

Carolyn Woodard: And that’s again, a question as you’re getting bigger and more people have devices they’re using for work. 

What is 2SV? What is MFA?

I hadn’t seen that acronym before, although I have seen MFA, which is multi-factor authentication. So, can you talk a little bit about that?

Johan Hammerstrom: 2SV stands for two-step verification. If you go to Google’s support site, they say 2SV, two-step verification, also known as MFA. And their support site basically says that they’re the same thing. They’re not the same thing. 

MFA is a subset of 2SV. 2SV, two-step verification, means you need to do two things to verify your identity to gain access to your email or any other resources. 

• The first thing that you use to verify your identity is almost always a password. So, you enter your username and password, that’s the first step. 
• And then the second step is some other form of verification. Now, multifactor authentication is a subset of what that second step is.

And so the multifactor could be a code that you have on your phone, you enter that code in and that’s the second step, and now you’ve been authenticated onto the system. A password is something that you know. And then if they ask you a question like, what was the name of your first teacher in second grade? That’s not a second factor. That’s also something you know. It’s a knowledge factor and it is a two-step process to verify. 

It’s using the same type of factor, knowledge factors, which are more compromisable. 

Long story short, you should definitely implement 2SV for all of your accounts and you should make sure that the second step of the two-step verification is a possession factor. 

That’s a text message that’s getting sent to your phone, or preferably the Google Authenticator app running on your phone and using the code that’s coming out of that app.

So, there’s a whole rabbit hole around all of this and Google’s implementation of it is somewhat confusing. But the quick answer is definitely implement 2SV and set up the policy in such a way that the second V is a multifactor authentication.

Carolyn Woodard: I use the Google Authenticator for most of my accounts, social media and even personal accounts. So, I think Google does make it easy to set up multi-factor authentication. 

You need to have an owner of Google Workspace that’s requiring people as part of your policy to have multi-factor authentication on all of your accounts that you’re using for business. And of course, it makes sense on your personal accounts too. 

Nonprofit Learning Lab: I’m used to having an internal server or Dropbox to organize shared files, and I’m struggling with Google Drive and how my new org shares folders. 

Do you have any resources or advice on how an organization can use Drive or Sites as an internal server versus individually sharing and organizing?

Johan Hammerstrom: That’s a great question. I think the Google shared drive is probably the first place to look. It might require you to migrate files out of the Google Drive, which is owned by individuals, into the Google shared drive, which is administered and configured by the administrator of the Google Workspace.

If you find that that solution doesn’t meet your needs, it is possible to integrate third-party solutions like Dropbox and Inbox with Google Workspace. One of the most common use cases we see for Box is for Google organizations that have Google Workspace that need a more advanced way of managing documents. They’ll just set up Box and then it integrates really well with Google Workspace.

Nonprofit Learning Lab: Thank you. Our next question is 

How are nonprofit licenses registered in Google Workspace?

Johan Hammerstrom: Basically, you’ll need to apply for nonprofit status with Google and then once that’s approved, you can set up your Google Workspace tenant. And then once you’ve done that, you’ll have access to the discounted licenses that I was showing earlier. If you go to Google and “Google Workspace Nonprofit,” it’ll take you through the process of applying for the nonprofit status.

Nonprofit Learning Lab: Great, thank you. 

Are there any IT security trainings that you would recommend?

Johan Hammerstrom: Yes. We have a number on our website, actually. We have a really thorough webinar series that we run, and then we record and publish all of those completely free to access on our YouTube channel. 

Our goal is to share our knowledge with the nonprofit sector. So, we have a number of webinars on our website about cybersecurity, and we actually have one about building your own cybersecurity training curriculum for your organization.

Nonprofit Learning Lab: Great. 

Do you have any templates for policies related to Google Workspace?

Carolyn Woodard: We’re having a webinar in which we will be sharing a lot of links to our resources and also some other templates that are out there that we recommend as a place to get started. We will be definitely sharing some Google Workspace acceptable use policy templates there.

Thank you so much. This was just a wonderful experience and opportunity.

Johan Hammerstrom: Yeah. Thanks, everyone for joining us today and thank you Nonprofit Learning Lab for hosting. We appreciate it.

Nonprofit Learning Lab: Thank you so much for participating, and again, thank you Johann and Carolyn for educating our community.