Google Drive Access Reviews for SOC 2 & ISO 27001

At some point during a SOC 2 or ISO 27001 audit, the auditor asks a question that sounds simple: "Show me evidence of your periodic user access reviews."

Most teams answer it for their SaaS apps — the identity provider's user list, screenshots of role assignments, an offboarding ticket. And then Drive comes up. Your company's contracts, financials, and customer data live in Google Drive, shared file by file, over years — and none of that sharing is visible in your identity provider.

This guide covers what auditors actually expect for Drive, and a repeatable process that produces the evidence in an afternoon.

Where access reviews appear in the frameworks​

You don't need to be a compliance expert, but it helps to know which controls the auditor is testing:

The frameworks don't prescribe how — no control says "export a spreadsheet." What auditors need is proof that the review happened, on a schedule, with findings acted on. That means dated artifacts, not good intentions.

Why Drive is the blind spot​

Access reviews usually start from the identity provider (Google Workspace, Okta, Entra). That covers who can log in to what app. It says nothing about what files each account can reach, because Drive permissions live on individual files and folders:

• A contractor whose Google account was never fully offboarded still opens the finance folder shared with their personal Gmail.
• A due-diligence folder set to "anyone with the link" during a fundraise, still public two years later.
• An ex-employee who remains the owner of files your team depends on.

None of this shows up in an IdP export. The Workspace Admin console's audit log doesn't answer it either — it records sharing events, not the current permission state. To review Drive access, you need a point-in-time snapshot of every file and every permission on it.

The review process, step by step​

Step 1: Export the current state of your Drive​

Generate one spreadsheet listing every file and every permission — see the full walkthrough in how to export Google Drive permissions. In short: copy the DriveAuditr template, run Drive Audit → Run Audit Now, and let it process in batches. You get one row per (file, permission) pair: file name, owner, permission type, role, email, and domain.

The export is dated by its run — that date is the anchor for your evidence.

Step 2: Review against a defined checklist​

Auditors like reviews with defined scope. Filter the sheet through each of these lenses and record what you find:

1. Public access — Permission type = anyone. Should any of these files be internet-accessible? (Full walkthrough: finding publicly shared files.)
2. External accounts — permission emails outside your domain. Is each one a current vendor, client, or contractor with a business need?
3. Departed people — filter for every offboarded employee and ended contract from the review period. They should appear zero times. (If they do appear: how to find and remove someone's access.)
4. Ownership — files owned by accounts that are suspended, personal, or no longer with the company.
5. Over-privileged roles — external writer roles that should be reader or commenter.

The Google Drive security audit checklist expands each of these into concrete filter steps.

Step 3: Record findings and remediate​

Keep a running review log — a second tab in the same spreadsheet works. For each finding: what you found, the decision, who fixed it, and when:

"Keep — reviewed, still needed" entries matter as much as removals: they show the review was a judgment process, not a rubber stamp.

Step 4: Snapshot and sign off​

When remediation is done, produce the closing evidence:

• Download the audit sheet as PDF or Excel (File → Download) — a dated, immutable snapshot.
• Have the review owner (typically your security lead or CTO) sign off — an email, a ticket comment, or a signed row in the log.
• File both wherever your compliance evidence lives (Drive folder, Vanta, Drata, a ticket).

Step 5: Make it recurring​

A one-off review satisfies nobody — SOC 2 Type II auditors sample evidence across the whole observation period. Quarterly is the common cadence for access reviews; monthly if you handle sensitive data.

Drive Audit → Setup Weekly Schedule re-runs the export automatically, so the snapshot is always fresh when review day comes. Put the review itself on the calendar with an owner — the auditor will ask who's responsible.

Frequently asked​

Will auditors accept a spreadsheet as evidence? Generally yes. Auditors care that the review is documented, dated, scoped, and acted upon — not about tooling. A dated export plus a findings log with sign-off is a textbook access-review artifact. Confirm with your auditor early.

Doesn't Google Workspace have this built in? Not really. The Admin console's Drive audit log records sharing events, not current state. Enterprise tiers add DLP rules and trust rules, but there's still no "export all current permissions" button. You need the API, a script, or a prebuilt template.

Do I need this for SOC 2 Type I? Type I tests design at a point in time — one documented review demonstrates the control exists. Type II tests operation over months, so you'll need the recurring cadence with evidence from each cycle.

We're small — five people. Is this overkill? The review scales down naturally: a five-person Drive exports in minutes and reviews in under an hour. Auditors don't lower the bar for small companies; they just expect proportionally simpler evidence.

Next steps​

• Export Google Drive permissions to a spreadsheet — the evidence-generation step in detail
• Google Drive security audit checklist — the full 10-step review scope
• See who has access to every file in your Drive

Questions? Email driveauditr@terrydjony.com.