Skip to content

Google Ads access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Google Ads, Black Cat runs 14 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Ads connector needs.

Checks (14)

severity: low Email-Only User Access fix difficulty: easy #

Review Google Ads users with email-only access and remove or upgrade as appropriate

  1. Navigate to Tools & Settings > Access and security > Users
  2. Filter users by access level to identify email-only access accounts
  3. Contact the user or their manager to confirm whether account access is still required
  4. Upgrade access to an appropriate role if the user needs account access, or remove the user if access is no longer needed
  5. Document the access review decision

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Admin Users fix difficulty: medium #

Reduce the number of Google Ads admin users to minimize the blast radius of account compromise

  1. Navigate to Tools & Settings > Access and security > Users
  2. Filter users by Admin role
  3. Review each admin user and confirm whether they require admin access
  4. Downgrade users who do not require admin access to a more limited role (Standard or Read-only)
  5. Keep admin access to the minimum number of users required for business operations
  6. Document the access review decisions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Pending Invitation fix difficulty: easy #

Cancel stale pending Google Ads user invitations that have not been accepted

  1. Navigate to Tools & Settings > Access and security > Users
  2. Click the Pending invitations tab to view outstanding invitations
  3. Identify invitations that have been pending for more than 7 days
  4. Cancel invitations that are no longer needed or were sent in error
  5. Re-send invitations if the user still requires access
  6. Notify the invitee's manager of the cancelled invitation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Stale User Access fix difficulty: medium #

Remove or deactivate Google Ads users who have not accessed the account recently

  1. Navigate to Tools & Settings > Access and security > Users
  2. Review the last sign-in date for each user to identify accounts with no recent activity
  3. Contact the user or their manager to confirm whether access is still required
  4. Remove users who no longer need access to the Google Ads account
  5. For users who still require access, remind them to sign in and confirm their role is appropriate
  6. Document the access review decision for compliance records

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Account With No Admin Users fix difficulty: easy #

Assign at least one admin user to each Google Ads account to ensure it can be governed and recovered

  1. Navigate to Tools & Settings > Access and security > Users
  2. Confirm that no user holds the Admin role on this account
  3. Identify the appropriate owner (e.g., marketing manager or agency admin) and invite them with Admin access
  4. Ensure the invited user accepts the invitation and logs in to confirm access
  5. Remove any placeholder or service accounts that do not correspond to a real owner
  6. Document the assigned admin in your SaaS ownership register

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Account With Single Admin User fix difficulty: easy #

Add a second admin user to eliminate the single point of failure for account governance

  1. Navigate to Tools & Settings > Access and security > Users
  2. Confirm that only one user holds the Admin role
  3. Identify a backup admin (e.g., a senior colleague or agency contact) and invite them with Admin access
  4. Ensure the invited user accepts the invitation
  5. Document both admins in your SaaS ownership register

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Standard User Access fix difficulty: easy #

Review Standard-role users whose access was granted more than 180 days ago and confirm it is still required

  1. Navigate to Tools & Settings > Access and security > Users
  2. Filter by Standard role and sort by access grant date
  3. Contact each flagged user or their manager to confirm continued need for access
  4. Remove users who no longer require access
  5. Downgrade to Read-only for users who only need visibility without edit permissions
  6. Document the access review outcome

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Stale Admin Invitation fix difficulty: easy #

Cancel or re-send admin invitations that have been pending for more than 7 days to reduce the window for account takeover

  1. Navigate to Tools & Settings > Access and security > Users
  2. Click the Pending invitations tab
  3. Identify Admin invitations that have been pending for more than 7 days
  4. Cancel the invitation if the user no longer requires admin access
  5. Re-send the invitation if access is still needed and confirm the correct email address was used
  6. Consider sending to a shared admin inbox to ensure the invitation is not missed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Self-Granted User Access fix difficulty: medium #

Investigate and revoke self-granted access to enforce separation of duties for Google Ads account access

  1. Navigate to Tools & Settings > Access and security > Users
  2. Identify the user flagged as having granted their own access
  3. Review the access role granted and the date it was assigned
  4. Revoke the self-granted access and re-provision it through an authorized approver
  5. Implement an access request process requiring a second admin to approve new access grants
  6. Document the remediation and update your access control policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Read-Only Invitation fix difficulty: easy #

Cancel or re-send read-only invitations that have been pending for more than 14 days

  1. Navigate to Tools & Settings > Access and security > Users
  2. Click the Pending invitations tab
  3. Identify Read-only invitations that have been pending for more than 14 days
  4. Cancel the invitation if the user no longer requires access
  5. Re-send the invitation if access is still needed and confirm the correct email address was used
  6. Document the outcome in your access request log

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Email-Only User Access fix difficulty: easy #

Review email-only users whose access was granted more than 90 days ago and confirm it is still required

  1. Navigate to Tools & Settings > Access and security > Users
  2. Filter by Email-only role and sort by access grant date
  3. Contact each flagged user or their manager to confirm continued need for email report access
  4. Remove users who no longer require access
  5. Upgrade to a higher role if the user needs more than email-only visibility
  6. Document the access review outcome

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Stale Admin Access fix difficulty: easy #

Review admin user access that has not been reviewed in more than 90 days

  1. Navigate to Tools & Settings > Access and security > Users
  2. Filter by Admin role and sort by access grant date
  3. Contact each admin user or their manager to confirm continued need for admin access
  4. Downgrade to Standard or Read-only role if full admin access is no longer required
  5. Remove the user entirely if access is no longer needed
  6. Document the access review outcome

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium User Access Without Inviter fix difficulty: easy #

Investigate user access records with no recorded inviter to ensure they were properly authorized

  1. Navigate to Tools & Settings > Access and security > Users
  2. Locate the user flagged as having no inviter record
  3. Determine how the access was granted (API, bulk import, or legacy migration)
  4. Verify the access was authorized through your approval workflow
  5. If unauthorized, remove the user access immediately
  6. Document the source of the access grant for audit purposes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Standard Access Invitation fix difficulty: easy #

Cancel or re-send standard access invitations that have been pending for more than 7 days

  1. Navigate to Tools & Settings > Access and security > Users
  2. Click the Pending invitations tab
  3. Identify Standard role invitations pending for more than 7 days
  4. Cancel the invitation if the user no longer requires access
  5. Re-send the invitation if access is still needed and confirm the correct email address
  6. Document the outcome in your access request log

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Google Ads checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial