Reference: Create and Manage Labels in Google Workspace

Google Workspace labels allow you to classify and control access to encrypted files when using Client-Side Encryption (CSE). With Virtru Private Keystore, labels are required for managing who can open encrypted content.

This article walks you through how to create, configure, and manage labels in the Google Admin console.

Step 1: Access the Label Manager

1. Sign in to the Google Admin console at admin.google.com.
2. From the Admin console home page, go to:
   Security > Access and data control > Label manager.
3. Click New Label to begin.

Step 2: Create a New Label

1. Enter a label name.
   • Label names must follow the format:
     Google Group Name: classification-<label-name> (e.g., classification-general, classification-finance).

   • The <label-name> should match the name of your corresponding Google Group.

     Example:

• Drive Label Name: CONFIDENTIAL
• Google Group Name: classification-CONFIDENTIAL.

1. Under Applications, select Drive and Docs.
   • A confirmation message will appear:
     “This label will be available to users who have permission to the label.”
   • Click Enable.
2. Click Add Fields to customize label metadata.
   • For example, you can add a Badge field, rename it to match the label, and adjust colors if desired.
3. Click Publish to make the label available.

Step 3: Set Permissions

1. On the top right of the label, click More actions.
2. Select Permissions, to choose who can apply or view the label.
   • Can apply labels: Grants users the ability to apply the label.
   • Can view this label only: Restricts users to visibility only.
3. Assign permissions to the relevant Google Groups or individual users.

Important: CSE labels do not support nested groups. Users must be added individually to the classification-<label-name> group.

Step 4: Apply Labels to Existing Files

Once labels are published, they can be applied retroactively to existing encrypted content. This step is critical if you’ve recently enabled CSE labels in Virtru Private Keystore:

• Without a label, older encrypted files cannot be accessed.
• Apply a general label (e.g., classification-general) to grant access for all employees.
• Apply restricted labels (e.g., classification-hr) for department-specific or sensitivity-based access control.

Step 5: Manage and Update Labels

• Edit or rename labels: Go back to Label Manager to update names, fields, or colors.
• Adjust permissions: Modify which groups or users can apply/view labels at any time.
• Add new labels: As your organization evolves, create additional labels for new teams or sensitivity levels.
• Audit label usage: Regularly review which groups have access to ensure compliance.

Best Practices

• Start broad, then refine: Use a single general label initially to ensure access, then expand into multiple restricted labels.
• Communicate changes: Let users know they must select a label when encrypting files.
• Review groups regularly: Ensure Google Groups tied to labels are accurate and up to date.
• Plan ahead: Because labels are permanent for CSE, map out your strategy before enabling them.