In a new Claude Team organization, an AI agent that can work on employees’ computers is switched on by default. So is a mode that lets that agent approve its own actions, and so is remote control of the agent from a phone. Adelia Risk built this Claude security guide so firms on Claude Team and Claude Enterprise can find defaults like these and change the ones that don’t fit.
This guide covers 76 settings in the Claude admin console, grouped into six areas that follow the console’s own menus. Every setting has a permanent ID (ORG-005, DATA-010, CODE-005), a risk level, the exact place to find it, and what we recommend. We wrote it for whoever ends up owning Claude at a regulated firm. That might be the CCO at a registered investment adviser, the operations lead at a wealth management firm, or the IT provider who got handed the admin login.
A report we ran at one of our larger RIA clients found dozens of unapproved AI tools on the firm’s computers. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users were bringing their own AI tools to work. Letting staff do firm work in personal AI accounts is like letting them use personal email for business. The firm has zero control over those tools, and its data ends up in them.
A firm-managed Claude plan is usually safer, but only once it’s configured. In IBM’s 2025 breach study, 97% of the organizations that reported a breach of an AI model or application said they didn’t have AI access controls in place.
If you’d rather have us review your Claude organization, Adelia Risk does that as part of our virtual CISO services. This guide gives you what you need to do it yourself.
Why Claude needs its own security benchmark
There’s no CIS Benchmark for Claude. We checked the public CIS Benchmarks list in October 2026, and it has benchmarks for Microsoft 365 and Google Workspace but nothing for Anthropic or Claude. So we built one.
The benchmark draws on three sources: CIS’s AI guidance, Anthropic’s admin documentation and the live console.
- In April 2026, CIS released three CIS Controls companion guides that apply the CIS Controls to large language models, AI agents and MCP connections (the standard most Claude connectors use). They tell you what to protect but not which Claude toggle to flip.
- Every “Where to Find It” section in this guide links to the Anthropic help article for that setting. Where Anthropic hasn’t published one, we say so.
- We walked every page of a Claude Team admin console in October 2026 and took each path and label from what was on screen. Anthropic moves settings often. Two settings changed pages or names in September 2026 alone, so expect some drift and check the date at the bottom of each page.
Much of the risk in this guide comes from hidden instructions planted in a web page, document, email or tool result that steer Claude into doing something the user didn’t ask for (prompt injection). OWASP ranks it first in its Top 10 for LLM applications. Anthropic’s own guidance for Claude in Chrome calls prompt injection “the biggest risk facing browser-using AI tools.”
When staff use Claude for chat, the way most people use ChatGPT, we have few concerns. The features that let Claude act, such as Cowork, connectors and Claude Code, call for a longer conversation, and they’re where prompt injection can do the most harm. Many of the settings here limit what Claude can reach, so a successful injection has less to work with.
Claude Team vs. Claude Enterprise
Your plan limits how far you can lock Claude down.
Claude Team is built for groups of 2 to 150 people. It has most of the controls in this guide: SSO, organization instructions, sharing controls, capability toggles, Cowork approval modes, Claude Code managed settings, connector controls and OpenTelemetry monitoring for Cowork and Office Agents.
Claude Enterprise adds the controls a regulated firm usually needs to answer an examiner’s questions:
- Audit logs you can export (Team has none)
- The Compliance API, which lets archiving and data loss prevention (DLP) vendors pull Claude activity into your records system
- A data retention setting you choose (Team uses Anthropic’s default)
- SCIM provisioning, which removes a person’s seat when your identity provider deactivates them
- Shortened session length, support contacts, connector domain restriction, inference hooks for inline DLP, and custom roles and groups that let you give a feature to some people instead of everyone
Eleven controls in this benchmark exist only on Enterprise. When we review a Team organization, those rows get the result “Enterprise”, which means only an upgrade can close the gap. The upgrade decision belongs in BILL-007.
Enterprise is a bigger step. Anthropic’s migration guide says Enterprise organizations have a 20 seat minimum and that migrating from Team to Enterprise through the self-serve path isn’t reversible. Pricing is a seat price plus usage at API rates.
For a regulated firm, Enterprise is often what makes Claude a tool the firm can defend. For a firm that isn’t regulated, Team plus the settings in this guide is usually enough. Either way, write the decision down, so that if Claude is ever involved in a breach, the firm can at least show it made explicit decisions about the setup.
How to use this guide
Each of the six area pages starts with a Quick Reference table and then walks through each setting from highest risk to lowest. Every setting shows:
- Risk: 🔴 Critical, 🟠 High, 🟡 Medium or 🟢 Low
- Heads Up? “Yes” means your team will notice the change, and we include a sample message you can send them first
- Plan: “Team and Enterprise” or “Enterprise only”
- Where to Find It: the admin console path and a link to Anthropic’s documentation
Every setting also has an anchor link, so /claude-security-guide/data-and-privacy/#DATA-010 jumps straight to that setting. When Adelia Risk runs a Claude security review, the results sheet links each finding to its section here.
The 6 Claude security areas
| Area | Controls | Critical / High | What it covers | Guide |
|---|---|---|---|---|
| Organization and access | 16 | 4 / 4 | Domains, SSO, provisioning, invites, organization instructions, plan, usage limits, members | Organization and access guide |
| Data and privacy | 15 | 2 / 5 | Chat, project and session sharing, data export, feedback, location, monitoring, audit logs, retention, Compliance API | Data and privacy guide |
| Capabilities | 16 | 1 / 6 | Web search, built-in browser, Cowork approval modes, code execution, network access, remote sessions, memory | Capabilities guide |
| Claude Code | 13 | 1 / 2 | Managed settings, desktop and cloud sessions, Remote Control, cloud environments, Git providers | Claude Code guide |
| Agents and extensions | 10 | 2 / 2 | Cowork, Office Agents, Claude in Chrome, Claude Tag for Slack, artifacts, beta products | Agents and extensions guide |
| Connectors, plugins and skills | 6 | 0 / 3 | Connector inventory, tool permissions, desktop extensions, skills, plugins | Connectors, plugins and skills guide |
Organization and access
This is where you decide who gets into your Claude organization and on what terms. The 16 settings cover your verified domains, single sign-on, how new people are added, organization instructions, your plan and usage limits, and who holds the Owner role.
Start with ORG-005 (verified domains) and ORG-015 (single sign-on). SSO needs at least one verified domain, and it puts Claude logins under the same multi-factor authentication and offboarding rules as the rest of your systems. Firms often skip BILL-005, the rule that firm work belongs on a Team or Enterprise plan, never on someone’s personal Pro or Max account. That page also includes our recommended organization instructions text, with each line paired to the setting that enforces it, where one exists.
Read the full Organization and access guide –>
Data and privacy
The Data and privacy tab controls what leaves a person’s own chat: shared chats, public projects, shared cloud sessions, personal data exports, and what goes back to Anthropic as feedback. It’s also where Team firms set up activity monitoring for Cowork and Office Agents.
The two Critical settings here are both Enterprise only. DATA-060 (audit log export) and DATA-052 (reliable activity logging) are why a Team-plan firm can’t fully answer “what did Claude do with client data last quarter.” On Team, start with DATA-010: a shared chat that used a connector can repeat what Claude pulled from a mailbox or folder the recipient can’t open. Projects marked “public” (DATA-025) are visible to everyone in your organization, not to the internet.
Read the full Data and privacy guide –>
Capabilities
Capabilities control what Claude can do beyond answering questions: search the web, browse sites, run code, reach the internet from its sandbox, remember past chats, and act inside Cowork with or without asking first. On Team, every one of these is on or off for the whole organization.
CAP-040 (“Skip all approvals” mode) is the Critical one, and it’s off by default. Keep it that way. Most of the High-risk settings are the tool approval settings (CAP-030, CAP-035, CAP-045) and remote sessions (CAP-060, CAP-065). In the Team console we reviewed, “Automatically approve” mode and Cowork’s remote access setting (then labeled Remote Control, now Computer access) were both on by default. Web search can stay on, but make that a documented decision and train people on it.
Read the full Capabilities guide –>
Claude Code
Claude Code is an AI agent that reads files and runs commands, on a developer’s computer or in Anthropic’s cloud. Anthropic reported in November 2025 that attackers it linked to a state-sponsored group manipulated Claude Code into attempting intrusions at roughly thirty targets. Manage Claude Code the way you’d manage any other admin tool.
Start with CODE-005, the managed settings policy. An empty policy means every session runs on each developer’s own rules. That page includes the interview prompt we give clients, which has Claude question their IT lead and then draft a policy that fits, plus Adelia Risk’s tiered reference baseline. Then turn off what you don’t use: CODE-020 (Remote Control) and CLOUD-005 (self-hosted environments) are the High-risk toggles.
Read the full Claude Code guide –>
Agents and extensions
These are the products where Claude acts on a person’s behalf: Cowork on their computer, Claude in Chrome in their browser, Office Agents in Excel, PowerPoint, Word and Outlook, Claude Tag in Slack, plus artifacts and the beta products. Several of them start on.
Two settings are Critical. COWORK-005 covers Cowork, which works with a person’s files, apps and connectors. Keep it on only with monitoring and trusted devices, and with auto-approve off. CHROME-005 covers Claude in Chrome, which can read pages, click and fill in forms on the sites a person is signed into. Anthropic advises against using it on sensitive sites, including financial accounts.
Read the full Agents and extensions guide –>
Connectors, plugins and skills
A connector gives Claude whatever the connecting person can see in another system, such as their mailbox, Drive or CRM. Skills and plugins bundle instructions and sometimes code that everyone’s Claude follows. Treat all of them as third-party access and keep an inventory.
CONN-005 asks for a named owner and business reason for every connector, and CONN-015 caps what each connector’s tools can do, so write and delete actions need approval. PLUG-005 covers skill publishing. On Team, the default publishing setting lets any member publish a skill to the whole organization without review.
Read the full Connectors, plugins and skills guide –>
Beyond the admin console
The practices below aren’t console settings, so we keep them out of the benchmark’s 76 controls. We still cover them in every engagement.
- Put MFA and device rules on the Claude app in your identity provider. Once SSO is on (ORG-015), multi-factor authentication and sign-in rules live in Okta, Microsoft Entra ID or Google, not in Claude. Require phishing-resistant MFA for Owners, and require a managed device where your identity provider supports it.
- Screenshot every admin page at each review. Anthropic changes the console often. Compare each set with the last one to catch any new setting that arrived switched on.
- Treat Zero Data Retention as a contract decision. Anthropic’s documentation says Zero Data Retention isn’t part of the standard Enterprise plan and can’t be turned on from admin settings. If your firm has record-keeping obligations, check whether keeping no data conflicts with them before you ask for it.
- Decide which models people can use. Model access and default model settings are Enterprise only. This is mostly an operational choice, not a security one.
- Give non-developers a locked-down place to run Claude Code. Instead of installing Claude Code on every laptop, some firms run it on one isolated machine or container with an approved list of websites it can reach and no stored credentials.
- Review connectors, plugins, skills and members every quarter. People change roles and projects end. The inventory you built for CONN-005 goes stale fast.
- Name Claude in your AI acceptable use policy. Say which Claude products are approved, what data may go into them, and that shared chats are firm records. Our AI acceptable use policy template is a starting point.
- Keep a change log for the admin console. Write down who changed which setting, when, and why. Team plans have no audit log to do it for you.
- Pin work devices to your Claude organization at the network edge. Enterprise firms can have their web proxy add a header that restricts which Claude organizations a device can sign in to, so a work laptop that goes through that proxy can’t use a personal Claude account.
- Add request-level logging through a gateway if you need it. Anthropic’s Claude Code admin guide describes a self-hosted gateway that records each request with the person’s identity, for firms that need more than Enterprise audit logs.
- Review usage analytics and spend every month. A sudden jump in one person’s usage can be the first sign of a problem. Owners can see this in Claude’s usage analytics.
- Check what members can still change. Organization settings set the ceiling. Members still choose some things for themselves, such as which connectors they sign in to, per-tool approvals within the limits you set, and whether to let Claude save sensitive topics to memory when you allow it. Set the organization toggles first, then tell people what’s theirs to decide.
Need help securing Claude?
Adelia Risk reviews Claude Team and Enterprise organizations for firms that want a second set of eyes or don’t have the time to work through 76 settings. We walk your admin console, score every control in this benchmark, explain the Team-versus-Enterprise trade-off in plain terms, and plan the rollout with you so the people who use Claude every day aren’t caught off guard. If you’re a registered investment adviser, see our RIA cybersecurity services. Everyone else can learn more about our virtual CISO services.
Verified against the Claude admin console in October 2026.
The Adelia Risk Claude Security Guide covers 76 controls across the Claude Team and Enterprise admin console. Start with Organization and access.
