Turn on hosted S/MIME for message encryption
Apps > Google Workspace > Gmail > User settings. Requires having the Gmail Settings administrator privilege. On the left, under Organizations, select the organizational unit you want to configure. Scroll to the S/MIME setting, and click to expand it.
Read more