Back to Email security

To keep a copy, print this page or save it as a PDF from your browser.

Salmini Checklist1 page

Communication Security · Email security

Email security checklist

Who leads Whoever looks after your email Name

Use it when

you're setting up the organisation's email, or doing the check every three months.

What to set up

An organisation account for everyone, and work kept out of personal email.
Two-factor required for every account, admins first.
Recovery email and phone current for each account.
The top admin account held by two trusted people in the organisation.
Unused accounts closed, and admin rights checked.
No forwarding or app access that nobody recognises.

Look after your domain

Registered in the organisation’s name, with automatic renewal on.
Two-factor on the registrar account.
SPF and DKIM switched on, confirmed with whoever set up your email.

Keep it out of email

Names of sources and case details go on Signal, not email.
Sensitive files shared through a folder, not as attachments.

Notes

Take care: If someone else is in an email account, win it back before any other.

Started Done Review again