Section 1: The Absolute Basics (Do these today)
These are the most important security settings. If you only do one section, do this one.
Turn on Multi-Factor Authentication (MFA)
Require every employee to use an app on their phone (like Microsoft Authenticator or Google Authenticator) to log in. This stops 99% of password hacking.
Use Strong Passwords
Make sure passwords must be at least 12 letters long. Do not use easily guessable words like your company name or the season (e.g., "Summer2026").
Turn on the "External Sender" Warning
Add a warning banner at the top of any email that comes from outside your company. This helps employees realize that an email might not actually be from the CEO.
Section 2: Stop Email Spoofing (Technical settings)
These settings tell the internet that your emails are real, and help stop hackers from pretending to be your company.
Set up SPF (Sender Policy Framework)
This tells the world which computers are allowed to send emails on behalf of your company. It prevents a random hacker server from sending mail that looks like it came from you.
Set up DKIM (DomainKeys Identified Mail)
This puts a hidden digital signature on your emails. It proves that the email actually came from your company and that a hacker did not change the words in the middle of delivery.
Set up DMARC (Domain-based Message Authentication, Reporting, and Conformance)
This tells other email providers (like Gmail or Yahoo) what to do if they get an email pretending to be you that fails the SPF and DKIM checks. You should tell them to "Reject" those fake emails.
Section 3: Filtering Bad Stuff (Defenses)
Keep the bad emails from ever reaching your employees' inboxes.
Block Dangerous Files
Block emails that have dangerous files attached to them. Examples of dangerous file types are: .exe, .bat, .js, .scr, and .vbs. Your employees almost never need these.
Turn on Safe Links Checking
Use a service (like Microsoft Defender or Proofpoint) that automatically checks links in an email *at the moment* the user clicks them. If the link was changed to a bad website after the email was sent, the system will block it.
Section 4: Educating the Team
Your people are your last line of defense.
Train Your Staff Every Year
Teach them how to spot fake emails. Show them real examples of phishing.
Give Them a "Report Phishing" Button
Make it very easy for an employee to report a bad email to the IT team. A single click button in their email app is best.