Cyber Essentials: Email authentication is explicitly required
Cyber Insurance: Underwriters won't cover you without baseline email security
The Compliance Checklist
1. GDPR and Email
GDPR requires you to protect personal data. Email is how data moves around.
Data Protection: Your emails contain customer/staff data—it must be secure in transit
Breach Notification: If email is compromised, you have 72 hours to notify regulators
Email Records: You must keep email logs for audit purposes
Monitoring: You must be able to detect if something's wrong
What auditors check: Authentication (SPF/DKIM/DMARC), encryption, access controls, logging
2. NIS2 and Critical Infrastructure
If you're critical infrastructure (energy, water, transport, health), NIS2 applies to you.
Email is an Attack Vector: Phishing is how most breaches start
You Must Have Controls: Multi-factor auth, email filtering, monitoring
Incident Response: You must be able to respond to email-based attacks within specific timeframes
What auditors check: Authentication, phishing defenses, incident response plan, staff training
3. Cyber Essentials Certification
Cyber Essentials is the UK's baseline security certification. Email is explicitly required.
SPF/DKIM/DMARC Required: These are non-negotiable for certification
Email Filtering: You must filter phishing and malware
Access Controls: Multi-factor auth on email accounts
Backups: You must be able to recover from ransomware attacks
What's checked: Technical controls, not just intentions
4. Cyber Insurance
Underwriters won't insure you if your email is a security liability.
Standard Questions: "Do you have email authentication?" "Multi-factor auth?" "Email filtering?"
Premium Reduction: Having strong email controls can lower your premiums
Claims Denial Risk: If you get hacked via email and you have no authentication, they might deny your claim
What underwriters want to see: Documented controls, evidence of implementation, monitoring in place
5. Audit-Readiness
When auditors arrive, you need evidence.
Documentation: Screenshot your SPF/DKIM/DMARC configuration
Logs: Show email logs and monitoring dashboards
Policies: Document your email security policy and controls
Incident Records: Show how you've responded to security incidents
Training: Evidence that staff have received phishing awareness training
The Practical Action Plan
You don't need to overhaul everything overnight. Here's the staged approach:
Week 1: Run the email security check. Get your baseline.
Week 2: Implement SPF/DKIM/DMARC (or ask IT to do it). This is non-negotiable for all frameworks.
Week 3: Enable multi-factor auth on email accounts. Document the policy.
Week 4: Set up email filtering for phishing. Enable logging.
Ongoing: Run phishing awareness training. Monitor logs. Document everything.
The Bottom Line
Email is your compliance foundation. Get it right, and auditors, insurers, and regulators will be satisfied. It's not a big project—it's a clear checklist that your IT team can implement in days, not months.
Get Audit-Ready Today
Run the email security check to see which controls you have and which you're missing. Share the results with your IT team and auditors.