Standard
Email Security Standard
This standard defines the minimum email security controls operated by the organization. It covers email authentication (SPF, DKIM, DMARC, BIMI), inbound anti-phishing and anti-malware controls, outbound controls, business email compromise (BEC) mitigations, user reporting, secure email gateway requirements, and the supplementary controls applicable to high-risk roles.
- Type
- Standard
- Version
- 1.1.0
- Date
- 2026-10-23
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material change to email infrastructure, threat-pattern, or regulator-expected posture
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Outbound authentication
- 4. Inbound controls
- 5. Anti-phishing and BEC controls
- 6. Outbound controls
- 7. User-facing controls
- 8. Secure-email-gateway and platform controls
- 9. AI-generated and AI-processed email considerations
- 10. Incident response
- 11. Operating expectations
- 12. Framework alignment
- 13. Limitations
Frameworks it maps to
- RFC 7208
- RFC 6376
- RFC 9989
- RFC 9990
- RFC 9991
- BIMI
- RFC 8460
- RFC 8461
- NIST SP 800-177 Rev. 1
- ISO/IEC 27001:2022
- NIST CSF 2.0
- OWASP Mail Header Injection prevention
Related documents
- Cryptographic Key Lifecycle Management Frameworksecurity
- Information Security Policysecurity
- Acceptable Use Policysecurity
- Data Classification and Handling Standardsecurity
- Data Loss Prevention Standardsecurity
- Security Awareness and Training Standardsecurity
- Security Incident Response Proceduresecurity
- Privacy Notice Templateprivacy
Next
All Documents