Cloud email and identity

Your mailbox is the front door. We lock it.

For most small offices, Microsoft 365 or Google Workspace holds email, files and every login. A single compromised account can send a fake invoice from your real address. We harden the tenant, measure it against public baselines and keep it that way.

Section 1

Threat Briefing

Business email compromise produced $3.05 billion in reported losses to the FBI in 2025. (FBI IC3 2025)

MFA works. Microsoft researchers found it reduced the risk of compromise by 99.22% across the population studied, and by 98.56% for accounts whose credentials had already leaked. Authenticator apps performed better than SMS codes. (Microsoft Research)

Not all MFA is equal. CISA recommends phishing-resistant MFA, such as FIDO/WebAuthn security keys, especially for administrators. (CISA fact sheet)

CISA publishes secure configuration baselines for Microsoft 365 (Entra ID, Defender, Exchange Online, SharePoint and OneDrive, Teams, Power BI and Power Platform) and the free ScubaGear tool to check a tenant against them. (CISA SCuBA)

Mailbox providers now enforce sender authentication. Since February 2024, Google requires senders of 5,000 or more messages a day to Gmail to use SPF, DKIM and DMARC. (Google)

Section 2

Risk and Compliance Matrix

Exposure	Framework or rule it maps to	What it costs you
Accounts without MFA, or with SMS codes only	CISA phishing-resistant MFA guidance; NIST CSF 2.0 PR.AA; FTC Safeguards 16 CFR 314.4(c)(5) MFA	Account takeover and invoice fraud from your own domain
Tenant settings never reviewed against a baseline	CISA SCuBA secure configuration baselines	Legacy sign-in, external forwarding and open sharing left on by default
No DMARC policy on your domain	Google email sender requirements; DMARC (RFC 7489)	Spoofed mail in your name; legitimate mail sent to spam
Admin accounts used for daily email	NIST CSF 2.0 PR.AA; CISA SCuBA Entra ID baseline	One phished click gives an attacker control of the whole tenant

Section 3

Architecture and Remediation Directives

Require MFA for every user, and phishing-resistant MFA (security keys or passkeys) for administrators. Block legacy authentication.
Separate admin accounts from daily mailboxes, and keep at least two break-glass accounts with long passwords stored offline.
Run CISA ScubaGear against Microsoft 365 (or the Google Workspace security health checks) at onboarding and quarterly, and fix failures in priority order.
Publish SPF and DKIM, then move DMARC from monitoring to quarantine and reject once reports show legitimate senders pass.
Alert on new inbox forwarding rules, impossible travel sign-ins and new OAuth app consents. Disable automatic forwarding to outside addresses.
Require a voice callback on a known number before any change to payment or bank details. This is a business process, not a software setting.

Section 4

Vendor-Neutral Verification Checklist

Three tests that work against any provider, including us. Run them before you sign anything.

Run CISA ScubaGear (free, from GitHub) against your Microsoft 365 tenant, or open the Google Workspace security health page, and count the failed checks.
Look up your DMARC record: run nslookup -type=txt _dmarc.yourdomain.com. No record, or p=none after several months, means spoofing is not being blocked.
Pull the MFA registration report and list every account with no MFA or SMS only. That list should be empty for administrators.

Administration

Everyday administration, done the secure way

Task	How we handle it
New users	Account, license, groups and shared mailbox access created from a checklist, with MFA enrolled on first sign-in
Departures	Sign-in blocked, sessions revoked, mailbox converted or delegated, files transferred to a manager
Licenses	Monthly review so you are not paying for unused seats or missing a feature you need
Sharing	External sharing limited to approved domains or links that expire
Changes	Logged in your ticket history so you can see who changed what and why

FAQ

Frequently asked questions

Do you handle day-to-day administration, or only security?

Both. We add and remove users, manage licenses, shared mailboxes, groups, calendars, Teams or Google Chat spaces and sharing settings, and we keep the security baseline in place while doing it.

Microsoft 365 or Google Workspace: which should we use?

Either works well for small offices. We usually recommend staying on the one you have unless a key application or client requirement favors the other. If you are deciding fresh, we compare cost, the apps your staff already know and your compliance needs.

Can you migrate us between platforms?

Yes. We migrate mail, calendars, contacts and files with a pilot group first and a planned cutover so email keeps flowing.

Who owns the tenant?

You do. The tenant is registered to your business with a break-glass admin account you control. We work through named admin accounts protected with MFA.

What is the CISA baseline you mention?

CISA publishes secure configuration baselines for Microsoft 365 and Google Workspace through its SCuBA project. We use them as a checklist and document any setting you choose to leave different.

How we package it