An email security baseline is the minimum set of controls a tenant receives by default or through licensing. It is only effective when settings are tuned, roles are assigned, and the organisation measures whether attacks still reach the inbox.
What an email security baseline does
An email security baseline is the minimum control set a tenant gets by default or through licensing. It establishes a starting point, not a finished defence, and its value depends on whether the organisation tunes settings, assigns ownership, and validates that attacks still do not reach the inbox.
That distinction matters because many email threats are not stopped by generic defaults alone. Baselines typically cover sender authentication, message filtering, tenant-level policies, and remediation features, but those controls only work as intended when they are aligned with mail flow, user roles, and the organisation’s tolerance for false positives and missed attacks.
Why email baselines need tuning
A baseline is usually designed to be broadly safe, not optimised for a specific risk profile. Organisations with high phishing exposure, executive targeting, external mail dependencies, or sensitive business processes often need stricter handling for impersonation, URL threats, attachment analysis, and post-delivery actions such as quarantine or recall.
The practical issue is that an untouched baseline can create a false sense of protection. If the defaults are too permissive, malicious mail reaches users; if they are too aggressive, business communication breaks and users work around the control. The right configuration is therefore a balance between prevention, usability, and the speed of response when suspicious mail gets through.
Email security baseline controls in context
Good baselines sit inside a broader email architecture, not as a substitute for it. They usually need to work alongside domain authentication, gateway or cloud email controls, secure routing, attachment and link inspection, and post-delivery remediation so the tenant can deal with both inbound and internal abuse.
For that reason, email security baselines are best understood as a control floor. They define what should already be on, while the rest of the programme determines whether the organisation can detect spoofing, block malicious content, and recover quickly when an attack bypasses the first layer.
NHIMG’s Email Security Guide is the most direct reference for how baseline controls relate to SEG, ICES, DMARC, routing, sandboxing, and remediation in a full email security stack.
How to assess whether the baseline is actually working
The useful test is not whether the tenant has a baseline, but whether the organisation measures its effect. That means checking whether malicious messages are landing, whether users can report suspicious mail, whether high-value mailboxes are protected more tightly, and whether policy changes are tracked over time.
Baselines also need operational ownership. Someone must decide which settings are mandatory, which exceptions are acceptable, and when a licensing tier or feature gap means the baseline should be supplemented by stronger controls elsewhere.
For teams comparing products or confirming coverage, Email Security Buyer’s Guide is useful for evaluating SEG, ICES, API permissions, and proof-of-concept criteria, while Cloud Security Guide helps place email baselines inside the wider identity, logging, and posture model used across cloud services.
Risk and Threat Considerations
Email security baselines are attractive targets because attackers only need one weak tenant setting, one overbroad exception, or one missed detection path to deliver phishing, malware, or business email compromise at scale. The largest risk is assuming the baseline is a complete defence when it is really a minimum starting point.
Failure mechanism: Weak default policy, poor licensing coverage, or unreviewed exceptions allow spoofed, malicious, or internally relayed email to bypass controls, and attackers then rely on users or downstream processes to finish the compromise.
Impact: Inbox compromise can lead to credential theft, fraudulent payment requests, malicious attachment execution, data loss, and degraded trust in email as a business channel.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.8.7 — Protection against malware | Email baselines often include malware and attachment filtering controls. |
| A.5.15 — Access control | Baseline administration depends on who can change tenant security settings and exceptions. | |
| Recommendation — Tune mail filtering and sandboxing to block malicious attachments and links. Restrict who can alter email security policies and approved exceptions. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Email filtering and attachment inspection directly support blocking malicious content. |
| AU-6 — Audit Review, Analysis, and Reporting | Baselines need measurement of what reaches the inbox and what is remediated. | |
| Recommendation — Deploy malicious code protections for inbound email and attachments. Review mail security logs and alert data to verify baseline effectiveness. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Email baseline controls map directly to phishing, filtering, and browser-linked email attack mitigation. |
| Recommendation — Implement email protections that reduce phishing, spoofing, and malicious content delivery. | ||
Practitioner Guidance
Why practitioners should care: Treat the baseline as an enforceable minimum standard, not a procurement feature. The real control objective is whether the tenant is hardened enough for the organisation’s threat level and whether deviations are explicitly owned.
What to watch for: Review privilege around mail security administration, untracked policy exceptions, and weak measurement of delivery outcomes. If no one can show what the baseline blocks, what still reaches users, and what happens after delivery, the control is not mature enough to rely on.
Practitioner takeaway: The most effective email baseline is the one that is continuously tuned, measured, and governed, because default settings alone do not stop modern phishing or tenant-specific abuse.
Related resources from NHI Mgmt Group
- How should public sector teams strengthen email security when baseline filtering is missing targeted phishing threats?
- How should security teams implement AI agent email access without over-granting permissions?
- How should security teams handle new hire passwords without using Slack or email?
- How should security teams reduce spoofing risk in email and voice workflows?