Who is accountable when email security gaps expose student and staff accounts to phishing?

Why This Matters for Security Teams

Email remains one of the most exposed trust boundaries in higher education because it connects staff, students, alumni, vendors, and cloud services in a single channel. When phishing reaches student and staff mailboxes, the issue is not just message hygiene. It becomes a governance question about who owns the risk, who approves the control baseline, and who is responsible for monitoring gaps that allow account compromise. NIST SP 800-53 Rev. 5 frames this as a control accountability problem across access, awareness, monitoring, and incident response, not a single product failure, as outlined in NIST SP 800-53 Rev 5 Security and Privacy Controls.

In practice, accountability usually sits with the organisation that owns the risk, but responsibility is split across security operations, messaging administrators, identity teams, and governance leaders. That split often creates a dangerous assumption that someone else is watching for weak MFA adoption, risky inbox rules, legacy authentication, or inadequate reporting workflows. If the institution accepts the risk of delayed remediation, it also accepts the downstream impact on student records, payroll data, research access, and service continuity. In practice, many security teams encounter accountability questions only after a phishing-driven compromise has already been used to reset passwords, reroute payments, or spread further messages.

How It Works in Practice

Accountability works best when it is assigned to the risk owner, while execution is distributed across the teams that operate email, identity, and incident response. For universities and colleges, that usually means the CISO or equivalent security leader owns the control posture, the IT director or messaging service owner runs the platform, and governance bodies approve exceptions where cost, usability, or legacy dependencies make ideal controls difficult to implement.

Effective practice starts with defining the minimum email security baseline and then proving that it is operating as intended. That baseline typically includes:

• MFA for privileged and high-risk accounts, with tighter controls for administrators and finance users.
• Anti-phishing filters, domain protection, and authentication checks such as SPF, DKIM, and DMARC.
• Conditional access and risk-based sign-in rules for unusual locations, devices, or mailbox behaviour.
• Alerting, triage, and containment procedures for suspicious inbox forwarding rules, token abuse, and account takeover.
• User reporting paths that feed directly into the SOC or help desk for fast validation and response.

Accountability is clearer when each control has an owner, an evidence source, and a review cadence. That includes logging who can change mail security policies, who reviews exceptions, and who signs off on residual risk. Where phishing exposure affects students, the identity layer matters too, because compromised email often becomes the recovery path for password resets, MFA enrolment changes, and self-service account recovery. Guidance from Anthropic — first AI-orchestrated cyber espionage campaign report also reinforces that automated phishing and social engineering are now scalable, so email security must account for both human error and machine-driven targeting. These controls tend to break down when legacy email protocols remain enabled across mixed student and staff environments because enforcement becomes inconsistent and exceptions multiply faster than governance can track them.

Common Variations and Edge Cases

Tighter email security often increases friction for users and administrators, requiring organisations to balance phishing resistance against access reliability and support burden. Best practice is evolving in environments where student self-service, third-party collaboration, and constrained budgets make uniform enforcement difficult. In those cases, accountability should still remain with the institution, but the control model may need phased deployment, compensating controls, and explicit exception handling.

There is no universal standard for this yet, but current guidance suggests that accountability becomes harder to dispute when governance documents map each risk to a named owner and a measurable control objective. That matters most where student populations are highly transient, staff turnover is frequent, or departments run their own email-related workflows outside central IT. Institutions also need to separate ownership of the platform from ownership of the risk. A mail system can be technically maintained by one team while the risk of phishing exposure is owned by another, especially when the threat affects finance, admissions, research collaboration, or safeguarding records. The important test is not who clicked, but who was accountable for reducing the likelihood and impact of that click.

Related resources from NHI Mgmt Group

• Who is accountable when phishing bypasses email security through a trusted app?
• How should security teams respond to voice phishing that targets Okta accounts?
• How should security teams handle AiTM phishing that targets business accounts?
• How should security teams defend against phishing when attacks move beyond email?