# Email security policy template (with sample wording)

URL: https://iblockspam.com/blog/email-security-policy-template
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Running email day to day
Author: iBlockSpam Team

> A free email security policy template with sample wording: accounts and MFA, forwarding, payment checks, attachments, reporting, admin rules and annual review.

## Short answer

An email security policy is a short written document that sets the rules for using company email safely. It should cover scope, account and MFA rules, forwarding and personal accounts, how to verify payment or bank-detail changes, attachments and links, reporting, admin duties and a yearly review date. Back each rule with a technical setting.

An email security policy is the short set of rules that tells everyone how to use company email without exposing the business to fraud, account takeover or data loss. This guide explains what a policy should cover, gives you a template with sample wording you can copy, and maps each rule to the setting in Microsoft 365 or Google Workspace that enforces it.

## What is an email security policy?

An email security policy is a written document, approved by management, that sets the rules for using company email safely and names who is responsible for them. It covers people (what staff must and must not do), process (how money and data requests are verified) and technology (which settings the administrator keeps in place).

A policy isn't paperwork for its own sake. The [NIST Cybersecurity Framework 2.0](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf) lists "Organizational cybersecurity policy is established, communicated, and enforced" as a governance outcome (category GV.PO). Each of those three verbs matters. A policy nobody has read, or one the mail system doesn't enforce, protects nothing.

For a small business, the email policy is usually one to three pages. It works alongside your [email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business), which covers the technical setup, and your [incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan), which covers what happens when something goes wrong.

## What should an email security policy include?

An email security policy should include scope, account rules, acceptable use, forwarding, payment verification, attachments and links, reporting, admin duties, exceptions and a review date. The table shows each section, why it's there, and the control that backs it up.

| Section | What it says | Why it matters | Technical backup |
|---|---|---|---|
| Purpose and scope | Who and what the policy covers | Contractors and shared mailboxes are often forgotten | Account inventory |
| Accounts and sign-in | MFA, no shared passwords, no password reuse | Stolen passwords lead to mailbox takeover | MFA enforcement |
| Acceptable use | Company business only from company accounts | Personal accounts sit outside backups and offboarding | Licensing, retention |
| Forwarding | No auto-forwarding outside the company | Attackers set forwarding rules to read mail quietly | External forwarding off |
| Payment and data requests | Verify by phone on a known number | Business email compromise relies on unverified requests | External sender tags |
| Attachments and links | What's allowed, what to do if unsure | Malware and credential phishing arrive this way | Filtering, macro blocking |
| Reporting | One way to report, no blame | Fast reports limit damage | Report button, shared quarantine |
| Administration | Admin accounts, DNS, logs | Admin accounts are high-value targets | Separate admin accounts, DMARC |
| Exceptions and review | How to ask for an exception, review date | Rules must change with the business | Change log |

## Email security policy template

Copy the sample wording below, replace the bracketed parts, and delete anything that doesn't apply. Every block marked "Example wording" is a starting point, not legal text. If you're in a regulated industry, have your adviser check it against your obligations.

### 1. Purpose and scope

> **Example wording:** This policy sets the rules for using [Company] email safely. It applies to all employees, contractors and anyone else with a [Company] email account, including shared and role mailboxes such as info@ and accounts@. It covers email on any device, including personal phones.

### 2. Accounts and sign-in

> **Example wording:** Every user has their own account. Passwords are never shared, reused from another service, or sent by email or text. Multi-factor authentication (MFA) is required on every account. Admin accounts use phishing-resistant MFA, such as a security key or passkey, where our platform supports it. If you get an MFA prompt you didn't start, deny it and report it.

Multi-factor authentication (MFA) means signing in with something beyond a password, such as an app prompt or a security key. The CISA, NSA, FBI and MS-ISAC [phishing guidance](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf) recommends "prioritizing phishing-resistant MFA for administrator and privileged user accounts".

### 3. Acceptable use

> **Example wording:** Use [Company] email for [Company] business. Don't use personal email accounts for company business, and don't sign up for personal services with your work address. Don't send customer or employee personal data outside the company unless your manager has approved it and it is sent by [approved method].

### 4. Forwarding and auto-replies

> **Example wording:** Don't forward or auto-forward company email to personal or outside accounts. If you need someone to cover your mail while you're away, ask [IT contact] to give a colleague access instead. Out-of-office replies to outside senders should give your return date and a general contact address, not travel details or personal phone numbers.

Attackers who take over a mailbox often add a forwarding rule so they can keep reading mail after the password is reset. See [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) for how to find them, and [out-of-office security risks](https://iblockspam.com/blog/out-of-office-auto-reply-security-risks) for safer auto-reply wording.

### 5. Payment, bank detail and sensitive data requests

> **Example wording:** Before paying a new invoice, changing a supplier's or employee's bank details, buying gift cards, or sending tax or payroll data, verify the request by phone using a number from our records, never a number in the email. Payments over [amount] need a second approver. This applies to requests that appear to come from [owner/executives]. No one at [Company] will ever be criticized for taking time to verify.

This is the most valuable section in the policy. The FBI's Internet Crime Complaint Center counted $55,499,915,582 in exposed losses from business email compromise between October 2013 and December 2023, and its first recommendation is to verify account-change requests through a separate channel ([IC3 PSA, 2024](https://www.ic3.gov/PSA/2024/PSA240911)). Our [business email compromise guide](https://iblockspam.com/blog/business-email-compromise-prevention) has a full payment-change procedure you can attach to the policy.

### 6. Attachments and links

> **Example wording:** Don't open unexpected attachments or click links in unexpected messages, even from people you know. Never enter your password on a page you reached from an email link; go to the site directly instead. Don't enable macros in documents from email. If you're unsure, ask [IT contact] before you click.

### 7. Reporting

> **Example wording:** Report anything suspicious with the [Report button / forward to report@company] as soon as you notice it, including messages you already clicked. Reporting quickly is what matters; you won't be disciplined for an honest mistake that you report. If you think you entered your password on a fake page, also call [IT contact] immediately.

### 8. Administration

> **Example wording:** Admins use a separate admin account that has no mailbox and is not used for daily email. [IT contact] keeps SPF, DKIM and DMARC records current, reviews DMARC reports monthly, keeps external auto-forwarding disabled, and reviews admin accounts and mailbox access every quarter. Changes to MX, SPF and DMARC records are logged.

### 9. Exceptions, enforcement and review

> **Example wording:** Ask [policy owner] in writing for any exception. Approved exceptions are recorded with a reason and an end date. Breaking this policy on purpose may lead to disciplinary action. This policy is owned by [name], approved by [owner/director] on [date], and reviewed every [12] months or after any email security incident.

## How do you enforce each rule in Microsoft 365 and Google Workspace?

You enforce an email policy by pairing each written rule with a setting that makes the safe behavior the default. Rules that rely on memory alone fail under pressure. The table maps the main rules to their controls.

| Policy rule | Microsoft 365 | Google Workspace |
|---|---|---|
| MFA on every account | Security defaults or Conditional Access | 2-Step Verification enforcement |
| No external auto-forwarding | Outbound spam policy: **Off - Forwarding is disabled** | Gmail **End User Access** > **Automatic forwarding** turned off |
| Flag outside senders | [External sender tag](https://iblockspam.com/blog/outlook-external-email-warning-tag) | **Warn for external recipients**, plus employee name spoofing warnings |
| No macros from email | [Block macros from the internet](https://iblockspam.com/blog/office-macros-blocked-from-internet) | Gmail **Safety** > **Attachments**: protect against attachments with scripts from untrusted senders |
| One way to report | [Report button and user-reported settings](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings) | **Report phishing** in Gmail |
| Domain can't be spoofed | DMARC at `p=reject` | DMARC at `p=reject` |

Two details are easy to miss:

- **Microsoft 365 forwarding default.** Microsoft's outbound spam policy has three choices. The default, **Automatic - System-controlled**, behaves differently between tenants, so [Microsoft](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) advises choosing **On** or **Off** explicitly. When it's off, forwarded mail bounces with `5.7.520 Access denied, Your organization does not allow external forwarding`.
- **Google Workspace new-user window.** When you enforce 2-Step Verification, you can give new users an enrollment period of 1 day to 6 months, and "during this period, users can sign in with just their passwords" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)). Keep it short.

For the domain rule, the federal phishing guidance says to "ensure DMARC is set to 'reject' for sent emails". Check where you stand with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and use our guide to [moving DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) to get there safely.

## How do you roll out an email security policy?

Roll it out in a few small steps so people know it exists and the settings match what it says.

1. **Fill in the template.** Replace every bracket, delete what doesn't apply, and keep it under three pages.
2. **Check the settings first.** Confirm each technical backup in the table above is actually in place. A policy that says "auto-forwarding is disabled" when it isn't is worse than no policy.
3. **Get it approved.** The owner or a director signs it, which matters because the payment rules apply to them too.
4. **Walk staff through it.** Spend 15 minutes on sections 5 and 7: verify payments by phone, and report fast. Our [security awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business) has a simple plan.
5. **Collect acknowledgments.** Have each person confirm they've read it. Add it to [new-employee onboarding](https://iblockspam.com/blog/new-employee-onboarding-email-security) so every new starter gets it in their first week.
6. **Store it where people can find it.** Keep a copy outside email, too, so it's available if a mailbox is compromised.
7. **Set the review date.** Put the yearly review in a calendar now.

## How often should you review the policy?

Review the email security policy at least once a year, and again after any incident, a platform change or a new kind of scam that reaches your staff. NIST's CSF 2.0 describes the same idea (GV.PO-02): policy "is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission."

At each review, ask three questions:

- **Does it still match reality?** New suppliers, new payment tools, a move to a different email platform, or new staff roles.
- **Do the settings still enforce it?** Settings drift. Check forwarding, MFA coverage, admin accounts and your SPF, DKIM and DMARC records.
- **What did incidents and reports teach us?** If staff reported a new type of lure, such as a fake gift card request from the owner, add an example. The [FTC](https://www.ftc.gov/business-guidance/blog/2025/07/bringing-new-employees-onboard-help-them-avoid-impersonator-scams) suggests telling employees directly if you'd never ask them to buy gift cards.

## Next steps

- Copy the template above, fill in the brackets, and get it signed this month.
- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) so the admin section starts from accurate SPF, DKIM and DMARC records.
- Attach a payment-change procedure from the [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention).
- Add the policy to onboarding and pair it with an [offboarding checklist](https://iblockspam.com/blog/employee-offboarding-email-security) so access is removed when people leave.
- If you want filtering, quarantine and DNS change alerts handled for the whole domain, see how [iBlockSpam works](https://iblockspam.com/how-it-works).

## Frequently asked questions

### Does a small business need a written email security policy?

Yes, even a one-page version helps. A written policy turns habits into rules people can follow under pressure, such as calling back on a known number before changing bank details. It also gives new staff one place to learn the rules, and NIST's Cybersecurity Framework 2.0 lists an established, communicated and enforced policy as a core governance outcome.

### How long should an email security policy be?

Short enough that people read it: one to three pages for most small businesses. Put the rules staff must follow in plain sentences, and keep technical settings in a separate admin checklist. If a rule needs a paragraph of explanation, it probably belongs in training material rather than in the policy itself.

### Should the policy ban personal email for work?

Most small businesses should. Company data sent to personal accounts falls outside your backups, retention, filtering and offboarding. A simple rule works: do company business only from company accounts, and don't forward or auto-forward work mail to personal addresses. Back it up by turning off automatic external forwarding in Microsoft 365 or Google Workspace.

### Who should approve and own the email security policy?

The owner or a senior manager should approve it, and one named person should own it: usually whoever runs IT, or your MSP contact on your behalf. The owner keeps it current, checks the technical settings match, and runs the yearly review. Senior approval matters because the payment rules apply to executives too.

### How is an email security policy different from an acceptable use policy?

An acceptable use policy covers all company technology: devices, internet, software and data. An email security policy goes deeper on one channel: sign-in rules, forwarding, payment verification, attachments, reporting and admin duties. Many small businesses keep email rules as a section of the acceptable use policy, which works as long as the email rules stay specific.

## Sources

- [NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 (February 2024), Govern: Policy (GV.PO)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
- [CISA, NSA, FBI and MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)
- [FBI IC3 PSA: Business Email Compromise: The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [Microsoft Learn: Control external email forwarding and fix 5.7.520 errors](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- [Google Workspace Admin Help: Deploy 2-Step Verification](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)
- [FTC Business Blog: Bringing new employees onboard? Help them avoid impersonator scams (July 2025)](https://www.ftc.gov/business-guidance/blog/2025/07/bringing-new-employees-onboard-help-them-avoid-impersonator-scams)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-policy-template (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt