For a contractor office that pays suppliers out of a company inbox, email security comes down to stopping two things: a payment going to the wrong bank account, and a mailbox ending up with the wrong person. Most of that isn’t a product you buy. It’s a handful of jobs, each owned by someone specific.
These email security best practices split the work between three roles: employees, the office manager and the administrator.
Email security best practices by who does the work
CISA’s cyber guidance for small businesses splits security work between the CEO, a security program manager and an IT lead. Those titles don’t fit most contractor offices, so we’ve adapted the idea into three roles: employee, office manager and administrator. The owner’s job is to back the office manager and the administrator, not to take on a technical task of their own.
Picture a five-person office: the owner, an office manager, a couple of field employees who see invoices, and one administrator (whoever holds the admin account for your company email). Here’s how the jobs split:
Who does what
Employee
- Everyday jobs
- Never pays or changes bank details because of an email alone. Uses their own login and never shares a mailbox password.
- When something looks off
- Reports a suspicious message, or a sign-in approval request they didn’t start, instead of acting on it. Passes payment-change requests to the office manager.
Office manager
- Everyday jobs
- Keeps the list of email accounts and decides who can open the shared inbox.
- When something looks off
- Checks a payment change by calling the supplier on a number already on file. Stops the payment and tells the administrator if the supplier didn’t ask for it.
Administrator
- Everyday jobs
- Turns on multi-factor sign-in and account recovery, confirms SPF, DKIM and DMARC are in place, and removes access when someone leaves.
- When something looks off
- Takes the first step when an account may be compromised: treats the mailbox as suspect for payments and works from the incident plan.
| Role | Everyday jobs | When something looks off |
|---|---|---|
| Employee | Never pays or changes bank details because of an email alone. Uses their own login and never shares a mailbox password. | Reports a suspicious message, or a sign-in approval request they didn’t start, instead of acting on it. Passes payment-change requests to the office manager. |
| Office manager | Keeps the list of email accounts and decides who can open the shared inbox. | Checks a payment change by calling the supplier on a number already on file. Stops the payment and tells the administrator if the supplier didn’t ask for it. |
| Administrator | Turns on multi-factor sign-in and account recovery, confirms SPF, DKIM and DMARC are in place, and removes access when someone leaves. | Takes the first step when an account may be compromised: treats the mailbox as suspect for payments and works from the incident plan. |
For employees, reporting is the expected move. CISA says staff should know how to escalate suspicious activity, so never scold the person who reports a message.
The office manager’s most important job is the payment-change check, laid out step by step below. The administrator’s jobs show up in this post as things to check, not settings or DNS records to copy.
Account access, multi-factor sign-in and the shared inbox
The office manager keeps the list of company email accounts and who can open the shared inbox. For a made-up company at example.com, that list would name who may open bids@example.com. The administrator owns the rest: chasing anyone who hasn’t set up multi-factor sign-in, keeping recovery methods current, and removing access when someone leaves.
Multi-factor sign-in (also called multi-factor authentication, or MFA) adds a second step after the password, like a code or a prompt on your phone. CISA’s guidance says to turn it on for every administrator account and to keep checking that it’s actually in use.
Don’t make people change passwords on a schedule. NIST’s digital identity guidelines (SP 800-63B) say systems must not require periodic password changes, and must force a change when there’s evidence a password has been compromised.
Multi-factor sign-in helps, but it doesn’t stop everything
CISA says any form of multi-factor sign-in is better than none, and that phishing is consistently the most cost-effective way for attackers to get in. It names FIDO authentication (signing in with a physical security key or a passkey instead of typing a code) as the only widely available phishing-resistant option.
NIST adds that passwords and one-time codes a person types in aren’t phishing-resistant, because a fake sign-in page can pass them along to the real one. And CISA is clear that following its advice isn’t a guarantee you’ll never have an incident.
So multi-factor sign-in lowers the risk, but it doesn’t prevent every compromise. If an employee gets a sign-in approval request they didn’t start, they report it instead of approving it.
A shared inbox still needs named logins
Shared access means named people, each with their own login, and no shared password. Two office staff might both open bids@example.com, each signed in as themselves. The office manager decides who can read the shared inbox, and the administrator removes anyone who leaves.
Whether bids@ should be a shared mailbox or a distribution list, and how to add a shared mailbox in Outlook, are covered in their own guides.
Checks that stop with the administrator
Employees don’t edit DNS records or set up email filtering. If the company uses a filtering service (sometimes called an email gateway), its settings belong to the administrator.
How long email is kept, whether it’s backed up and whether it can be restored are three separate questions. CISA says scheduling backups isn’t enough, and to regularly test that you can actually restore from them. And if a mailbox ever needs to be locked, the administrator, not a field lead, is the one who calls the email host.
Sender authentication, without the DNS text
SPF, DKIM and DMARC are three checks that help other mail systems tell real email from your domain apart from forgeries. Microsoft’s explanation of email authentication describes them like this:
- SPF (Sender Policy Framework) names the mail servers allowed to send email for your domain.
- DKIM (DomainKeys Identified Mail) digitally signs parts of each message, so a change in transit can be detected.
- DMARC checks that those results line up with the From address people actually see, tells receiving systems what to do when a message fails SPF or DKIM, and says where to send reports.
Microsoft says anything less than all three gives weaker protection. Even with all three in place, they don’t stop every phishing email. The records themselves go in when the mailbox is set up, which our guide on how to create a business email walks through. For this checklist, the office manager’s part is simple: ask the administrator whether all three are on.
If the account may be compromised, stop payments
If anyone suspects an account has been taken over, stop using it for payments and tell the administrator. The administrator treats that mailbox as suspect for anything payment-related until they know whether it was misused, and works from the company’s incident plan.
Pausing payments is our advice rather than CISA’s, but CISA does say to use your incident plan early, even when you suspect a false alarm. This is also the one time a forced password change makes sense: when there’s evidence of compromise, as NIST describes above, not because the calendar says so.
Verify a payment-change email before anyone pays
Here’s how the three roles work together when a payment change arrives by email. A message that looks like it’s from one of your suppliers says the bank account for a materials invoice has changed, and asks for the next payment to go to the new account. It even includes a phone number.
Four steps before anyone pays
- 1
The employee doesn’t pay
Whoever sees the message doesn’t pay and doesn’t reply with bank details. They tell the office manager. - 2
The office manager calls the supplier
On the number already on file, or another route the company already uses for that supplier. Never the number in the email. - 3
No request from the supplier, no payment
If the supplier didn’t ask for the change, the office manager stops the payment and tells the administrator. - 4
The administrator treats the mailbox as suspect
For payments, until they know whether the account was misused.
That callback on a number you already have is our own recommendation, not a quote from CISA or NIST.
Safer sharing isn’t the whole defense
No business email is perfectly safe. Multi-factor sign-in, the three authentication checks and encryption each leave a gap. Encryption doesn’t stop phishing, because the trick happens before any message gets encrypted. Encrypted email and Gmail’s confidential mode aren’t a complete defense, and they don’t stop every theft.
When you do need to send something sensitive, we cover sending a secure email in Outlook and in Gmail separately.
Last, have the office manager and the administrator review this list of jobs regularly. CISA recommends reviewing your incident plan quarterly, so an easy habit is to go over the one-page role list at the same time.
If you’d like help with the administrator side, see our security and backup support for contractors.