Review the everyday paths from untrusted content to sensitive work

Check every sharing path when access is revoked

Suppose a project owner removes an external participant from a shared folder. Membership access is revoked, but a separately created public link to one document still works. The removal succeeded on one path while another remains open. Neither action can recall a copy the participant already downloaded.

Use a synthetic document and a controlled external account to test the intended policy. Check the folder, direct document link and separately created sharing links before and after removal. Record inherited permissions and effective access for each path. The result should explain what removal actually closed and which limits remain.

Connect each communication path to observable evidence

Assign an owner to each communication path and retain its effective configuration or completed test. A policy records the intended behavior. The assessment also needs to establish what happens under the conditions being reviewed.

Compare the settings with the behavior users encounter

Inventory third-party email senders before changing authentication enforcement. Examine representative messages from each legitimate service, including relevant forwarding workflows. SPF, DKIM and DMARC provide evidence about domain authorization and authentication. They do not decide whether the request in the message is honest or appropriate. Keep that judgment separate.

For browsers, compare an extension's permissions with the work it needs to perform. Check installation and removal in the managed environment, then determine whether a separate profile or unmanaged browser can bypass the restriction. The administrator console cannot establish enforcement on a path it does not control.

For collaboration tools, test guest departure, link expiration and access to recordings. Make sure user instructions describe the outcomes those tests establish. The incident-reporting route must also remain usable when the primary mailbox or collaboration account is unavailable.

Keep the conclusion tied to the paths exercised

CIS Controls organize email, browser and malware defenses. NIST digital identity guidance informs authentication and recovery. Use them to select relevant questions, then test the tenant configuration needed to answer those questions. The guidance alone does not describe how this tenant behaves.

Record which identities and paths were exercised, and which mail services, browser profiles or sharing modes were excluded. Prioritize gaps that allow unintended access or obstruct recovery. Keep successful authentication distinct from a judgment about the received content; the two conclusions require different evidence.

Explain which identity each authentication result refers to

A pass result needs the identity it refers to. For each authorized sender, record the test time, receiving system, visible From domain, SPF MAIL FROM domain and result, and the checked DKIM signing domains, selectors and results. Also retain the DMARC result and alignment settings. This lets someone check whether the authenticated identities align with the sender visible in the message.

Obtain those observations from a receiving system you trust. An Authentication-Results field copied into message text is not sufficient by itself; its presence does not establish that the reported checks are trustworthy. Leave missing or untrusted observations unknown instead of completing the explanation by assumption.

The two fictional cases below assume a valid DMARC policy, strict SPF and DKIM alignment modes, one DKIM signature and completed receiver checks. The domains are illustrative. Either aligned SPF or aligned DKIM can produce a DMARC pass under these conditions. Passing both methods is not required.

A DMARC pass validates use of the From domain. It does not establish that the request is legitimate or that the message was delivered. A failure also does not, by itself, prove phishing. Keep the observations and investigate unexpected results before changing enforcement.

References: RFC 8601: Message Header Field for Indicating Message Authentication Status, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC), Google Workspace: Set up DMARC — alignment.