E-mail Policy

E-mail Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

Email is widely used across all industry sectors and serves as the primary method of communication within Safire. However, improper use of email can introduce significant legal, privacy, and security risks (e.g., Phishing, Malware, Data Exfiltration). This policy outlines the minimum security requirements and acceptable use standards for the Safire email system.

Scope

This policy applies to all employees, contractors, vendors, and agents acting on behalf of Safire and governs any email sent from a Safire email address or using Safire-managed email systems.

Policy

General Acceptable Use

• Business Use: Safire’s E-mail account should be used primarily for Safire business-related purposes.
• Incidental Personal Use: Personal communication is permitted on a limited, “incidental” basis, provided it does not interfere with productivity or consume excessive resources. NonSafire related commercial uses (e.g., running a side business) are prohibited.
• No Expectation of Privacy: Safire employees shall have no expectation of privacy in anything they store, send, or receive on the company’s E-mail system. Safire reserves the right to monitor, review, and disclose messages without prior notice for legal, security, or business reasons.

Security and Data Protection

• Transmission of CUI/Restricted Data:
• Controlled Unclassified Information (CUI) and “High-Restricted” data must NEVER be transmitted in the body of an email.
• CUI must be transmitted via encrypted attachment (FIPS-validated) or secure file transfer link.
• The subject line of emails containing sensitive attachments should not reveal sensitive information but should include a label (e.g., [SECURE]).
• Phishing and Suspicious Mail:
• Users must exercise caution when clicking links or opening attachments from unknown senders.
• Suspected phishing attempts, spam, or malicious emails must be reported immediately to the IT Security Team (e.g., via the “Report Phishing” button or helpdesk ticket).
• Users must never share their email password in response to an email request.

Prohibited Activities

• Auto-Forwarding: Users are strictly prohibited from automatically forwarding Safire email to a third-party email system (e.g., sending all work email to a personal Gmail account). This is a violation of CMMC Access Controls.

• Third-Party Services: Users are prohibited from using personal third-party email systems (Google, Yahoo, Hotmail, etc.) to conduct official Safire business.

• Offensive Content: The Safire E-mail system shall not be used for the creation or distribution of disruptive or offensive messages, including offensive comments about race, gender, disabilities, age, sexual orientation, pornography, religious beliefs, political beliefs, or national origin.

• Chain Letters/Spam: Sending chain letters, unauthorized mass mailings, or joke emails from a Safire account is prohibited.

Retention

• Business Records: E-mail is considered a business record if there exists a legitimate and ongoing business reason to preserve the information.
• Legal Hold: Users must not delete any emails subject to a notification of “Legal Hold” or active investigation.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as automated monitoring of autoforwarding rules , phishing simulation tests, and internal/external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Acceptable Use Policy
• Data Classification Policy
• Cryptographic Policy
• Data Protection Policy

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page