FAQs
Have Questions?
What does an email security audit actually check?
The audit reviews sender authentication records, mail flow routing, anti-phishing and anti-impersonation policies, attachment and link protection, external sender warnings, priority account protection, mailbox auditing, retention and legal hold posture, and the user training layer. The output is a list of gaps ranked by impact, with a remediation order the team can run in two-week sprints.
How long does the audit take?
A typical 50-seat SMB audit runs about six business days. The first two days are tenant access setup and configuration export. The middle two days are review against the CinchOps email controls checklist. The final two days are the fix list draft, the priority account list, and the remediation roadmap discussion with the leadership team.
Does CinchOps do the remediation too?
Yes. The audit and the fix work are the same engagement family. CinchOps closes the highest-impact gaps in the first two-week sprint, then moves to the second tier of work, then loops the changes into the ongoing managed IT runbook so they stay in place. The next audit becomes a checkpoint instead of a rebuild.
What if we use Google Workspace, not Microsoft 365?
The audit framework is the same. The control names change. CinchOps audits Google Workspace tenants for sender authentication, advanced phishing and malware protection, context-aware access, mailbox audit, and the policy and training layer. The fix list looks similar in shape to the Microsoft 365 version but uses the Google admin console.
Will the audit catch business email compromise risk?
Yes, specifically. The audit reviews the controls that block payment-change spoofing and CEO impersonation, the protection on the AP and executive accounts, the external sender warnings, and the firm's wire transfer verification process. The combination is what stops the calls that almost cost a Houston firm a wire last spring.