Most firms with 5–150 people live in Microsoft 365 or Google Workspace. Attackers do too. This baseline is a control list to close before buying another “security pack”.
It is not full product documentation and not a conformity assessment. After each item: a fact (present / missing) and an owner.
Common to both platforms
- Named accounts. No shared “office@” password used by three people.
- MFA on every user account, stronger (passkey / FIDO2 key) on admins and on the company owner’s mailbox.
- A separate admin account from daily email — administrator account standard.
- No legacy auth (old protocols that bypass MFA) unless there is a written exception with an expiry date.
- Guest and partner accounts with a term and an owner; access ends after the project.
- Forwarding rules and filters — periodic review: who forwards mail outside.
- OAuth / connected apps — remove unknowns; limit who may grant mailbox access.
- Admin roles — as few Global Admin / Super Admin seats as possible; a change log.
- Devices — at least: which laptops can open company mail; a lost-phone procedure (runbook).
- Mail DNS — SPF, DKIM, DMARC in a mode that does not break legitimate mail but collects reports (staged rollout).
Microsoft 365 notes
- Disable or restrict Basic Authentication / legacy protocols in Entra ID.
- Check mailbox forwarding (Inbox rules + transport) for silent redirects.
- Global Administrator seats: phishing-resistant MFA; break-glass accounts in a safe, not in Slack.
- SharePoint / OneDrive: “anyone with the link” only on purpose; narrower defaults.
- If Intune or another MDM exists — even a simple profile: disk encryption, screen lock, remote wipe for work phones.
Google Workspace notes
- Enforce 2-Step Verification for the organisational unit; prefer security keys for admins.
- Review Gmail filters and forwarding addresses on critical accounts.
- Super Admin: minimum people; separate from daily work.
- OAuth: review apps with Gmail / Drive access.
- Drive: default sharing inside the organisation, not “public on the internet”.
What this baseline does not do
- It does not replace EDR, SIEM or a pentest.
- It does not say “you are ISO / NIS2 compliant”.
- It does not price implementation — use the form with tenants and user counts.
Next step
Put results in three columns: present, missing, consciously deferred. Then follow the small-business security order.