August 2026 Volume 8

OPERATIONS & MANAGEMENT

While Microsoft does provide some backup features, it does not offer traditional backup and recovery for all scenarios that may come up, like accidental deletion, malicious insider actions, or ransomware encryption. Use an additional, cloud-to-cloud backup and recovery solution to safeguard your email, calendar, contacts, OneDrive, and SharePoint. This helps ensure you can recover quickly and completely in case of a compromise. Building a Strong Microsoft 365 Security Strategy To truly secure your environment, you need a structured, proactive approach. Step 1: Conduct a Security Assessment Be honest about how your IT is functioning now, especially from a security standpoint. What’s working well? What’s causing frustration or slowing your team down? Work with your IT team to understand your current risks. Review key materials like your network diagram, asset inventory, past security assessments, and a list of the software you use. These will help identify gaps and areas of concern. As part of the assessment, ask your IT team to point out hidden vulnerabilities. There may be weaknesses you don’t recognize or even know how to ask about. This will help you address issues Think about the tools you’re using and where you could beef up your approach. Identify any gaps you find based on internal company goals, best practice IT standards, requirements from your customers, competitive advantage, cyber liability insurance providers, or regulators. Your IT team can help you identify gaps and choose the cybersecurity technology that’s most suitable for your needs. To start, focus on: • Enforcing MFA for all users • Conditional access to determine whether to allow, block or limit user access • Email security enhancements • Device management Step 3: Train Your Employees As we all know, no security tool is foolproof for stopping a cyberattack. Even with sophisticated technology in place, your team is your last line of defense. An old IT adage is that cybercriminals only need to get it right once – we need to get it right every time. Offer cybersecurity awareness training that is varied and interesting. This will help your team recognize threats and develop skills they can use both at work and on their personal devices. Cybersecurity fatigue is real. You can help by creating a positive cybersecurity culture that creates an environment for learning, not blaming. Encourage everyone to be comfortable reporting security concerns and asking questions. In the long run, staff training will help protect your organization. Step 4: Monitor and Respond Security in Microsoft 365 isn’t something you can set up once and then ignore. Cybercriminals are constantly adapting their before they become larger problems. Step 2: Implement Core Protections

2. Email Security The most common way cybercriminals infiltrate organizations is still through email. Today, we access business email on an average of 2.5 different devices, which means a successful email attack can have far-reaching implications. A strong email security strategy includes: • Advanced threat protection (Safe Links, Safe Attachments) • Anti-phishing policies and impersonation detection • Additional services to block known dangerous senders and warn users about potentially dangerous emails • Ongoing cybersecurity awareness training to keep users aware of current email phishing tactics A compromise of a single email account can wreak havoc on your business. Once the cybercriminal has access, not only can they see every email and contact in that mailbox, they can also send phishing emails that appear to be legitimate from that user’s account. Mailbox access also gives the bad guys access to the user’s OneDrive and SharePoint documents, further extending the risk that confidential company data will be exposed. Unfortunately, we’ve seen this happen too many times among our clients. It’s not only dangerous, and potentially costly financially, but also embarrassing to explain after the fact. 3. Endpoint & Device Security Remember that your Microsoft 365 environment extends beyond the cloud - it includes every laptop, desktop, and mobile device connected to it. Particularly in hybrid work environments, unmanaged or under secured devices can become entry points for cybercriminals. For example, we’ve seen too many cases of users copying or emailing files to an unsecured home computer, simply for convenience. Best practice endpoint and device security helps ensure that data stays secure and reduces this unnecessary risk to your business. Among other approaches, your IT team can help you: • Enforce device compliance policies • Require encryption and screen locks • Enable remote wipe for lost/stolen devices 4. Data Protection & Compliance Your business data is one of your most valuable assets, and one of the most targeted. Microsoft 365 offers tools to protect it, but many SMBs never fully implement them. Consider: • Data Loss Prevention (DLP) policies • Secure sharing settings in OneDrive and SharePoint • Retention policies for compliance and recovery Without these controls, it’s easy for sensitive data to be accidentally (or intentionally) exposed. 5. Backup & Recovery One of the biggest, and potentially most dangerous, misconceptions is that Microsoft fully backs up all your M365 data.

FIA MAGAZINE | AUGUST 2026 49