CIS Critical Security Controls v7.1 (SANS Top 20)

PR.IP-1: С учетом соответствующих принципов безопасности (например, концепция минимальной функциональности) создается и поддерживается базовая конфигурация информационных технологий / промышленных систем управления 

/STANDARD
Email is the main infection vector for a workstation, whether it is opening attachments containing malware or a misguided click on a link redirecting towards a site that is, itself, malicious. 

Users must be especially aware of this issue: is the sender known? Is information from him or her expected? Is the proposed link consistent with the subject mentioned? If any doubt, checking the message authenticity by another channel (telephone, SMS, etc.) is required. 

To protect against scams (e.g.: a fraudulent transfer request seeming to come from a manager), organisational measures must be strictly applied. 

Moreover, the redirection of professional messages to a personal email must be prohibited as it may constitute an irremediable information leak from the organization. If necessary, controlled and secure methods for remote access to professional email must be offered. 

Whether the organization hosts or has their email system hosted, it must ensure:

Configure Microsoft Office macro settings to block macros from the internet, and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.
Relative Security Effectiveness:  Essential | Potential User Resistance:  Medium | Upfront Cost:  Medium | Ongoing Maintenance Cost:  Medium