Checklists fail when they are alphabetical. This one is ordered by how often each item appears in real incident write-ups: identity first, external boundaries second, application paths third, and visibility last. Work it top to bottom before wide rollout, and re-run it annually.
1. Identity and Sign-In
- Multi-factor authentication enforced for every human account, with no standing exceptions; break-glass accounts exist, are monitored, and are named in the incident runbook.
- Conditional sign-in rules require compliant devices or managed browsers for sensitive workloads.
- Legacy authentication protocols disabled — they bypass modern sign-in controls entirely.
- Session lifetimes sensible for shared-device environments: shorter where hot-desking is normal.
2. External Boundaries
- External access (federation) limited to the domains your business actually works with, or disabled where regulation demands.
- Guest access enabled only for populations with a named business owner; anonymous meeting join disabled organisation-wide.
- External sharing links default to specific people; anonymous link types blocked unless a documented process requires them.
- Guest expiry policies set so forgotten guests do not accumulate for years.
3. Applications and Data Paths
- App permission policy reviewed: third-party apps allowed by exception, not by default.
- Custom and line-of-business apps inventoried with an owner each.
- Personal cloud storage connectors blocked inside the collaboration client, closing the classic exfiltration side door.
- Clipboard and file-transfer restrictions considered for regulated populations, balanced against usability complaints you are prepared to answer.
The classification prerequisite
Every technical control above protects data whose sensitivity someone has decided. Without labels — visible markings that travel with documents and messages — protection rules have nothing to match on. Stand up a simple three-level scheme (public, internal, confidential) before configuring automated protection; two levels is honestly better than none.
4. Content Protection
- Labels published to the client with sensible defaults; mandatory labelling only for the confidential tier, to avoid alert fatigue.
- Loss-prevention rules warn before blocking: a warning teaches users, a block teaches them to work around you.
- Retention defaults aligned with legal requirements — over-retention is a liability, under-retention is a violation.
5. Visibility and Response
- Audit logging enabled and flowing to your monitoring stack, with alerts on the actions that matter: permission grants, external shares, policy changes.
- Administrative role membership reviewed quarterly; every standing global admin is a headline waiting to happen.
- eDiscovery roles assigned to legal, not to IT — separation of duties is the point.
- An incident runbook section specific to collaboration data: who can place a hold, who can export, who notifies.
Using the Checklist
Assign each item an owner and a date; unowned checklist lines are fiction. Record exceptions explicitly with expiry dates — an exception with a sunset clause is a decision, an exception without one is a hole. Re-run the list after any major platform update, because vendors ship new defaults as eagerly as they ship new features.
Identity and boundaries keep strangers out. The next chapter deals with the people you deliberately let in: guests and external collaborators, and the controls that keep them inside the lines.
