<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-email-compliance-auditing
description: >-
  Audit email systems for regulatory compliance including HIPAA, SOX, GDPR,
  and industry frameworks covering retention, encryption, access controls,
  audit logging, and eDiscovery readiness.
domain: cybersecurity
subdomain: email-security
tags:
  - compliance
  - hipaa
  - sox
  - gdpr
  - ediscovery
  - retention
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1114"]
  tools: [exchange-powershell, m365-compliance, google-vault]
---

# Performing Email Compliance Auditing

## Overview

Email compliance auditing verifies that email systems meet regulatory
requirements for data retention, encryption, access controls, audit
logging, and legal hold. Critical for HIPAA, SOX, GDPR compliance.

## Prerequisites

- Tools: Exchange PowerShell, M365 Compliance Center
- Regulatory requirements for the organization's industry
- Administrative access to email platform

## Key Concepts

- **Retention policies**: Rules governing how long email is kept
- **Litigation hold**: Preserving email for legal proceedings
- **eDiscovery**: Searching and exporting email for legal requests
- **Journal rules**: Copying all email to a compliance mailbox

## Workflow

### Step 1: Retention Policy Audit

```powershell
# List retention policies
Get-RetentionCompliancePolicy | Format-List Name, Enabled, ExchangeLocation

# List retention rules
Get-RetentionComplianceRule | Format-List Name, RetentionDuration

# Check litigation hold status
Get-Mailbox -ResultSize Unlimited | Where {$_.LitigationHoldEnabled} |
  Select DisplayName, LitigationHoldDate

# Check journal rules
Get-JournalRule | Format-List Name, JournalEmailAddress, Scope
```

### Step 2: Encryption and Transport Audit

```powershell
# Check TLS enforcement rules
Get-TransportRule | Where {$_.RouteMessageOutboundRequireTls} |
  Select Name, RecipientDomainIs

# Verify encryption configuration
Get-OMEConfiguration | Format-List

# Check connector TLS settings
Get-InboundConnector | Select Name, RequireTls
Get-OutboundConnector | Select Name, TlsSettings
```

### Step 3: Access Control and Audit Log Review

```powershell
# Check mailbox audit status
Get-Mailbox -ResultSize 100 | Select DisplayName, AuditEnabled, AuditLogAgeLimit

# Search audit log for mailbox access
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) \
  -Operations MailboxLogin, MailItemsAccessed -ResultSize 1000

# Check delegate access
Get-MailboxPermission -Identity "exec@example.com" |
  Where {$_.User -ne "NT AUTHORITY\SELF"}

# Check forwarding rules
Get-Mailbox -ResultSize Unlimited | Where {$_.ForwardingSmtpAddress} |
  Select DisplayName, ForwardingSmtpAddress
```

### Step 4: eDiscovery Readiness

```powershell
# List eDiscovery cases
Get-ComplianceCase | Format-List Name, Status

# Verify legal hold
Get-Mailbox -InPlaceHold | Select DisplayName, InPlaceHolds

# Test content search
New-ComplianceSearch -Name "Audit Test" -ExchangeLocation All \
  -ContentMatchQuery "subject:'confidential'"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Audit log gaps | Compliance | Missing audit log periods |
| Retention changes | Admin audit | Modifications to retention policies |
| Unauthorized forward | Transport logs | Auto-forwarding to external addresses |

```yaml
title: Email Retention Policy Modified
id: b8c9d0e1-f2a3-4567-b012-890123456789
status: experimental
description: Detects changes to retention policies impacting compliance
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation:
      - "Set-RetentionCompliancePolicy"
      - "Remove-RetentionCompliancePolicy"
  condition: selection
falsepositives:
  - Scheduled retention updates by compliance team
level: high
tags:
  - attack.t1485
  - attack.impact
```

## Verification

- [ ] Retention policies match regulatory requirements
- [ ] Encryption enforced for external communications
- [ ] Audit logging enabled on all mailboxes
- [ ] Delegate access and forwarding reviewed
- [ ] eDiscovery search and legal hold functional

## References

- [HIPAA Email Requirements](https://www.hhs.gov/hipaa/for-professionals/security/guidance/)
- [SOX Compliance](https://www.sec.gov/about/laws/soa2002.pdf)
- [GDPR Article 30](https://gdpr-info.eu/art-30-gdpr/)
