Email Security Compliance: What PCI DSS, ISO 27001, Cyber Essentials and GDPR Actually Require

If your organisation handles payments, personal data, or operates under any major compliance framework, you have probably been told that email security matters. But what exactly do these frameworks require — and how do you check if your domain meets the bar?

This guide covers the four frameworks most organisations in the UK and Ireland encounter: PCI DSS, ISO 27001, Cyber Essentials, and GDPR. For each one we explain what it requires, what the technical controls look like, and how to verify your domain is compliant.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) applies to any organisation that stores, processes, or transmits cardholder data. Version 4.0, released in 2022, significantly strengthened email security requirements.

What PCI DSS 4.0 requires for email:

• Requirement 5.4.1 mandates anti-phishing mechanisms — including DMARC, DKIM, and SPF — to protect against phishing emails targeting cardholders and staff
• Requirement 6.4 requires that all public-facing applications use TLS 1.2 or higher (TLS 1.3 preferred)
• Requirement 12.3.3 requires a review of all cryptographic cipher suites in use

In practice, PCI DSS 4.0 is the first version to explicitly name DMARC as a control. A DMARC policy of reject or quarantine is expected. A policy of none will likely be flagged by a QSA during assessment.

ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). The 2022 revision introduced Annex A controls that map directly to email security.

Relevant controls in ISO 27001:2022:

• A.8.23 — Web filtering: controls to protect against malicious web content, including phishing links delivered via email
• A.8.24 — Use of cryptography: requires that email in transit is encrypted — TLS 1.2 or higher is expected
• A.5.14 — Information transfer: requires policies and technical controls for secure information transfer, including email
• A.8.7 — Protection against malware: anti-phishing controls including DMARC are relevant evidence here

ISO 27001 does not mandate specific technologies — it requires you to identify risks and implement appropriate controls. In practice, auditors expect to see SPF, DKIM, and DMARC as evidence of email security controls. A missing or none DMARC policy is a common finding in ISO 27001 gap assessments.

Cyber Essentials

Cyber Essentials is a UK government-backed certification scheme. It is mandatory for suppliers bidding for certain UK government contracts and is increasingly required in the supply chain more broadly.

The Cyber Essentials technical controls focus on five areas: firewalls, secure configuration, user access control, malware protection, and patch management. Email authentication (DMARC, SPF, DKIM) is not explicitly listed as a Cyber Essentials requirement — however, the Cyber Essentials Plus assessment includes phishing resistance testing, and a well-configured email domain is expected evidence.

What to have in place for Cyber Essentials:

• SPF record with -all (hardfail)
• DKIM configured for your email provider
• DMARC policy of quarantine or reject
• TLS 1.2 or higher on all web-facing services
• Security headers (HSTS, X-Content-Type-Options) on your web properties

GDPR

The General Data Protection Regulation requires organisations to implement "appropriate technical and organisational measures" to protect personal data (Article 32). Email is a primary channel for personal data transmission, making email security directly relevant to GDPR compliance.

Where email security intersects with GDPR:

• Email spoofing can lead to personal data being sent to attackers — a reportable data breach under Article 33
• Phishing attacks targeting your staff or customers may involve personal data — DMARC reduces the attack surface
• Email in transit should be encrypted — MTA-STS enforces TLS for incoming mail delivery
• Data minimisation applies to what you collect via email forms — security headers (CSP) help prevent data exfiltration via injected scripts

The Irish Data Protection Commission (DPC) and the UK's ICO both treat inadequate technical security measures as a factor in assessing GDPR compliance after a breach. A domain with no DMARC or a none policy provides weak evidence of appropriate technical measures.

What Does a Compliant Domain Look Like?

Across all four frameworks, the baseline expected configuration is the same:

• SPF: valid record with -all, under 10 DNS lookups
• DKIM: configured for your email provider with a 2048-bit key (1024-bit keys are considered weak)
• DMARC: policy of quarantine or reject, with a reporting address (rua) configured
• SSL/TLS: valid certificate, TLS 1.2 minimum (TLS 1.3 preferred), not expiring within 30 days
• Security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy

You can check all of these for your domain in one scan — no sign-up required.

Check your domain for free

SPF · DKIM · DMARC · SSL · Security Headers