Agree ownership before access
We agree the email estate, business priorities and people authorised to make decisions. Your service owner retains authority over your environment. GURU Protect supplies a named lead who coordinates email incidents and changes across internal teams and suppliers.
| Decision | Agreed owner |
|---|---|
| Incident coordination and updates | Named GURU Protect lead, working with your incident manager |
| Business impact and priority | Your service owner, with our technical assessment |
| Production approval and risk acceptance | Your authorised change owner |
| Security containment and evidence handling | Your security lead and agreed incident responders |
| Acceptance and closure | The named customer owner, against recorded criteria |
This is our proposed delivery framework. We record your arrangements in the order and service schedule.
One incident record everyone can follow
We work in your existing incident system where access and licensing permit. Where separate queues are necessary, we link the reference numbers, agree the system of record and record material decisions there. We agree severity definitions, escalation routes and update intervals during onboarding.
ServiceNow, Jira Service Management and other service desks can be considered. Ticket creation, email ingestion, API synchronisation and automated updates are scoped against your platform, permissions and data policies. This website does not claim that a connector is already deployed.
- Record impact, affected routes, first occurrence and an accountable owner.
- Keep a timeline of evidence, actions, supplier references and next decisions.
- Agree update frequency by impact; provide updates even when a supplier is still investigating.
- Separate incident recovery from a longer-term problem record when appropriate.
A change you can approve
Every production change has an agreed route through your change policy, including your change advisory board where required. We provide the technical detail needed to make the decision.
- Purpose, scope, affected services and dependencies.
- Risk, expected user impact, validation evidence and acceptance criteria.
- Implementation steps, named implementer, maintenance window and any freeze restrictions.
- Backup or configuration export where applicable; rollback steps, decision point and limitations.
- Recorded approval before implementation, followed by verification and updated documentation.
Emergency changes use explicitly delegated authority and your emergency procedure. We record the reason, approver and actions, then support the retrospective review. Urgency is not permission to bypass your controls. NCSC’s operational-security guidance also emphasises controlled changes and prepared incident handling. [NCSC: operational security]
Access and permissions
We agree named accounts, least-privilege roles, MFA and the duration of access. Elevated access is approved for the task and removed when no longer needed. We agree secure evidence transfer and retention before collecting mailbox content or logs. Secrets do not belong in ordinary ticket comments.
Your security team remains involved where identity compromise, legal preservation or sensitive data is at issue. Our draft data-processing terms set out the arrangements that must be completed before we process personal data on your behalf.
Own the case across suppliers
We gather the available evidence, raise or coordinate supplier cases, challenge unclear answers and keep the business informed. We identify where recipient-side evidence is needed rather than presenting a local trace as a complete end-to-end view.
We cannot compel a recipient or vendor to supply records or guarantee their restoration time. We can keep ownership of the agreed case, make the dependency visible and present the next practical action. See what message tracing can prove.
A response commitment you can use
Managed Email includes an engineer response within four coverage hours, 08:00–20:00 UK time every day. Cover begins after terms are agreed and the deposit is received, or on the later start date in your order. Incident clocks pause outside coverage. Named ownership and supplier coordination are included; the hands-on engineering allowance is separate. Read the complete response terms.
A one-off urgent Email Resolution engagement has different windows and a 50% premium. It is not required to obtain the included response for a covered Managed Email incident. The relevant service agreement records which service applies.
Leave your team stronger
We hand over the agreed configuration records, operating instructions, known dependencies and outstanding actions. We update your agreed knowledge base or configuration records, demonstrate the relevant runbooks and remove temporary access.
For significant incidents or changes we agree a review: what happened, which evidence supports the conclusion, what remains uncertain and who will address the causes.
Primary sources
Provider requirements and product capabilities can change. Check the linked source before a production change.