Notes · 2 of 8
A risk accepted without your signature
Somewhere in the offices you answer for, the email still runs on a machine nobody asks about.
This month we watched several offices running their own email — and the vendor behind that software shipped security fixes two months ago that none of them had applied.
Nobody chose this. A server was set up years ago because that's how everyone did it. The person who built it moved on. The email keeps arriving, so no one asks about the machine behind it. Running your own email was ordinary in 2010. Today it's rare — and the offices still doing it are usually the ones with the least staff to do it well.
Why this is yours
Here's why this belongs on your desk and not only your security team's. Email is how an office talks to the public, its vendors, and its own people. Every account on that server is a door. An email server two months behind on fixes is a door whose lock the vendor has already described to the world, fix by fix, with dates. And when email breaks this close to the dates on your calendar, it doesn't land as a maintenance problem. It lands inside whatever story is already being told about you.
What only you can do
Ask — with a date in it. You don't need to know the software. Three questions do the work: Who runs our email — us or a provider? If it's us, when was the last security fix applied? What date is the next one due? The answers are the finding. "We're not sure" is a finding too.
Require — in writing. If a unit you answer for runs its own email, a document somewhere should say who applies fixes and how fast, in days. If no document says it, the real answer is nobody.
Confirm — with evidence. "We're working on it" and "done" are different findings. Ask for the date the last fix was applied. Dates are easy to give when the work actually happened.
Decide — what changes this week. Maybe nothing changes: the office's email turns out to be run by a provider who patches on schedule, and now you know that. Maybe you schedule the move off the old server for after the dates you can't move. Running your own email isn't a scandal. Running it without anyone asking about it is a risk being accepted on your behalf, without your signature.
The offices in this position are not careless. They are small, they inherited a machine that works, and every day it works is a day the question seems unnecessary. That's exactly why the question has to come from you. It costs one email to ask — ideally not through the server in question.
Copy and send: Who runs our email — us or a provider? If us, what date was the last security fix applied? What date is the next one due?
If you want the short version to send to a colleague:
Ask (with a date) · Require (in the contract) · Confirm (with evidence) · Decide (what changes this week)
If you oversee units or vendors you don't operate, reply with what you're accountable for — a county, a campus, a system — and I'll tell you which of the four I'd start with. Message me instead if you'd rather not say it in public.