E-mail cannot be used securely without appropriately documented rules and a defined security process within the organisation in question. If procedural, organisational, and technical rules are neglected in the planning of e-mail systems, this could result in incorrect settings and both internal and external attacks.

For example, an insufficiently sized e-mail server can fail due to a large number of incoming e-mails. If sufficient security safeguards are not planned, e-mail clients will also be more susceptible to e-mails containing malware.