We have had this question about our Data handling security guidance:

Your secure remote access guide states that schools should audit remote access to email by employees. Many schools will have to determine what level of auditing is required. Is it simply logging when an individual accesses the email system or logging the content of each email sent and received? The latter, although common in the corporate sector, results in a significant overhead for schools.