The Black Swimming Association is a community-focused organisation dedicated to promoting water safety, swimming participation and aquatic engagement among underrepresented communities. Through education, advocacy and programmes designed to reduce barriers to swimming, the organisation works to create greater inclusivity and confidence in aquatic activities while supporting the wellbeing of the communities it serves.
As the organisation’s digital footprint continued to grow, it recognised the need to strengthen the security of its Microsoft 365 environment and improve its overall cyber security posture.
The primary objective was to increase the organisation’s Microsoft Secure Score while implementing stronger controls to reduce the risk of unauthorised access, phishing attacks, malware infections and data exposure. The review identified opportunities to enhance identity protection, improve email security, implement stronger governance around user permissions and strengthen data protection measures.
The organisation also wanted to ensure that users could work securely across both company-managed and personal devices while maintaining a positive user experience. A comprehensive approach was required to provide layered security across identities, devices, data and communication platforms without disrupting day-to-day operations.
We conducted a detailed review of the Microsoft 365 security environment and developed a structured improvement programme focused on identity security, threat protection, data governance and user access controls.
The first priority was the implementation and enforcement of Conditional Access policies. These controls were configured to provide stronger protection against unauthorised access attempts while ensuring that legitimate users could continue working securely.
To enhance email security, Microsoft Defender Standard Policies were enabled and existing Anti-Phish, Anti-Malware and Anti-Spam policies were reviewed and updated. This created a more robust defence against increasingly sophisticated cyber threats and helped improve the detection and prevention of malicious content before it reached end users.
A dedicated Quarantine Policy was implemented, alongside updated global settings, to improve the management of suspicious messages and provide greater administrative oversight.
Additional governance improvements were introduced, including updates to user consent settings, reducing the risk associated with unauthorised application permissions. Controls were also put in place to prevent users from independently installing Outlook add-ins where unnecessary, helping to minimise potential security risks.
To strengthen data protection, sensitive information labels were implemented to support information classification and handling requirements. Company branding was deployed across the Microsoft environment to improve user trust and reinforce organisational identity.
Further security enhancements included disabling external calendar sharing where appropriate and implementing Bring Your Own Device (BYOD) app protection policies to safeguard organisational data accessed from personal devices.
Together, these measures created a more secure and well-governed Microsoft 365 environment aligned with modern cyber security best practices.
The Black Swimming Association now benefits from a significantly stronger Microsoft 365 security posture and an improved foundation for ongoing cyber resilience.
The enforcement of Conditional Access provides enhanced protection for user identities, reducing the likelihood of unauthorised access attempts succeeding. Strengthened Defender and email security policies have improved the organisation’s ability to identify and block phishing emails, malware and spam before they impact users.
The introduction of data sensitivity labels has provided greater control over organisational information, supporting improved data handling practices and helping users understand how information should be managed and protected.
Governance improvements around user permissions, application access and Outlook add-ins have reduced unnecessary risk while improving administrative control over the environment. Enhanced quarantine management has also streamlined the handling of suspicious messages, improving operational efficiency and visibility.
BYOD app protection policies now enable staff and volunteers to access organisational resources securely from personal devices while ensuring business data remains protected.
Overall, the organisation achieved meaningful improvements to its Microsoft Secure Score, strengthened cyber security controls across multiple layers and established a more secure platform to support its future growth and community initiatives.
- Improved Microsoft Secure Score
- Improved visibility and administrative control across the environment
- Enhanced cyber resilience and regulatory readiness
- Stronger governance around application permissions
