Secure the account people use
Multifactor authentication and sensible sign-in rules stop many stolen passwords from becoming a company incident.
Keep administration separate
Daily email accounts should not hold broad administrative rights. Record who has elevated access and why.
Review sharing and recovery
Check anonymous links, external guests, retention and backups against the value of the data, not a default setting.