How to: Whitelist Management

Hey guys,

I look after Email Protection for our company. Just querying what is good practice.

Questions:
- How you guys handle password protected attachments?
- How do you manage exception lists i.e. how do you keep it maintained and relevant rather than letting it grow?
- What sort of checks you do to determine legitimacy of sender/email?

cybersecurity management whitelist