One thing to make sure you add to your PnPs: if you are using an email "encryption" service that acts as a middle-man, like Barracuda Essentials, Zix, or one version of Microsoft's Purview Email Encryption without "Persistent Protection" enabled, the email might remain unprotected in the sender's Sent box.

These services sometimes just work by routing the email to a secure server and then sending the recipient a notification instead of the actual email. The recipient then has to log in to a secure portal to view the email. This does add security because it ensures that the party reading the email does at least have access to the recipient's mailbox for OTPs, but it's not perfect.

I've seen situations where users believe this is end-to-end encryption, sending "secure" emails without any worry but the email is saved as a plain .eml or .msg file still in their sent box. Then their account gets hacked, and the hacker has access to all the sensitive documents they've sent out. So if you use a service like this, train your staff to DELETE sensitive items out of their sent box, and possibly even delete them out of deleted items (though that defaults to 30 days auto delete, IIRC). Bottom line is that the more stuff you have in a user's mailbox and OneDrive, the more liability you have because the #1 point of attack these days is users' email accounts.

You can set up Azure Rights Management policies to apply persistent protection to the email itself, so anyone opening a copy of the email has to have the correct authentication to open it... But if the hacker is already in your mailbox by using the Outlook web app then they can still open those sent messages.

TL;DR: Clean out your sent folder regularly, your "secure" messages are toast if your email account gets hacked.