> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/communication-templates/staggered-rollout-essentials-or-advanced-+-ato-resilience.md).

# Staggered Rollout: Essentials or Advanced + ATO Resilience

{% hint style="info" %}
If you only purchased Account Takeover (ATO) Resilience as a stand-alone, use the [ATO Resilience Templates](/getting-started/deployment-guides/communication-templates/staggered-rollout-ato-resilience.md) instead.
{% endhint %}

In this scenario, you'll deploy Material in stages and communicate with your users along the way.

> **Pros**: Smaller changes to digest, time to identify any end user feedback or problems with overall deployment and improve
>
> **Cons**: Your end users could feel like there are never-ending changes

| Timing                         | Template Name                                                                                             |
| ------------------------------ | --------------------------------------------------------------------------------------------------------- |
| 14-30 days prior to deployment | 1. [Introducing Material Security + ATO Resilience](#id-1.-introducing-material-security--ato-resilience) |
| At email threat deployment     | 2. [Email Threat Protection is Deployed](#id-2.-email-threat-protection-is-deployed)                      |
| At File Security Deployment    | 3. [File Security is Deployed](#id-3.-file-security-is-deployed)                                          |
| At Email Redaction Deployment  | 4. [ATO Resilience is Deployed](#id-4.-ato-resilience-is-deployed)                                        |

{% hint style="success" %}
All templates include customizable content including your organization's name. Be sure to update (or sometimes remove) any inline directions. They're included in brackets and highlighted <mark style="background-color:yellow;">\<like this></mark>.
{% endhint %}

***

## 1. Introducing Material Security + ATO Resilience

> **Message Purpose:** To inform your users that changes will be coming soon and why
>
> **Delivery Timing:** We recommends at least 14 days but no more than 30 days in advance of go-live so users have not forgotten about it.

<details>

<summary>Introducing Material Security + ATO Resilience template</summary>

**Message Subject:**

Introducing <mark style="background-color:yellow;">**\<your company name>**</mark>’s new information security provider, Material Security—and what it means for you

**Message Body:**

We’re pleased to announce, we’ve partnered with Material Security – an information security company – to protect <mark style="background-color:yellow;">**\<your company name>**</mark> from key security risks. Material keeps connected accounts safe by protecting our company’s fundamental material—our emails, documents, and accounts —before, during, and after a breach.

With Material Security we can:

* Detect sophisticated email based attacks and take action fast through a variety of responses
* Detect potential risks related to files and attachments, including sharing of sensitive data
* Investigate issues quickly and improve our defenses to keep us safe even as attack methods change every day
* Protect sensitive information and related accounts in the event of a breach

Please be on the lookout for additional messages as we get closer to deploying Material Security. We’ll send a few emails over the next few weeks as we roll out different features over time. The entire process should take about 1-2 months to complete.

We’re carefully working with Material Security and our internal IT and Security teams to ensure a smooth rollout, and we’ll be alerting you to upcoming milestones and additional information as we get closer to our Go-Live date including what you can expect to see.

In the meantime, if you want to do a little more research on Material, feel free to take a look at their website here: <https://material.security/>

</details>

***

## 2. Email Threat Protection is Deployed

**First, gather screenshots for your Email Threat Protection is Deployed message:**

> You need four screenshots for this template:
>
> * **Screenshot A (User Report Response)**
> * **Screenshot B (Banner)**
> * **Screenshot C (Block)**
> * **Screenshot D (Speedbump)**

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4f8">📸</span> How to Get Screenshots A-D (User Report Response, Banner, Block, and Speedbump)</summary>

1. Enable Email Threat remediation just for yourself (see [Step Four in Enable Email Threat Protection](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/configure-user-reporting.md#step-four-enable-remediation)).
2. Find **an email in your inbox** that includes embedded links; **mark it as suspicious** using the built in labels.
3. A User Report Response email should appear in your inbox momentarily **(Screenshot A)**
4. Return to **Material**.
5. Expand **Issues**, then click **Email Threats**.
6. Find the case for the email you marked suspicious, then **open it**.
7. Under Remediation, **add a Block and a Banner** (if not already there).
8. Click **Save**, but leave the case details open for a moment.
9. Return to your inbox and **open the email you marked**.
10. Take a screenshot of the banner on the email **(screenshot B)**.
11. Click a **link** in the email.
12. Take a screenshot of the Block **(Screenshot C)**
13. Return to **Material**.
14. In the case details, change the **Block to a Speedbump**, then click **Save**.
15. Return to your inbox and **open the email** you marked.
16. Click a **link** in the email.
17. Take a screenshot of the Speedbump **(Screenshot D)**.

</details>

**Second, fill out the Email Threat Protection is Deployed template utilizing the screenshots you gathered:**

> **Message Purpose:** To inform your users about what to expect from email threat protection and how to make their own reports
>
> **Delivery Timing:** When you [enable Email Threat responses](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/configure-user-reporting.md)

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4e9">📩</span> Email Threat Protection is Deployed template</summary>

**Message Subject:**

Material Security Email Threat Detection will be on in 7 days – what to expect

**Body of Message:**

We recently sent you an email introducing Material Security, our new tool to protect <mark style="background-color:yellow;">**\<Your organization name>**</mark> from email-based attacks. This email includes key information about changes you'll see in one week, and what to do if you have questions.

While many malicious messages will be deleted or moved out of your inbox automatically, others might remain accessible to you, but will look a little different:

* Links and attachments might first open a page asking you to verify you know the sender or simply block access to those links and attachments
* The message might include a banner to draw your attention to something suspicious about the message that you should notice before proceeding.

Examples of these situations are shown below. When you see these, please read them and follow the guidance. If you have questions, you can always reach us at <mark style="background-color:yellow;">**\<contact for the responsible team>**</mark>.

* <mark style="background-color:yellow;">**Screenshot B (Banner)**</mark>
* <mark style="background-color:yellow;">**Screenshot C (Block)**</mark>
* <mark style="background-color:yellow;">**Screenshot D (Speedbump**</mark>)

You also have the power to report suspicious emails that have not been modified as described above or moved to Spam. To do this,

<mark style="background-color:yellow;">**\<alter these options to fit your needs>**</mark>

* Label the email as Suspicious, or
* Forward the email to <mark style="background-color:yellow;">**\<the reporting address you included in Email Threat Settings>**</mark>

You’ll get a thank you email in response and updates once we determine if the message is malicious or safe.

* <mark style="background-color:yellow;">**Screenshot A (User Report Response)**</mark>

**Up Next:** We’ll let you know when we officially deploy this functionality in about a week, then shortly after we’ll prepare to deploy File Data Security. You’ll receive a new email highlighting what to expect.

Thank you for your help and cooperation in protecting our organization! Any questions? Let us know here: <mark style="background-color:yellow;">**\<your preferred contact>**</mark>

</details>

***

## 3. File Security is Deployed

**First, gather screenshots for your File Security is Deployed message:**

> You need one screenshot for this template:
>
> * **File Issue Response Email**

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4f8">📸</span> How to Get File Issue Response Email screenshot</summary>

1. In Material, click **Detections**.
2. Filter to **Entity Type**, **File**.
3. Scroll to the detection called **File is publicly accessible,** and open it.
4. Confirm **Send Email** is the first remediation step. If not, **add it,** then click **Save**.
5. Create a **blank document** in your **drive**. Update the Share settings to **Anyone with the Link**.
6. After a few moments, a File Issue Response Email appears in your inbox. Take a screenshot of that.

</details>

**Second, fill out the File Security is Deployed template utilizing the screenshots you gathered:**

> **Message Purpose:** To inform your users about what to expect from File Data Security and how to open messages safely
>
> **Delivery Timing:** When you [enable File Data Security](/getting-started/deployment-guides/your-first-30-days/7-enable-file-security.md)

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4e9">📩</span> File Security is Deployed template</summary>

**Message Subject:**

Google Drive Data Security is enabled – what to expect

**Message Body:**

As you likely know from our previous emails and announcements, we’re slowly rolling out Material Security features to protect our company’s fundamental material—our emails, documents, and accounts —before, during, and after a breach.

Our next rollout is Google Drive Data Security. This feature identifies sensitive content (PII, financial data, legal documents, etc.) archived in your user mailboxes. On your end, you’ll get an email explaining the file issue, and sometimes access to the file will be automatically updated to comply with policy. The email you’ll receive looks something like this:

<mark style="background-color:yellow;">**\<Screenshot: File Issue Response Email>**</mark><br>

Thank you for your help and cooperation in protecting our organization! This completes our Material Security deployment. Any questions? Let us know here: <mark style="background-color:yellow;">**\<your preferred contact>**</mark>

<br>

</details>

***

## 4. ATO Resilience is deployed

**First, gather screenshots for your ATO Resilience is Deployed message:**

> You need two screenshots for this template:
>
> * **Screenshot A (Account Verification)**
> * **Screenshot B (Redacted Email)**

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4f8">📸</span> How to Get Screenshot A (Account Verification)</summary>

1. Request a password reset on anything associated with your work email.
2. From your inbox, find the **reset request**.
3. Take a screenshot of the **verification**.

</details>

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4f8">📸</span> How to Get Screenshot B (Redacted Email)</summary>

1. From **your email inbox**, open the **Sensitive** folder.
2. Take a screenshot of the secured, **Retrieve Message email**.<br>

   If no emails are in your sensitive folder:

   1. From your email inbox, **mark an email as Sensitive** using the built-in labels.
   2. Wait the length of your Default Locking Grace Period.
   3. Open the email again (**now in your Sensitive folder**) and take a screenshot.

</details>

**Second, fill out the ATO Resilience is Deployed template utilizing the screenshots you gathered:**

> **Message Purpose:** To inform your users about the changes to password resets and how to retrieve email redactions
>
> **Delivery Timing:** When you deploy [Sensitive Email Redaction](/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-email-redaction.md)

{% hint style="info" %}
We also have interactive tutorials about resetting passwords and unlocking emails that you can include in your communication [here](/getting-started/deployment-guides/communication-templates/tutorials-for-end-users.md).
{% endhint %}

<details>

<summary><span data-gb-custom-inline data-tag="emoji" data-code="1f4e9">📩</span> ATO Resilience is Deployed template</summary>

**Message Subject:**

Material Account Protection is here! How to reset passwords going forward.

**Message Body:**

Over the past few weeks we’ve been enabling Material Security features to protect <mark style="background-color:yellow;">**\<Your organization name>**</mark> from email-based attacks. Up next, we’re enabling a feature called Account Takeover Resilience to detect a range of account compromise indicators, provides automated remediation workflows, and limits lateral account takeovers by adding a simple authentication step to access password resets and other identity verification messages.

To prepare for these changes, please review the following steps to understand how it will affect password resets and other account verification messages in the coming weeks.

Beginning in about a week:

**Password Resets**

When you reset a password via email, you will first receive a verification email from Material. It looks something like this:

<mark style="background-color:yellow;">**\<Screenshot A: Account Verification>**</mark>

* Follow the instructions in the email to verify your identity using <mark style="background-color:yellow;">**\<mfa provider>**</mark>. Once your identity is verified, the original password reset email will be delivered to your inbox. This quick check with <mark style="background-color:yellow;">**\<mfa provider>**</mark> allows us to make sure the verification message lands in the right hands.
* If you did not request a password reset, click **I did not request to reset my account**.

**Sensitive Emails**

Material scans for content like credit card numbers or personally identifiable information in your email, then categorizes them as sensitive and redacts them for security. You can then access them via a seamless retrieval flow.

Every protected email is replaced with stub, showing you message properties and a link to retrieval the full message:

<mark style="background-color:yellow;">**\<Screenshot B: Email Redaction>**</mark>

<mark style="background-color:yellow;">\*\*\*\*\*\*\*</mark>

<mark style="background-color:yellow;">**\<Variant A below: Google Drive instructions (delete if using Microsoft)>**</mark>

To access the message, **click the link in the email and then complete the authentication steps** just like you normally do when signing in. Once you authenticate, this message will be put back in your **inbox** for <mark style="background-color:yellow;">**\<your default retrieval grace period time>**</mark>. After that time has passed, you will need to authenticate again when prompted.

Once you retrieve one redacted email, you have **\<your default retrieval challenge session time>** to open other redacted emails without authenticating.

<mark style="background-color:yellow;">\*\*\*\*\*\*\*</mark>

<mark style="background-color:yellow;">**\<Variant B below: Microsoft instructions (delete if using Google Drive)>**</mark>

To access the message, **click the link in the email and then complete the authentication steps** just like you normally do when signing in. Once you authenticate, this message will be put back in your **Retrieved Items folder** for <mark style="background-color:yellow;">**\<your default retrieval grace period time>**</mark>. After that time has passed, you will need to authenticate again when prompted.

Once you retrieve one redacted email, you have **\<your default retrieval challenge session time>** to open other redacted emails without authenticating.

<mark style="background-color:yellow;">\*\*\*\*\*\*\*</mark>\
Thank you for your help and cooperation in protecting our organization! This completes our Material Security deployment. Any questions? Let us know here: <mark style="background-color:yellow;">**\<your preferred contact>**</mark>.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/getting-started/deployment-guides/communication-templates/staggered-rollout-essentials-or-advanced-+-ato-resilience.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.