The dependency graph says what is possible. Sequencing says what to do with limited attention, and the ordering principle is simple: everything evidence-driven needs the evidence started first.
The sequence
0 Registrar account security MFA, individual logins, a recovery address off-domain. Outranks everything below it and takes an hour. 1 Reporting, everywhere DMARC rua on every domain. TLS-RPT. Costs nothing, breaks nothing, and starts a clock that everything else depends on. 2 The free controls Non-sending domains locked down. np=reject. CAA. Dangling records removed. See the next lesson. 3 Inventory, from the reports Four weeks minimum, a quarter if seasonal. 4 Alignment, per sender In parallel, gated on vendors rather than on you. 5 DMARC to enforcement Staged, against criteria, with a rehearsed rollback. 6 Transport: MTA-STS, then DANE if the MX zone is signed 7 Monitoring and takedown capability 8 BIMI, if the trademark exists and the spend is justified
What can and cannot run in parallel
| Can parallelise | Cannot | |
|---|---|---|
| Steps 0, 1 and 2 | All three, on day one. None depends on the others. | — |
| Step 3 | — | It is elapsed time, not work. Nothing compresses four weeks of reports. |
| Step 4 | Every sender simultaneously — they are gated on different vendors. | — |
| Step 5 | — | Each policy step needs observation of the one before it. |
| Steps 6 and 7 | With each other, and with the later part of 5. | — |
Steps 3 and 5 are the only genuinely serial parts, and both are waiting rather than working. That is worth saying out loud at the start of a programme, because a plan that looks idle for six weeks is one somebody will question in week three.
Why step 0 is not step 4
- It takes an hour and requires no evidence, no vendor and no budget.
- Every control below it can be removed by whoever holds the account.
- It is the step most often skipped, because it belongs to nobody in particular.
Ship something in week one
Steps 0, 1 and 2 are all achievable in the first week, they carry no risk, and they include the largest single risk reduction available on most estates — locking down the non-sending domains. A programme that delivers visible work immediately is one that gets the six weeks of waiting it needs afterwards.