If you don't outsource this type of service (preferred solution imho) then from the very beginning you have to monitor internally (the solution done after the f

If you don't outsource this type of service (preferred solution imho) then from the very beginning you have to monitor internally (the solution done after the fact) and also and most importantly externally, in this case having one or more monitored client-like email accounts.