What it asks for. Spam protection mechanisms must be employed at system entry and exit points to detect and act on unsolicited messages, and they must be updated when new releases are available.
In practice. Doing this well means a managed email security service or gateway with spam, phishing and malicious attachment filtering, sender authentication checks using SPF, DKIM and DMARC, and automatic updates of detection rules. Auditors look for configuration evidence, DMARC policies and filtering statistics. CIS Control 9 covers email protections. Users should have an easy way to report suspicious messages, which feeds back into tuning.
Common gaps. DMARC is frequently left at a monitoring-only policy indefinitely. Filtering exceptions for specific senders or domains are added and never reviewed. Outbound filtering is often missing, so a compromised mailbox can be used to spam partners.