What exactly are you trying to secure? The email in transit to other people? In that case, you'd want to use something like PGP to encrypt the message, since email is sent in the clear...your service provider could easily intercept email messages flying over their network (or anyone supplying a connection between you and the recipient). PGP will definitely give them more trouble than it's worth to decrypt the message. There should be plugins for Outlook to integrate it.
Are you trying to secure the storage of messages on your server? You'd want to take the usual precautions of making sure the server has all the latest patches, STRONG passwords, rotating password policy such that users have to change their passwords periodically with minimum 8 letters mixed case alphanumerics, probably on a thirty to ninety day cycle.
You have AV and malware scanners on the mail server, yes?
Are you worried about storage being taken? Governments like taking those if they think there's reason to examine it for something an employee has been doing. The only way to stop that is encryption of the storage volume. Here's where things get hairy because you need to have GOOD BACKUPS in place before screwing around with this...you can use something like NTFS's native encryption or truecrypt to encrypt the volume. This also means that if there's problems with data being corrupted, boot issues, etc...you're up a creek if you don't plan ahead and test, since you can't just boot up with a rescue disk and get to data for recovery! You may want to only have a partition set aside for storing data from the mail server, then encrypt that volume.
Again...TEST BACKUPS. We're talking about making changes to your mail server where if something goes wrong you could easily lose data.
Then that's another question...you are using a backup product that encrypts the tapes, right? Because all the security on the mail server means nothing if some punk can walk out with a tape to recover the data at home because you don't have it passworded and encrypted.
How far do you want to layer security? Because if you're running Outlook in a way that caches data, anyone that puts malware on the client system can read their email. Heck, taking over the boss's computer means they have access to whatever the boss has access to, encrypted or not.
You really need to identify the specific threats you're trying to guard against. Plan out how if you were an outsider you'd try to get whatever asset you're protecting. Then figure out how you'd be thwarted. Stealing client computers? Data backups? Sniffing traffic? Keystroke loggers? What accounts need to be protected?
Then take a deep breath and figure out how much it's going to COST in terms of money and in terms of convenience. Security often isn't the most convenient thing, and users will grow frustrated if they have to put up with things like decryption and encryption (and getting other people to USE the encryption) or having to store passwords or having multiple passwords. You need to find a balance between safety and convenience so that your users will work WITH you and not against you, because your security won't mean squat when users decide to work around your security measures when they're too irritated to follow procedures.
