The best practice is to have one Parent BU (NTO) and three separate Child BUs (Universal Containers, Ursa Major Solar, and Cloud Kicks) — each with its own Sender Authentication Package (SAP) for branding, authentication, and independent sending reputation.

This structure provides clear separation of assets, subscribers, and branding while allowing NTO to retain access for reporting and oversight at the Parent BU level.

—

Exact Extracts from Salesforce Documentation:

Source: Salesforce Help – Business Unit Hierarchies

→ "Use a Parent BU to manage settings and aggregate reporting across Child BUs. Assign separate Sender Authentication Packages to each Child BU for independent branding and deliverability."

Source: Salesforce Implementation Guide – Business Unit Structure

→ "A scalable hierarchy should provide isolation for brand-specific assets and subscribers while maintaining corporate oversight."