Detections
Analytics

3.2.1 Ensure DLP policies are enabled

Information

Data Loss Prevention (DLP) policies allow Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.

Enabling DLP policies alerts users and administrators that specific types of data should not be exposed, helping to protect the data from accidental exposure.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft Purview https://purview.microsoft.com/
 - Click Solutions > Data loss prevention then Policies.
 - Click Create policy.
 - Create a policy that is specific to the types of data the organization wishes to protect.

Impact:

Enabling a Teams DLP policy will allow sensitive data in Exchange Online and SharePoint Online to be detected or blocked. Always ensure to follow appropriate procedures during testing and implementation of DLP policies based on organizational standards.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-7, 800-53|SC-4, CSCv7|13

Plugin: microsoft_azure

Control ID: 48e7c23806aa33047d79026f944ba3cd8bb14f94e965a23c2d7ae15b561a029c