CIS.M365.3.2.1 - (L1) Ensure DLP policies are enabled
Overview
At least one data loss prevention (DLP) policy for Exchange, SharePoint, OneDrive or Teams is enabled. Policies for Copilot are checked separately.
Without DLP, sensitive information such as card numbers, national identifiers and health records can be emailed, shared or uploaded with nothing to stop it, warn the user or record it. A DLP policy gives you that control and an audit trail, even if you only start in a mode that reports. The locations it covers are the repositories and cloud storage that an attacker collects data from (T1213 and T1530), and it detects and blocks sensitive content that is sent out through a web service (T1567).
The test passes when one non-Copilot policy is in the Enable mode. It does not check which locations or users the policy covers, or whether the policy has exclusions. Policies for Copilot are checked in a separate test. A Microsoft 365 licence that includes Purview DLP is required; tenants without it are skipped.
Remediation action
- Sign in to the Microsoft Purview portal.
- Go to Solutions > Data loss prevention > Policies and select Create policy.
- Choose a template or a custom policy, give it a name, and select the locations and users that need protection.
- Configure the rules for the sensitive information that matters to you and set the policy mode to Turn it on right away.
Related links
- Microsoft Purview portal - Data loss prevention policies
- Create and deploy data loss prevention policies
- Learn about data loss prevention
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 3.2.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.3.2.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Purview |
| Feature | Data loss prevention |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.2.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:3.2.1, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisDlpPoliciesEnabled |
| Services | SecurityCompliance |
| Compatible licenses | EXCHANGE_DLP |
Source
- Test:
tests/cis/Test.CIS.M365.3.2.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.3.2.1.md