CIS.M365.3.3.1 - (L1) Ensure Information Protection sensitivity label policies are published
Overview
At least one sensitivity label policy is published, so users can apply sensitivity labels to their files and email.
Sensitivity labels classify content and can add encryption, markings and access restrictions that stay with a file when it leaves your tenant. A label that is not published to users cannot be applied, so a tenant without a published policy has no consistent way to say which content is confidential.
Creating the labels is only the first step. A label policy makes them available to the users and groups that you choose, and can set a default label and require users to label content.
Remediation action
- Sign in to the Microsoft Purview portal.
- Go to Solutions > Information Protection > Sensitivity labels and create the labels you need.
- Open the Label policies tab and select Publish label.
- Choose the labels, the users and groups to publish to, and the policy settings, such as a default label and mandatory labelling.
- Finish the wizard.
Related links
- Microsoft Purview portal - Label policies
- Create and publish sensitivity labels
- Learn about sensitivity labels
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 3.3.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.3.3.1 |
| Severity | Low |
| Suite | CIS |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:3.3.1, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisSensitivityLabelPoliciesPublished |
| Services | SecurityCompliance |
Source
- Test:
tests/cis/Test.CIS.M365.3.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.3.3.1.md