[DT] : MS Purview Information Protection & Data Loss Prevention

Microsoft Purview Information Protection & Data Loss Prevention (DLP)

with Corporate Information Governance & Data Classification

Executive Summary

This engagement delivers a two-phase implementation designed to establish Microsoft Purview Information Protection and Data Loss Prevention capabilities while building an enterprise Information Governance program aligned with NeoCurrency's SOC 2 certification objectives.

Phase 1 – Microsoft Purview Information Protection & DLP

• Phase Hours Deliverables
• Discovery & Planning Requirements, compliance objectives, licensing review
• Purview Foundation Configure Purview, roles, readiness
• Information Protection Up to 5 sensitivity labels, publishing policies, manual/container labeling
• Data Loss Prevention Exchange, SharePoint, OneDrive, Teams DLP, policy tips, notifications
• Endpoint DLP USB, copy/paste, browser, print controls
• Testing & Optimization Pilot, tuning, reporting
• Documentation & KT Runbooks, policy matrix, knowledge transfer

Phase 2 – Corporate Information Governance & Data Classification

• Phase Hours Deliverables
• Information Governance Assessment Governance workshop, SOC 2 objectives, data owners
• Corporate Classification Framework Classification matrix, handling standards, ownership
• Enterprise Data Discovery Assess SharePoint, OneDrive, Exchange, Teams
• Automatic Classification & Labeling Auto-labeling, classifiers, policy tuning
• Corporate Data Tagging & Validation Validation, reporting, bulk tagging strategy
• Governance Documentation & Handover Governance framework, standards, executive handover

SOC 2 Alignment

• •Security – Microsoft Purview, DLP, Endpoint DLP
• •Confidentiality – Sensitivity Labels and encryption
• •Privacy – Data classification and governance
• •Processing Integrity – Policy validation and auditing
• •Availability – Operational documentation and runbooks