{ "id": "CB-M365-DATA-001", "standard": "m365", "version": "main", "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-001", "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-001.json", "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-001.yml", "profiles_effective": [ "baseline", "hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-M365-DATA-001", "title": "Enforce a DLP policy for sensitive data in Exchange, SharePoint and OneDrive", "finding": { "title": "Sensitive data can be shared outside the organization from mail, SharePoint and OneDrive without control", "description": "No enforced data loss prevention policy detects bank, identity or payment card numbers, so they leave the tenant by email or sharing link without blocking or warning." }, "status": "active", "profiles": [ "baseline" ], "risk": { "severity": "high" }, "assessment": "manual", "tags": [ "dlp", "purview", "data-protection", "exchange", "sharepoint", "onedrive", "gdpr" ], "description": "A Microsoft Purview data loss prevention (DLP) policy is turned on (not in simulation) on the\n**Exchange email**, **SharePoint sites** and **OneDrive accounts** locations, scoped to all users\nand sites. Its rules detect at least the sensitive information types in\n**{{ dlp_sensitive_info_types }}** and:\n\n- block sharing of matching content with people outside the organization;\n- show a policy tip and send an email notification to the user;\n- send an incident report or alert to the team that handles DLP events.\n\nTeams chats are covered by CB-M365-DATA-002 and devices by CB-M365-DATA-003.\n", "rationale": "Most data leaks in Microsoft 365 are an email or a sharing link sent to the wrong person, by\nmistake or on purpose. A DLP policy stops the most damaging categories (bank details, national\nidentifiers, card numbers) before they leave, and the notification teaches users the rule at the\nmoment it applies. GDPR requires appropriate technical measures for personal data; payment card\nnumbers fall under PCI DSS.\n", "impact": "False positives block some legitimate exchanges (for example a supplier's IBAN sent to an\nexternal accountant). Run the policy in simulation with notifications for two to four weeks,\ntune instance counts and confidence levels, and allow users to override with a justification\nwhere the business accepts it.\n", "notes": "The list of sensitive information types replaces US identifiers used in other baselines (SSN,\nITIN) with French and European ones; add the types that match your sector (health insurance\nnumber, tax number). Microsoft 365 E3 covers DLP for Exchange, SharePoint and OneDrive; Teams and\nendpoints need E5 Compliance.\n", "parameters": [ { "name": "dlp_sensitive_info_types", "type": "list", "description": "Sensitive information types that the DLP policy must detect and block when shared externally (names as shown in Microsoft Purview).", "default": [ "Credit card number", "International banking account number (IBAN)", "France social security number (INSEE)", "France national id card (CNI)", "France passport number" ] } ], "audit": { "manual": "1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global\n Reader (or a member of a role group with View-Only DLP Compliance Management).\n2. Browse to **Solutions** > **Data Loss Prevention** > **Policies**.\n3. Open each policy and check:\n - **Status** (policy mode) is **On**, not **In simulation** or **Off**;\n - **Locations** include **Exchange email**, **SharePoint sites** and **OneDrive accounts**,\n scoped to all users, groups and sites;\n - a rule with the condition **Content contains** > **Sensitive info types** lists every type\n in {{ dlp_sensitive_info_types }}, with the condition **Content is shared from Microsoft\n 365** > **with people outside my organization**;\n - the action **Restrict access or encrypt the content** blocks external recipients or\n external access;\n - **User notifications** and **Policy tips** are on, and **Incident reports** or alerts go\n to a monitored address.\n4. Alternative in Security & Compliance PowerShell: `Get-DlpCompliancePolicy | Format-List\n Name,Mode,ExchangeLocation,SharePointLocation,OneDriveLocation` and `Get-DlpComplianceRule |\n Format-List Name,ParentPolicyName,Disabled,ContentContainsSensitiveInformation,AccessScope,BlockAccess,BlockAccessScope,NotifyUser,GenerateIncidentReport`.\n5. Fail if no policy with `Mode` = `Enable` covers the three locations, if a listed type is\n missing, or if the external sharing is only audited and not blocked, or if users are not\n notified.\n" }, "remediation": { "manual": "1. Sign in to the Microsoft Purview portal as at least a Compliance Administrator (or DLP\n Compliance Management role).\n2. Browse to **Solutions** > **Data Loss Prevention** > **Policies** > **Create policy**.\n3. Choose **Enterprise applications & devices** or the **Custom** template, name the policy, for\n example `DLP - Sensitive data external sharing`.\n4. Select the **Exchange email**, **SharePoint sites** and **OneDrive accounts** locations, all\n users and sites.\n5. Create a rule: **Content contains** > **Sensitive info types** with the types in\n {{ dlp_sensitive_info_types }}; **Content is shared from Microsoft 365** > **with people\n outside my organization**; action **Restrict access or encrypt the content** > **Block only\n people outside your organization**; turn on **User notifications**, **Policy tips** and\n **Incident reports**.\n6. Save in **Run the policy in simulation mode** with **Show policy tips while in simulation\n mode**, review the matches in **Activity explorer** for two to four weeks, then set the\n policy to **Turn the policy on immediately**.\n7. PowerShell alternative: `New-DlpCompliancePolicy -ExchangeLocation All -SharePointLocation\n All -OneDriveLocation All -Mode TestWithNotifications`, `New-DlpComplianceRule` with\n `-ContentContainsSensitiveInformation`, `-AccessScope NotInOrganization`, `-BlockAccess\n $true`, `-NotifyUser`, then `Set-DlpCompliancePolicy -Mode Enable`.\n", "rollback": "Set the policy back to simulation mode (`Set-DlpCompliancePolicy -Mode TestWithNotifications`)\nor turn it off.\n" }, "references": [ { "title": "Learn about data loss prevention", "url": "https://learn.microsoft.com/purview/dlp-learn-about-dlp", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Create and deploy data loss prevention policies", "url": "https://learn.microsoft.com/purview/dlp-create-deploy-policy", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Sensitive information type entity definitions", "url": "https://learn.microsoft.com/purview/sit-sensitive-information-type-entity-definitions", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "Get-DlpCompliancePolicy", "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/get-dlpcompliancepolicy", "publisher": "Microsoft", "kind": "vendor-doc", "accessed": "2026-10-24" }, { "title": "CISA SCuBA Security Suite baseline", "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md", "publisher": "CISA", "kind": "standard", "accessed": "2026-10-24" } ], "mappings": [ { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.SECURITYSUITE.3.1v1", "relation": "partial", "note": "French and EU identifiers replace US SSN and ITIN; the list is a parameter." }, { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.SECURITYSUITE.3.2v1", "relation": "partial", "note": "Covers Exchange, SharePoint and OneDrive; Teams and devices are in CB-M365-DATA-002 and CB-M365-DATA-003." }, { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.SECURITYSUITE.3.3v1", "relation": "equivalent" }, { "framework": "cisa-scuba-m365", "framework_version": "2.0.0", "id": "MS.SECURITYSUITE.3.4v1", "relation": "equivalent" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-4", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "SC-7(10)", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1567" }, { "framework": "mitre-attack", "id": "T1048" } ], "related_controls": [ { "id": "CB-M365-DATA-002", "type": "related" }, { "id": "CB-M365-DATA-003", "type": "related" }, { "id": "CB-M365-DATA-004", "type": "related" }, { "id": "CB-M365-COLLAB-003", "type": "related" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "introduced_in": "0.1.0", "created": "2026-10-24", "updated": "2026-10-24" } }