{
  "id": "CB-M365-DATA-005",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-005",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-005.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DATA-005.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DATA-005",
    "title": "Publish sensitivity labels to all users",
    "finding": {
      "title": "No sensitivity labels are published to users",
      "description": "Users have no way to classify documents and emails, so protection, DLP and Copilot rules based on labels have nothing to work with."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "sensitivity-labels",
      "information-protection",
      "purview",
      "classification"
    ],
    "description": "The organization has a sensitivity label taxonomy that matches its classification policy (for\nexample *Public*, *Internal*, *Confidential*, *Highly confidential*, with sub-labels for\nencryption where needed). At least one label publishing policy makes these labels available to\nall users in Office apps, Outlook and the Microsoft 365 web apps, with a link to the internal\nclassification guide.\n",
    "rationale": "Labels are the foundation for content-aware protection in Microsoft 365: encryption that follows\nthe file, DLP rules, Copilot exclusions and audit of who handles classified data. Without\npublished labels, users cannot mark what is sensitive and most information protection controls\nstay theoretical.\n",
    "impact": "Users see a sensitivity button in Office apps. Labels with encryption can block access for\nexternal partners or older clients: start with non-encrypting labels and test encryption on a\npilot group. Training is needed for consistent labelling.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global\n   Reader.\n2. Browse to **Solutions** > **Information Protection** > **Sensitivity labels** and check that\n   labels exist and are active.\n3. Browse to **Solutions** > **Information Protection** > **Publishing policies** and check that\n   a policy publishes these labels to **All users and groups** (or to groups that together cover\n   all users).\n4. Alternative in Security & Compliance PowerShell: `Get-Label | Format-Table\n   DisplayName,Priority,ContentType,Disabled` and `Get-LabelPolicy | Format-List\n   Name,Labels,ExchangeLocation,ModernGroupLocation,Enabled,Mode`.\n5. Fail if no label is published, or if the publishing policies leave users out.\n"
    },
    "remediation": {
      "manual": "1. Agree the label taxonomy with the data owners and the security team.\n2. Sign in to the Microsoft Purview portal as at least an Information Protection Admin (or\n   Compliance Administrator).\n3. Browse to **Solutions** > **Information Protection** > **Sensitivity labels** > **Create a\n   label** for each level, with scope **Files & other data assets** and **Emails**.\n4. Browse to **Publishing policies** > **Publish label**, select the labels, target **All users\n   and groups**, set **Provide users with a link to a custom help page**, and publish.\n5. PowerShell alternative: `New-Label` and `New-LabelPolicy -Labels <labels> -ExchangeLocation All`.\n",
      "rollback": "Remove labels from the publishing policy or delete the policy. Do not delete labels already\napplied to content.\n"
    },
    "references": [
      {
        "title": "Learn about sensitivity labels",
        "url": "https://learn.microsoft.com/purview/sensitivity-labels",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Create and publish sensitivity labels",
        "url": "https://learn.microsoft.com/purview/create-sensitivity-labels",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Get-LabelPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/get-labelpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-16",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "MP-3",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DATA-004",
        "type": "related"
      },
      {
        "id": "CB-M365-DATA-006",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}