Financial services firms are increasingly under pressure to safeguard sensitive data, and so data loss prevention (DLP) has emerged as a critical strategy. Technologies such as Microsoft Purview, which is already integrated deeply within the Microsoft ecosystem of applications, are a logical choice to address the challenge of securing and controlling how data in a business is handled. However, the journey to effective DLP begins long before the technology is even considered.

Here are the top five things we believe financial services firms should know before implementing Data Loss Prevention technology, such as Microsoft Purview.

1. Use your existing policies and procedures

If your business already has policies relating to how data should be handled, then these should be used as the basis of how DLP may be implemented. They will also typically help to accelerate your DLP journey if you already have them.

If you do not have any existing policies or procedures, a clear, well-defined policy on how you expect people in your business to handle data is a necessity before implementing any DLP technology.

2. Understand your data

Before diving into any DLP solution, it is crucial to understand your data. Having full knowledge of what data you possess, where it resides in your various systems, and its significance to your business operations will set the foundations on which every other aspect of DLP will then be determined.

This process typically requires involvement from across the firm with input from a broad spectrum of stakeholders, to gain a complete understanding of the type of data you have. Without this analysis, data types can typically fall through the cracks of a DLP implementation.

Data type example:

Investor relation data is highly sensitive and is typically stored in X SharePoint site, typically as Word or PDF documents, and less sensitive informational documents may also be stored on our public website.

3. Classify your data accurately

Data classification is a cornerstone of any successful DLP implementation. Classifying data involves categorising information based on its level of sensitivity and the potential impact of its loss or exposure. Those who already have a policy will typically have the classification already determined.
By using the information gathered in the previous step, financial firms can establish clear classification policies based on the data they have and define how different types of data should be handled.

Data classification example:

Investor relation data that should not be made public is stored in the “Private” folder in X SharePoint site, this should never leave the business, only data that is saved to the “Public” folder has been uploaded to our public website. Our established classification is Private and Public as defined in our Acceptable Use Policy.

4. Map out your data journey

Understanding the journey of data within and outside your business is critical when you then decide how you will control those data flows. Data is often copied and emailed in and out of the business every day, so it is critical that valid data flows are not subsequently blocked or impeded by any DLP implementation.

Data journey example:

Investor relation data that is made public is sent by the investor services team to our third-party website company via email, who then uploads it to our website. Private data of this type is only ever stored in X SharePoint site, but may be shared internally via email across teams.

5. Define Appropriate Actions Based on Data Type

Once data is classified, the next step is to determine the actions that should be taken to protect different types of data, based on their classification, and how they are being handled. This involves defining rules, but at this stage, those rules should not be based too far on the technology capability of the chosen DLP tool.

Defined protective actions examples:

Investor relation data classified as private can be sent within the business.

Investor relation data that is classified as public can only be sent by the investor services team via email to our third-party website company, otherwise, it is blocked from being sent.

Attempts to email externally are a serious breach of our Acceptable Use Policy, the COO should be notified if this occurs.

In summary, implementing a data loss prevention strategy is a multi-faceted process that extends beyond technology. It requires a thorough understanding of your data, accurate classification, comprehensive mapping of the data journey and defined protective actions. By focusing on these areas first, financial services firms can lay a solid foundation for the effective implementation of DLP technology.