packs/zero-trust-assessment/workshop/data.json
|
{ "$comment": "Generated by build/zero-trust-workshop/Update-MtZtWorkshopData.ps1. Do not edit.", "Id": "data", "Name": "Data", "Source": { "Url": "https://zerotrust.microsoft.com", "Docs": "https://github.com/microsoft/zerotrustassessment", "Updated": "2026-11-06" }, "Areas": [ { "Id": "know-protect-data", "Name": "Know and protect your data", "Description": "Know and protect your data", "Icon": "know-protect-data.svg" }, { "Id": "manage-data-access", "Name": "Manage Data Access", "Description": "Manage data access", "Icon": "manage-data-access.svg" }, { "Id": "protect-critical-assets", "Name": "Protect Critical Assets", "Description": "Protect critical assets", "Icon": "protect-critical-assets.svg" } ], "Tasks": [ { "Id": "RMT_001", "Name": "Sensitive data discovery", "AreaId": "know-protect-data", "Swimlane": "Data Identification", "Phase": "First", "Priority": "P0", "Effort": "High", "UserImpact": "Low", "License": "E5", "Cisa": "Initial", "Dependencies": [], "Icon": "RMT_001.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_001", "Doc": "## Overview\n\nThe first step in implementing Zero Trust for your data assets is to identify and categorize these assets according to their sensitivity, which encompasses areas like confidentiality, criticality and business impact.\nThe following tools are available for discovering Sensitive Data across the organization:\n* Out of the box and custom classifiers (A.K.A. Sensitive Information Types). Classifiers enable you to identify documents and emails that contain contents matching certain patterns or criteria.\n * Out of the box classifiers allow you to detect identifiable information corresponding to well-known entities such as people's national identity numbers, bank accounts or drivers licenses.\n * Custom sensitive information types can be created to identify non-standard, business-specific identifiers or other sensitive information, or to customize how standard entities are detected.\n* Advanced classifiers. These include:\n * Exact Data Match for accurately detecting known personal information such as that corresponding to customers or employees.\n * Trainable classifiers (both pre-trained and custom) to detect documents likely to belong to certain categories or classes\n * Fingerprints to identify documents closely matching the content in well-known documents.\n * Named entities, which can be used to detect people's names, addresses, credentials and other potentially sensitive data.\n* Content Explorer and the Content Explorer Export PowerShell tool: Individual data assets matching individual classifiers can be identified and investigated in Content Explorer directly. Alternatively, information about all data assets can be identified and exported using PowerShell and imported into a SIEM tool for further analysis.\n* Activity Explorer: it reflects creation, access and sharing of sensitive information in your environment, allowing you to perform an initial assessment of risky behaviors and actions by your users involving sensitive data.\n* Unified Audit Log and custom tools built on top of it. Every action related to the creation, modification, classification, discovery or sharing of data in a Microsoft 365 tenant is reflected in the Audit Log, which can be connected to a SIEM to help identify the presence of sensitive information and patterns in its exposure and usage.\n\n## Reference\n\n* Content Explorer: https://learn.microsoft.com/en-us/purview/data-classification-content-explorer \n* Content Explorer PowerShell: https://learn.microsoft.com/en-us/powershell/module/exchange/export-contentexplorerdata \n* Activity Explorer: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer\n* Unified Audit Log: https://learn.microsoft.com/en-us/purview/audit-solutions-overview\n* Out of the box Sensitive Information Types: https://aka.ms/sensitiveinfotypes\n* Custom Sensitive information types: https://learn.microsoft.com/en-us/purview/sit-create-a-custom-sensitive-information-type \n* Exact data matching: https://learn.microsoft.com/en-us/purview/sit-learn-about-exact-data-match-based-sits\n* Trainable classifiers: https://learn.microsoft.com/en-us/purview/trainable-classifiers-learn-about \n* Fingerprinting: https://learn.microsoft.com/en-us/purview/sit-document-fingerprinting \n* Named Entities: https://learn.microsoft.com/en-us/purview/sit-named-entities-learn\n\n## Additional resources\n\n|**Scenario**|**Preferred method**|**Alternative methods (less accurate)**|**Techniques to reduce false positives**|\n| :- | :- | :- | :- |\n|**Detect PII/PHI for known individuals (customers/patients)**|Exact Data Match to data from LoB app extract|Custom SITs including employee ID + common PII SITs (e.g. SSN).|If using regular SITs, consider requiring the presence of All Full Names, and limiting rules to documents with more than a certain minimum match count. |\n|**Detect PII/PHI for employees or contractors**|Exact Data Match to data from HR system extract|Custom SITs including employee ID + Named Entities (e.g. all full names) + common PII SITs (e.g. SSN).|If using regular SITs, consider requiring the presence of All Full Names, and limiting rules to documents with more than a certain minimum match count. |\n|**Detect forms with personal data (e.g. sign-up forms, tax forms, account management forms, etc.)**|Form fingerprinting + standard SITs or fingerprinting + custom SITs|(Custom SITs) + keywords + OCR (for scanned forms)|Use EDM instead of custom SITs if not using fingerprinting. |\n|**Contracts, legal documents or other business forms**|Custom trainable classifiers (+ OCR)|OOB trainable classifiers + OCR|Identify documents in your organization that are correctly identified by the OOB trainable classifiers, copy them to a repository and use them to train a custom classifier. This will produce a fine tuned classifier that will better align with your organization's typical terms (e.g. include company names, jargon, boilerplate). |\n|**Important contracts or other documents**|Trainable classifier + sensitivity label (manually or automatically applied)|Trainable classifier + custom SIT (e.g. regex to detect monetary amounts in excess of $100K, or dictionary or EDM with important customer names)|Identify documents in your organization that are correctly identified by the OOB trainable classifiers, as well as documents manually tagged/labeled as such, copy them to a repository and use them to train a custom classifier. This will produce a fine tuned classifier that will better align with your organization's typical terms (e.g. include company names, jargon, boilerplate). You can also combine use of multiple trainable classifiers in a single rule, e.g. \"Contracts\" and \"Documents about Project X\" to find documents relevant to both subjects.|\n|**General PII or PHI of unknown individuals (e.g. non-customers or prospective customers)** |OOB SITs if available for the desired PII or custom SITs.|Manual labeling|Copy and edit an existing SIT to fine tune its keyword requirements. Expand proximity limit requirements for matching content in filled forms in PDF format since content in forms is not stored within the form structure. Add requirements for named entities such as All Full Names.<br />Ensure custom regexes are defined as \"word match\" or start and end with \\b.|\n|**Sensitive conversations of known nature**|Custom Trainable classifier trained based on confirmed samples| |Identify in Content Explorer documents with labels that are relevant to those subjects, extract them and use them to train a custom classifier. |\n|**Sensitive conversations of non-specific nature**|Manual labeling (let the user decide)|Use dictionaries of \"hush words\" or other relevant keywords which might hint at sensitive subjects. | |\n|**Scanned identity cards (or similar)**|OOB or Custom SITs + OCR|Custom SIT with keyword lists present in such documents + OCR|Add requirement for Named Entities (names or addresses) if expected to be written in one line in the document. |\n|**Project data**|Location-based labeling (e.g. default label for library)|Manual labeling or custom trainable classifiers|Once location-based labeling or manual labeling has identified enough relevant documents use those to train a custom classifier. |", "Checks": [ "ZTA.35022", "ZTA.35033", "ZTA.35034" ] }, { "Id": "RMT_003", "Name": "Document/Identify approved sharing of sensitive information with external partners", "AreaId": "know-protect-data", "Swimlane": "Data Identification", "Phase": "Then", "Priority": "P1", "Effort": "Medium", "UserImpact": "Medium", "License": "AIP-P1", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_003.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_003", "Doc": "## Overview\n\nList all known and approved scenarios required by business functions that involve sharing sensitive data with external partners of the organization (such as service providers and collaborators).\nThese scenarios can be general in nature (e.g. employee sending a partner pre-release information necessary for the coordination of business activities) or specific (e.g. sharing of billing data with an external auditor).\nInitial identification of common sharing patterns can be done by using tools like Activity Explorer and through analysis of the Unified Audit Log's SharePoint and OneDrive sharing logs, as well as Exchange audit logs.\n\n## Reference\n\n* Activity Explorer: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer\n* SharePoint sharing logs schema: https://learn.microsoft.com/en-us/purview/audit-log-activities#sharing-and-access-request-activities", "Checks": [] }, { "Id": "RMT_004", "Name": "Identify Customer Sharing Scenarios", "AreaId": "know-protect-data", "Swimlane": "Data Identification", "Phase": "First", "Priority": "P0", "Effort": "Medium", "UserImpact": "Medium", "License": "AIP-P1", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_004.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_004", "Doc": "## Overview\n\nList all known and approved scenarios required by business functions that involve sharing sensitive data with customers of the organization or non-affiliated external persons.\nThese scenarios might be general in nature (e.g. employee sending a customer files that contain the same customer's PII) or specific (e.g. billing data is shared on a monthly basis by the Finance department with customers as PDF attachments).\nInitial identification of common sharing patterns can be done by using tools like Activity Explorer and through analysis of the Unified Audit Log's SharePoint and OneDrive sharing logs, as well as Exchange audit logs.\n\n## Reference\n\n* Activity Explorer: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer\n* SharePoint sharing logs schema: https://learn.microsoft.com/en-us/purview/audit-log-activities#sharing-and-access-request-activities", "Checks": [] }, { "Id": "RMT_005", "Name": "Data governance regulatory needs", "AreaId": "know-protect-data", "Swimlane": "Data Identification", "Phase": "Then", "Priority": "P0", "Effort": "High", "UserImpact": "Low", "License": "AIP-P1", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_005.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_005", "Doc": "## Overview\n\nIdentify any Data Lifecycle Management needs such as data Retention and data deletion policies which require the organization to retain some data for a minimum or maximum period of time and prevent it from being deleted or kept (e.g. retain customer complaint records for 6 months).\n\n## Reference\n\n* Purview Data Lifecycle Management: https://learn.microsoft.com/en-us/purview/data-lifecycle-management", "Checks": [] }, { "Id": "RMT_006", "Name": "Define a data classification taxonomy for the organization based on data sensitivity", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "First", "Priority": "P0", "Effort": "Medium", "UserImpact": "Medium", "License": "AIP-P1", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_006.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_006", "Doc": "## Overview\n\nDifferent business assets, and in particular business data assets such as documents and emails, must be handled with different levels of precaution and under specific types of controls based on their sensitivity.\nSensitivity can be associated with the confidentiality, criticality and business impact of each piece of information.\nIdentify the different categories for data sensitivity, e.g. \"personal, public, external business data, internal business data, confidential, highly confidential\", and work with stakeholders across the organization to identify the right level of granularity required to properly compartmentalize data. Keep in mind that this classification is not the only method that will be used to compartmentalize data, so keep it at a high level. Think of these as \"buckets\" of confidentiality which define the principles for handling different types of data.\nOnce a classification taxonomy has been defined, it can be implemented through sensitivity labels which can then be applied to different assets either automatically or manually.\nWork with stakeholders in the business and in IT to define the right naming convention for the labeling taxonomy. A suitable sensitivity level taxonomy must meet the following requirements:\n1) Be simple. The taxonomy can't be formed of more than two layers of classification, and each layer should not show more than six different options to a user at any given time to avoid users ignoring them or choosing without careful consideration. Project, role or team-specific labels must be scoped so they aren't displayed unnecessarily to unrelated users.\n2) Reflect the business needs. Labels must be able to accommodate the different types of data assets in the organization, dividing them by their sensitivity, while providing the required security controls for each applicable scenario.\n3) Be easily understandable. Selecting the right label names is critical for users to be able to understand them at a glance. The ordering of the labels must be obvious (e.g. don't use simultaneously terms like \"confidential\" and \"private\" since users might not know which one implies a higher level of sensitivity, use terms like \"confidential\" and \"highly confidential\" instead), and the terms used must resonate with your users' accepted language.\n4) Be stable. While it is possible to adjust sensitivity label definitions over time, such changes should be minimized, and if at all possible be limited to changes in terminology or enforcement, avoiding changes in the structure of the labeling taxonomy as much as possible.\n\nYour label taxonomy should have one or two levels. In most cases, the top level should be used to reflect the sensitivity of the data, while a second level (sublabels) can optionally be used to specify different forms of data matching the top-level sensitivity labels that require different levels of protection (e.g. Confidential/Internal and Confidential/External both represent confidential data but with different scope of restrictions).\nCreate and deploy labels and label policies following the defined taxonomy, but without implementing any restrictions in them.\nIdentify (but do not enforce at this time) access restrictions related to each sensitivity level and business scenario. For example, consider whether users might have a need for copying or printing highly confidential data, whether watermarks are needed to minimize risk of oversharing, and whether specific people in your organization need access at all to the specific types of assets.\n\n## Reference\n\n* Create and publish sensitivity labels https://learn.microsoft.com/en-us/purview/create-sensitivity-labels\n* Microsoft Information Protection Deployment Acceleration Guide: https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/", "Checks": [ "ZTA.35003", "ZTA.35015" ] }, { "Id": "RMT_007", "Name": "Identify Automatic Classification cases", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "Then", "Priority": "P0", "Effort": "Medium", "UserImpact": "Medium", "License": "AIP-P2", "Cisa": "Advanced", "Dependencies": [ "RMT_006" ], "Icon": "RMT_007.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_007", "Doc": "## Overview\n\nIdentify and document use cases where a file can be automatically labeled based on its content. Examples: documents containing detectable sensitive information using standard Sensitive Information Types, documents matching trainable classifiers related to sensitive topics or document types, etc.\nConsider different methods for automatic classification with varying assertiveness based on the confidence on the detected data. E.g. for a match to a sensitive information type which is likely to lead to many false positives, use interactive client-side labeling in recommendation mode, whereas for matches with a high level of certainty such as those resulting from Exact Data Matching or fingerprinting at high match thresholds, you can use service-side autolabeling in SharePoint, OneDrive and Exchange.\nDo not deploy the automatic labeling rules at this stage.\n\n## Reference\n\n* Apply a sensitivity label to content automatically https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically", "Checks": [ "ZTA.35035" ] }, { "Id": "RMT_008", "Name": "Manually classify sensitive assets", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "Then", "Priority": "P1", "Effort": "Medium", "UserImpact": "High", "License": "AIP-P1", "Cisa": "Traditional", "Dependencies": [ "RMT_007" ], "Icon": "RMT_008.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_008", "Doc": "## Overview\n\nTrain and evaluate users for manually applying sensitivity labels. Start with a group of pilot users who are trained to use labels, and after a period of a few weeks identify (using Content Explorer) files which they have labeled manually, as well as known files you would expect to have been labeled, and compare the results with the expected label for each asset as evaluated by the security team.\nWhen implementing labels, you should initially deploy them without usage restrictions, watermarks and other controls in order to assess users behavior without consideration of the impact of such restrictions.\n\nThis step precedes using recommended and automatic labeling mechanisms that don't rely on the end user making a decision to apply a label.\n\n## Reference\n\n* Create and publish sensitivity labels https://learn.microsoft.com/en-us/purview/create-sensitivity-labels\n* Content Explorer: https://learn.microsoft.com/en-us/purview/data-classification-content-explorer \n* Content Explorer PowerShell: https://learn.microsoft.com/en-us/powershell/module/exchange/export-contentexplorerdata \n* Activity Explorer: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer", "Checks": [ "ZTA.35004", "ZTA.35005", "ZTA.35006", "ZTA.35012", "ZTA.35016", "ZTA.35018" ] }, { "Id": "RMT_009", "Name": "Implement label recommendations", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "Then", "Priority": "P1", "Effort": "Medium", "UserImpact": "Medium", "License": "AIP-P2", "Cisa": "Initial", "Dependencies": [ "RMT_008" ], "Icon": "RMT_009.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_009", "Doc": "## Overview\n\nConfigure label recommendation in client-side labeling for the group of pilot users.\nAfter a period of a few weeks, evaluate using Activity Explorer and Autolabeling simulations whether the recommendations were accepted and applied by users to assess and fine-tune accuracy of the rules.\n\n## Reference\n\n* Recommend that the user applies a sensitivity label https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically#recommend-that-the-user-applies-a-sensitivity-label\n* Learn about auto-labeling simulation: https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically#learn-about-simulation-mode", "Checks": [] }, { "Id": "RMT_015", "Name": "Automatically label sensitive assets", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "Next", "Priority": "P0", "Effort": "Low", "UserImpact": "Low", "License": "E5", "Cisa": "Advanced", "Dependencies": [ "RMT_009" ], "Icon": "RMT_015.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_015", "Doc": "## Overview\n\nConfigure client-side Auto-labeling rules in automatic application mode (either as replacement or in addition to label recommendations as implemented previously) for the group of pilot users. Configure service-side auto-labeling for SharePoint Online, OneDrive and Exchange users.\nClient-side autolabeling, being interactive, can be more aggressive in the use of classifiers with low confidence (users are allowed to override the application of a label to the content they are creating). Service-side autolabeling occurs without user interaction, so it is generally limited to rules with higher certainty (e.g. higher match count and/or higher SIT confidence levels).\n\nMonitor using activity explorer or a SIEM tool to see if users are overriding labels that were applied automatically and adjust the policies or further train users if needed.\n\n## Reference\n\n* Apply a sensitivity label to content automatically https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically", "Checks": [ "ZTA.35008", "ZTA.35014", "ZTA.35017", "ZTA.35019", "ZTA.35020", "ZTA.35021", "ZTA.35029" ] }, { "Id": "RMT_016", "Name": "Identify sensitive data using Trainable Classifiers", "AreaId": "know-protect-data", "Swimlane": "Data Classification", "Phase": "Next", "Priority": "P2", "Effort": "Low", "UserImpact": "Low", "License": "E5", "Cisa": "Optimal", "Dependencies": [ "RMT_015" ], "Icon": "RMT_016.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_016", "Doc": "## Overview\n\nList all use cases where a file can be automatically identified as sensitive using trainable classifiers (Pretrained classifiers provided by Microsoft and/or Custom trainable classifiers).\nConsider whether the out of the box classifiers cover your business needs and have the required accuracy in your environment or they need to be fine-tuned by creating new classifiers based on their matches in your content or using manually selected content.\nFine-tuning an out of the box classifier can be done by copying all files detected by the original classifier in a specific location, removing files that were improperly detected and adding known files that were not correctly matched and training a classifier based on these results. In most cases, just training a classifier based on the matches to the original classifier provides enough benefit by identifying internal terms and jargon which can considerably improve accuracy of the classifier.\n\nFor classifiers where high rates of false positives are a problem consider combining their use with regular classifiers, e.g.:\n* Contract classifier together with a custom SIT that looks for monetary amounts in excess of a certain value (e.g. $100,000).\n* Project collateral classifier together with a dictionary-based SIT that looks for terms referring to specific projects or stakeholders.\n\n## Reference\n\n* Learn about trainable classifiers https://learn.microsoft.com/en-us/purview/trainable-classifiers-learn-about\n* Get started with trainable classifiers https://learn.microsoft.com/en-us/purview/trainable-classifiers-get-started-with", "Checks": [ "ZTA.35036" ] }, { "Id": "RMT_010", "Name": "Monitor external sharing", "AreaId": "know-protect-data", "Swimlane": "Data Protection", "Phase": "Then", "Priority": "P0", "Effort": "High", "UserImpact": "Low", "License": "AIP-P2", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_010.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_010", "Doc": "## Overview\n\nBased on the scenarios listed earlier for sharing data with external partners of the organization such as service providers and collaborators (excluding customers), design the DLP policies to block external sharing scenarios not matching these patterns. Use both sensitive information types as conditions and sensitivity labels as either conditions or DLP rule exceptions to address those scenarios.\nE.g.: block sharing of high confidence NDA intellectual property with anyone except registered partners. Block sharing of high confidence NDA intellectual property with partners unless it's labeled as \"Partner Confidential\" (which limits access only to employees and partners and limits resharing functionality).\n\nUse rules based on sensitive information types and/or EDM if sharing PII with partners is allowed in specific circumstances (e.g. auditors, data processors).\nUse rules based on trainable classifiers to detect intellectual property or allowed types of sensitive discussions. Combine them with regular classifiers (e.g. keyword-based SITs) if data pertaining specific projects or topics is allowed for sharing with partners.\n\nDo not enforce the DLP rules at this stage, keep them in simulation mode in order to assess potential impact, and after a few weeks assess if critical business scenarios could have been impacted by these rules if they had been enforced. Adjust the logic of the rules and their enforcement actions (e.g. usage of policy tips, overrides and exceptions) as needed.\n\n## Reference\n\n* Create and Deploy data loss prevention policies https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy", "Checks": [] }, { "Id": "RMT_011", "Name": "Monitor sharing with customers", "AreaId": "know-protect-data", "Swimlane": "Data Protection", "Phase": "Then", "Priority": "P0", "Effort": "High", "UserImpact": "Medium", "License": "AIP-P2", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_011.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_011", "Doc": "## Overview\n\nBased on the scenarios of sharing data with customers (external users), design the DLP policies to block external sharing scenarios not matching these patterns. Use both sensitive information types as conditions and sensitivity labels as conditions and DLP rule exceptions to address those scenarios. Select different combinations of evidence with varying levels of certainty to implement controls at different levels of assertiveness. For example:\nSingle match and low or medium confidence matches: warn the user.\nSingle match and high confidence matches: block with override.\nMultiple matches with low or medium confidence: block with override.\nMultiple matches with high confidence: block.\nLarge number of matches with medium confidence: block.\n\nConfigure these policies across different sharing scenarios, including SharePoint, OneDrive, Teams, Endpoint and Exchange.\nUse Exact Data Matching as a high confidence classifier. Use regular SITs with validators and keywords as medium or high confidence classifiers. Use regular SITs with no keywords as low confidence matches. You can also use trainable classifiers together with regular SITs as conditions representing high confidence situations.\n\nDo not deploy the DLP rules at this stage, configure them but keep them in simulation mode in order to assess potential impact, and after a few weeks assess if critical business scenarios could have been impacted by these rules if they had been enforced. Adjust the logic of the rules and their enforcement actions (e.g. usage of policy tips, overrides and exceptions) as needed.\n\n## Reference\n\n* Create and Deploy data loss prevention policies https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy", "Checks": [] }, { "Id": "RMT_017", "Name": "Implement SharePoint Permission Strategy", "AreaId": "know-protect-data", "Swimlane": "Data Protection", "Phase": "Next", "Priority": "P0", "Effort": "Low", "UserImpact": "High", "License": "AIP-P1", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_017.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_017", "Doc": "## Overview\n\nSensitivity labels can be applied not just to documents and emails, but also to SharePoint sites and OneDrive. When applied to sites, sensitivity labels can be used to enforce SharePoint policies for external sharing, guest access, privacy controls and conditional access. They can also be used to assign default labels for content and other settings.\n\nAt this stage you should design and implement a strategy for SharePoint Online sites permissions and labeling including:\n* Decide whether you will use the same label taxonomy as the one you used for documents and emails (recommended) or you will use a separate group of labels for this scenario. Even in the case of a separate set of labels, it is recommended that the language used for the labels is closely aligned between the two to help reinforce their meaning.\n* Decide whether a default label will be used for sites, and whether labeling will be mandatory. In environments where Zero Trust is being implemented, mandatory labeling of sites should be enforced, and a default label which enforces internal-only access by authenticated users can be configured.\n* Decide which controls will be enforced by these labels. Generally, labels such as \"public\" do not enforce major restrictions, though anonymous sharing should be disabled for all sites to achieve zero trust. For sites related to internal-only content, the following settings are recommended to align with the zero trust principles:\n* Configuring the privacy level settings to \"Private\" so access to sites must be explicitly granted.\n* Configuring external sharing settings in the label to either allow only people in your organization for labels designating internal sites, or for external sites to only allow existing guests (which must be explicitly added to your directory by using Entra ID) to access the site. Enabling the option to give access to new guests will allow individual users in the company to automatically add people as guest to the organization by just sharing content in SharePoint, so this option should not be selected unless the burden of manually inviting users is considered unacceptable in the company's business.\n* Enforce Conditional Access to access the sites, according to C.A. policies defined as part of the workshop for the Identity pillar. For labels designating internal sites, allow only access from managed devices. For labels designating external sites, allowing web access only is recommended.\n\nYou can also use sensitivity labels on Teams for teams and channels, as well as for Microsoft 365 groups, using criteria similar to the ones used for SharePoint and OneDrive.\n\nDepending on the type of site (Team site, Channel sites, Communication sites, Hub sites) apply the appropriate permissions. You should also consider using SharePoint Advanced Management options for further restricting and monitoring access to SharePoint sites.\n\n## Reference\n\n* Sharing and permissions in the SharePoint modern experience https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions\n* Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites", "Checks": [] }, { "Id": "RMT_012", "Name": "Set Data Loss Prevention policies", "AreaId": "know-protect-data", "Swimlane": "Data Loss Prevention", "Phase": "Then", "Priority": "P0", "Effort": "Low", "UserImpact": "Low", "Cisa": "Initial", "Dependencies": [], "Icon": "RMT_012.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_012", "Doc": "## Overview\n\nDeploy and enable the data loss prevention policies which you previously designed for external sharing with third parties and with partners and customers. Also create and deploy DLP rules to block sharing of sensitive information in scenarios not matching either of these or other allowed scenarios.\n\n## Reference\n\n* Create and Deploy data loss prevention policies https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy", "Checks": [ "ZTA.35030", "ZTA.35032" ] }, { "Id": "RMT_013", "Name": "Manage DLP Alerts & Incidents", "AreaId": "know-protect-data", "Swimlane": "Data Loss Prevention", "Phase": "Then", "Priority": "P0", "Effort": "High", "UserImpact": "Low", "Cisa": "Initial", "Dependencies": [], "Icon": "RMT_013.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_013", "Doc": "## Overview\n\nUse the recommended Microsoft Defender XDR experience for DLP alert investigations. If needed for advanced incident management needs such as reporting to executives or regulators and for automated workflows, export the relevant activities from the Unified Audit Log to a SIEM system such as Microsoft Sentinel.\n\n## Reference\n\n* Guidance for investigating Microsoft Purview Data Loss Prevention incidents https://techcommunity.microsoft.com/t5/security-compliance-and-identity/guidance-for-investigating-microsoft-purview-data-loss/ba-p/3732562\n* Unified Audit Log DLP schema https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#dlp-schema", "Checks": [] }, { "Id": "RMT_014", "Name": "Monitor sharing by employees", "AreaId": "know-protect-data", "Swimlane": "Data Loss Prevention", "Phase": "Then", "Priority": "P0", "Effort": "High", "UserImpact": "Medium", "Cisa": "Initial", "Dependencies": [], "Icon": "RMT_014.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_014", "Doc": "## Overview\n\nBased on the identified scenarios of sharing data among internal users of the organization (Document / Approve all Data Sharing means), add restrictions to the sensitivity labels you defined in previous steps in a way that aligns with those scenarios. E.g. limit access to \"confidential / internal\" content to internal users (employees) only. Further restrict Highly Confidential data so it can't be copied or printed, and add a watermark to it to discourage other forms of sharing.\nAlso add restrictions to labels used for external sharing with partners or customers, e.g. by limiting access to only the domains for those companies and by limiting usage rights such as the ability to copy, forward or print the content.\n\nMonitor the manual application of labels by users after implementing these restrictions. Ideally, application patterns should not change as a result of the restrictions, if you see significant changes in user behavior work with different stakeholders to understand whether these changes are the result of overly restrictive policies which prevent users from doing their jobs with the data if they label it correctly, or it is due to poor user awareness, training or other factors. Adjust the policies accordingly.\n\nAt the same time, you should consider the option to enforce mandatory labeling of all emails and documents (recommended for Zero Trust), and use of a default label for emails and documents. Given the usually large number of emails a user may generate each day, a common practice is to define a default label for emails, and use one that's mildly restrictive (e.g. \"internal\", associated with DLP rules that block sending such emails externally but without internal sharing or usage restrictions) so users are able to change this label as needed for external sharing or for using a more restrictive label.\n\nAlso consider the use of Information Barriers to prevent sharing of data between parts of the organization which should be isolated from each other (e.g. account teams working for competing companies, tented projects, highly confidential R&D labs, roles in highly regulated businesses that are in potential conflict with others in the organization if they exchanged content).\n\n## Reference\n\n* Create and Deploy data loss prevention policies https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy\n* Learn about information barriers: https://learn.microsoft.com/en-us/purview/information-barriers", "Checks": [ "ZTA.35039" ] }, { "Id": "RMT_018", "Name": "Set Insider Risk Management policies", "AreaId": "know-protect-data", "Swimlane": "Data Loss Prevention", "Phase": "Next", "Priority": "P0", "Effort": "Low", "UserImpact": "Low", "License": "E5", "Cisa": "Optimal", "Dependencies": [], "Icon": "RMT_018.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_018", "Doc": "## Overview\n\nInsider Risk Management allows you to monitor activities by risky users using state of the art AI algorithms.\nBy default, no special data collection or monitoring is performed for users, but specific events, such as the user triggering a specific DLP rule or them announcing to HR their intention to leave the company, trigger detailed analysis of the past and future user activity to identify potentially malicious behavior, including actions such as collecting sensitive data in removable drives, printing sensitive documents or attempting to bypass physical access controls.\nWhile the Zero Trust principles indicate that no activity should be blindly trusted, using Insider Risk Management to put special focus on users which are in a heightened state of risk allows for more focused policies to be enforced as needed.\n\nIn order to benefit from this capability, you need to create and manage insider risk management policies based on in-scope groups of employees and the type of risk activities that you want to detect and investigate (i.e. policy indicators).\nIn the context of a Zero Trust implementation, the following policies are of specific value:\n* Data Theft by departing users\n* Data Leaks by priority users\n* Risky AI usage\n* Security Policy Violations\n\nIn addition to these policies, Insider Risk Management can be also used to identify risky users to which more restrictive DLP policies will be applied. Any of the policies above can be used to put risky users in the scope of more aggressive or restrictive DLP policies that are too limiting to be applied to the whole population.\n\n## Reference\n\n* Create and manage insider risk management policies https://learn.microsoft.com/en-us/purview/insider-risk-management-policies\n* Configure policy indicators in insider risk management https://learn.microsoft.com/en-us/purview/insider-risk-management-settings-policy-indicators\n* Help dynamically mitigate risks with Adaptive Protection https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection?tabs=purview-portal", "Checks": [ "ZTA.35038" ] }, { "Id": "RMT_019", "Name": "Privileged Access Management for DLP/MIP/IRM Admins", "AreaId": "manage-data-access", "Phase": "First", "Priority": "P3", "Effort": "Low", "UserImpact": "Low", "License": "AIP-P2", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_019.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_019", "Doc": "## Overview\n\nThis section is not implemented yet. It will be added once PIM support for DLP and MIP roles becomes generally available.\n\n## Reference\n\n*", "Checks": [ "ZTA.35011" ] }, { "Id": "RMT_020", "Name": "Set RBAC for DLP/MIP/IRM Admins", "AreaId": "manage-data-access", "Phase": "Then", "Priority": "P1", "Effort": "Low", "UserImpact": "Low", "License": "AIP-P1", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_020.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_020", "Doc": "## Overview\n\nReview the Role-Based Access control options available for administrators of Data Loss Prevention, Microsoft Information Protection and Insider Risk Management, and make the configurations necessary to meet your organization's needs.\n\nIn particular, consider restricting the use of the following roles and privileges which offer company-wide access to content:\n* Content Explorer content viewer role group. This role group allows an administrator to view any content in the tenant, regardless of the content's access restrictions. This role is by default only assigned to global administrators and compliance administrators, and should be granted only to personnel involved in data investigations.\n* Content Explorer list viewer role group. This role group allows an administrator to enumerate any content in the tenant, and view matches to sensitive information in it, regardless of the content's access restrictions. This role is by default only assigned to global administrators and compliance administrators, and should be granted only to personnel involved in data investigations and alert processing.\n* AIP SuperUser. This role (assigned via the Add-AIPServiceSuperUser and Set-AIPServiceSuperUserGroup PowerShell cmdlets) allows a user to decrypt any MIP-encrypted content protected in the tenant (other than content protected with Dual Key Encryption) regardless of the policy on the label assigned to the content.\n\n## Reference\n\n* Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview https://learn.microsoft.com/en-us/defender-office-365/scc-permissions", "Checks": [] }, { "Id": "RMT_021", "Name": "Set minimum standards for trusted devices / accounts", "AreaId": "manage-data-access", "Phase": "Then", "Priority": "P0", "Effort": "Medium", "UserImpact": "High", "License": "AIP-P1", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_021.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_021", "Doc": "## Overview\n\nUse Intune to manage the devices and identities of the DLP/MIP/IRM administrators in accordance with the sensitive data they handle (such as configuration settings, alert and incident data).\n\n## Reference\n\n* Manage your devices and control device features in Microsoft Intune https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices\n\n* Manage user and group identities in Microsoft Intune https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-identities", "Checks": [] }, { "Id": "RMT_022", "Name": "Segment administration using Administrative Units and RBAC", "AreaId": "manage-data-access", "Phase": "Next", "Priority": "P3", "Effort": "Medium", "UserImpact": "Low", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_022.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_022", "Doc": "## Overview\n\nFor most administrative tasks, including Information Protection Admin and DLP admin, the Purview administration portal allows the scoping of policies and artifacts to specific administrative units, so management of such elements can be limited to specified admins (e.g. those for a specific region or business unit) and application of the same can be scoped to users in those administrative units.\n\nFor businesses with compartmentalized or tented units, this capability should be utilized by defining administrative units including the users in those parts of the businesses and the corresponding administrators.\nYou must then assign DLP policies, labels, label policies, autolabeling policies and insider risk management policies to the corresponding admin units to ensure administrators cannot alter policies or view results for users outside of their unit.\n\n## Reference\n\n* Administrative units in Microsoft Purview https://learn.microsoft.com/en-us/purview/purview-admin-units", "Checks": [] }, { "Id": "RMT_023", "Name": "Identify Critical Assets", "AreaId": "protect-critical-assets", "Swimlane": "Critical Asset Identification", "Phase": "Then", "Priority": "P0", "Effort": "Medium", "UserImpact": "Medium", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_023.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_023", "Doc": "## Overview\n\nCritical Data Assets are defined here to be Mission-critical which require special data security and/or cryptographic requirements, such as in the Defense or Military industries.\n\nSuch resources are, either permanently or temporarily, accessible only to a very limited set of users, and never shared with personnel outside of the organization.\nExamples include documents with secret product design plans or formulas, critical PII for VIP employees or customers, undisclosed financial or business results, high value R&D and exploration data, etc.\n\nIdentify emails (not individually, but as patterns, e.g. \"email sent to the executive board that discuss undisclosed financial results\"), documents and other data assets that can be considered critical data assets. This step will not be applicable for most industries and most organizations.\n\nAlso identify the optimal means for detecting such data. Data that resides in a specific document that would never be transformed into other formats or incorporated into other documents can be just labeled accordingly, so the label will always travel with the document allowing easy identification.\nContent that can be transformed into other formats or copied in part or in full in other documents but that is only valuable if present in complete or semi-complete form (e.g. some forms of source code and CAD designs or numerical data) can be detected using fingerprints with full or high percentage match.\nContent that can be transformed into other formats or copied in part or in full in other documents and that is only valuable even if only obtained in part (e.g. financial results, product plans, etc.) can be detected using either labels that don't allow for copying and which include dynamic watermarks, or via fingerprints configured for partial match.\n\n## Reference\n\n* Dynamic watermarking for sensitivity labels in Word, Excel, and PowerPoint https://techcommunity.microsoft.com/t5/security-compliance-and-identity/preview-dynamic-watermarking-for-sensitivity-labels-in-word/ba-p/4185842\n* Document fingerprinting in Microsoft Purview https://learn.microsoft.com/en-us/purview/sit-document-fingerprinting", "Checks": [] }, { "Id": "RMT_024", "Name": "Plan for the protection of Critical Assets", "AreaId": "protect-critical-assets", "Swimlane": "Critical Asset Protection", "Phase": "Next", "Priority": "P0", "Effort": "Medium", "UserImpact": "Medium", "Cisa": "Traditional", "Dependencies": [], "Icon": "RMT_024.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_024", "Doc": "## Overview\n\nFor each type of critical asset identified previously, determine the type of special data security or cryptographic needs based on the business use case, industry regulatory compliance requirements and any other applicable constraints. Plan accordingly considering the technology, process, and people aspects of the change. These can include the standard methods of protection such as DLP and sensitivity labels with usage restrictions, as well as physical access and hardware considerations, identity and device special considerations for the user accounts and devices used with the critical assets, and special cryptographic methods among others.\n\nFor documents where access must be controlled so tightly that even the risk of legitimate government requests for access, legal discovery requests, access by cloud operators or the risk of rogue admins cannot be accepted, encrypting the document with Double Key Encryption might be warranted. Keep in mind that, in addition to a high operational cost, content protected with DKE becomes entirely opaque to all cloud services, including compliance services such as DLP and eDiscovery, so the use of this functionality must be limited to the minimal set of documents that require it.\n\n## Reference\n\n* Dynamic watermarking for sensitivity labels in Word, Excel, and PowerPoint https://techcommunity.microsoft.com/t5/security-compliance-and-identity/preview-dynamic-watermarking-for-sensitivity-labels-in-word/ba-p/4185842\n* Learn about Double Key Encryption (DKE) https://learn.microsoft.com/en-us/purview/double-key-encryption", "Checks": [] }, { "Id": "RMT_025", "Name": "Protect Critical Assets", "AreaId": "protect-critical-assets", "Swimlane": "Critical Asset Protection", "Phase": "Next", "Priority": "P0", "Effort": "Medium", "UserImpact": "High", "Cisa": "Initial", "Dependencies": [], "Icon": "RMT_025.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_025", "Doc": "## Overview\n\nImplement the classifiers or labels required to detect the critical data assets identified in the previous step.\n* Fingerprint the document for which that is the optimal detection method and associate the fingerprints with classifiers.\n* Label and protect assets where that's the best method for identification. Include usage restrictions (do not copy, do not print, do not export, etc.) in the labels used for such assets, as well as dynamic watermarks where appropriate.\n\nSpecial Cryptographic methods are addressed as a separate step.\n\n## Reference\n\n* Dynamic watermarking for sensitivity labels in Word, Excel, and PowerPoint https://techcommunity.microsoft.com/t5/security-compliance-and-identity/preview-dynamic-watermarking-for-sensitivity-labels-in-word/ba-p/4185842\n* Document fingerprinting in Microsoft Purview https://learn.microsoft.com/en-us/purview/sit-document-fingerprinting", "Checks": [ "ZTA.35007", "ZTA.35009", "ZTA.35013", "ZTA.35024", "ZTA.35025", "ZTA.35026" ] }, { "Id": "RMT_026", "Name": "Evaluate and implement special cryptographic needs (BYOK, DKE)", "AreaId": "protect-critical-assets", "Swimlane": "Critical Asset Protection", "Phase": "Next", "Priority": "P3", "Effort": "Medium", "UserImpact": "High", "Cisa": "Advanced", "Dependencies": [], "Icon": "RMT_026.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_026", "Doc": "## Overview\n\nImplement special cryptographic methods offered by Microsoft if warranted by the sensitivity of the data.\nThese include Double Key Encryption (DKE) to ensure data can only be accessed by internal users with access to specific on-premises resources (at the expense of access through cloud services, including web apps, search and other functionality), and Bring your own key (BYOK) to use a key that's provisioned and managed by you for content encrypted with sensitivity labels, instead of a default key generated by Microsoft.\n\n## Reference\n\n* Double Key Encryption (DKE) https://learn.microsoft.com/en-us/purview/double-key-encryption\n* Bring your own key (BYOK) details for Azure Information Protection https://learn.microsoft.com/en-us/azure/information-protection/byok-price-restrictions", "Checks": [ "ZTA.35010" ] }, { "Id": "RMT_027", "Name": "Monitor Audit Logs for Data Access", "AreaId": "protect-critical-assets", "Swimlane": "Critical Asset Protection", "Phase": "Next", "Priority": "P1", "Effort": "Low", "UserImpact": "Low", "Cisa": "Advanced", "Dependencies": [], "Icon": "manage-data-access.svg", "Link": "https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/data/RMT_027", "Checks": [ "ZTA.35037" ] } ] } |