Use defense in depth
A strong data protection program assumes that one control can fail. A user can misclassify a file, an account can be compromised, an exception can be abused, or a detection rule can miss a new format. Layered safeguards reduce the chance that one failure becomes an uncontrolled disclosure.
The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond, and Recover. Data protection needs the same full lifecycle, not only a preventive product. See the NIST CSF 2.0 overview.
Layer 1: Governance and handling rules
Define what the organization is protecting and who makes decisions. Essential foundations include:
- a small, usable classification scheme
- approved storage and transfer methods
- owners for important data sets
- retention and deletion rules
- third-party sharing requirements
- a documented exception process
- privacy-respecting monitoring standards
Policy language must connect to a real behavior. "Protect confidential data" is too vague. "Do not send Highly Confidential customer exports to personal email" is testable.
Layer 2: Identity and least privilege
Reduce how much information an identity can reach before controlling how it leaves. Apply strong authentication, conditional access, role-based access, privileged access management, guest reviews, and timely removal of access after role changes.
Broad access creates broad leakage potential. DLP should not compensate for a site that is open to the entire organization when only one team needs it.
Layer 3: Secure collaboration and sharing
Make the safe path the easy path. Configure sensible sharing defaults, expiration for guest access, restricted anonymous links, domain allow or block rules where justified, and separate environments for highly sensitive work.
Users are more likely to bypass controls when approved collaboration is confusing or slow. Pair restrictions with a documented way to complete legitimate external sharing.
Layer 4: Classification and persistent protection
Labels communicate sensitivity and can trigger content markings, access restrictions, and encryption. Protection that stays with a file is valuable after download or forwarding, but encryption requires careful planning for external recipients, applications, discovery, and recovery.
Start with a label taxonomy and handling model. Do not begin by encrypting every internal document.
Layer 5: Data loss prevention
DLP evaluates content and context, then applies a response to an action. Responses should form a graduated ladder:
- Audit: Record the event without interrupting the user.
- Coach: Show a policy tip that explains the risk and safer action.
- Warn with override: Allow a justified exception and log it.
- Block: Prevent a high-confidence, high-impact action.
- Restrict access or protect: Limit recipients or apply protection where supported.
Use the least disruptive action that adequately reduces risk. Hard blocks are appropriate when the detection is reliable, the harm is high, and an approved alternative exists.
Layer 6: Endpoint and application control
Once data reaches a device, control high-risk actions such as upload to restricted services, copy to removable media, print, clipboard, browser paste, and transfer to network shares. Device health and management status also matter. An unmanaged or compromised endpoint can undermine repository controls.
Layer 7: Detection, investigation, and response
Collect events with enough context to answer what happened, which policy matched, what data was involved, who acted, where it was going, and whether the action succeeded. Define alert severity, triage ownership, escalation, evidence handling, and legal or privacy review.
Not every event deserves an incident. Aggregate repeated low-risk activity, focus on unusual volume or destination, and tune rules from investigation outcomes.
Layer 8: Recovery and improvement
After an event, revoke links or sessions, remove unauthorized copies where possible, rotate exposed credentials, correct permissions, notify required parties, and update the control. Track whether the failure came from policy, detection, configuration, workflow design, or user understanding.
From here, choose the platform-specific guidance that matches your environment: Microsoft 365, Google Workspace, or Sekurzen Guard. Each path applies this layered model to its supported workloads and operating model.