On Data Leakage Prevention Maturity: Adapting the C2M2 Framework

Abstract

In an evolving cybersecurity landscape marked by escalating data breaches and regulatory demands, data leakage prevention (DLP) has emerged as one of several defense mechanisms. This study underscores unresolved foundational issues within DLP, revealing that it remains a significant challenge in large organizations. This highlights the necessity for a holistic approach to DLP to effectively address these persistent challenges. By developing a DLP Maturity Model, adapted from the renowned C2M2 framework, this research provides a comprehensive tool for assessing organizational DLP capabilities and pinpointing critical gaps. Applying the DLP Maturity Model within the financial sector as demonstrated through a banking scenario showcases its relevance and added value. This application illuminates the model’s effectiveness in securing sensitive data and adhering to essential regulatory standards, highlighting its adaptability across various compliance landscapes. Implementing this DLP Maturity Model in a banking scenario showcases its applicability, highlighting its ability to formulate a strategy to secure sensitive data and comply with regulatory standards. This approach aligns with the concept of a continuous risk-based strategy, merging the holistic model to identify and address critical insider risks within organizations. The study addresses a specific gap in DLP research, notably the lack of a holistic framework for assessing and enhancing DLP strategies across organizations. It equips practitioners with a foundational tool to determine current DLP maturity and devise strategies for mitigating insider-driven data breach risks, thereby bolstering organizational cybersecurity resilience.

1. Introduction

The narrative of data leakage prevention (DLP) technology has unfolded rapidly yet succinctly within the cybersecurity domain [1]. Initially, up to 2005, DLP solutions were largely niche products with minimal deployment across industries. The period between 2006 and 2009 marked a significant turning point, characterized by multimillion-dollar (USD) acquisitions. Almost every major player in the IT security market acquired firms, aiming to secure a foothold in the DLP sector [2,3,4,5,6,7]. However, despite initial expectations for a widespread DLP adoption and integration into standards, the anticipated era of dominance for DLP tools did not unfold, with very few standards explicitly recommending their use. In 2019, the narrative experienced a refined shift, with the European Banking Authority (EBA) issuing updated information and communications technology (ICT) and security risk management guidelines, now adopted across numerous European nations [8], which recognized the significance of data protection yet refrained from explicitly requiring DLP. The next shift began with the broader adoption of monitoring tools and security information and event management (SIEM) systems, leading to a resurgence in DLP discussions. Contemporary standards, notably ISO/IEC 27001 and 27002 [9,10] as of 2022, now explicitly recommend the implementation of DLP tools. The discourse around the Digital Operational Resilience Act (DORA), mandating resilience for critical sectors in Europe, further exemplifies this trend, suggesting DLP’s classification as essential according to the current perspective of the three European supervisory authorities (ESAs) [11].

Simultaneously, the frequency and severity of breaches continue to rise [12], which underscores the importance of holistic strategies in the field of DLP. However, there remains a discernible gap between employing discrete DLP tools and forging an overarching DLP strategy, underscoring the necessity of evolving from singular solutions to a holistic approach for DLP. This paper aims to bridge the existing gap by developing a DLP Maturity Model, specifically adapted from the C2M2 framework due to its proven reliability, industry-specific focus, and alignment with NIST methodologies. This model is designed for assessing DLP maturity, enabling target-actual comparisons and subsequently providing relevant information to support cybersecurity strategy development and decision-making regarding DLP.

The article makes several distinct contributions to the field of DLP.

• It highlights the importance of a holistic approach to DLP.
• It introduces a novel DLP Maturity Model, meticulously adapted from the C2M2.
• It details the application of this model within the financial sector, providing a comprehensive case study on its implementation in a banking scenario.

This study is structured into several key sections. Initially, it underscores the imperative for developing the DLP Maturity Model. It then delves into the essential definitions and themes underpinning DLP, setting the stage for a deeper exploration of DLP’s principal components and maturity frameworks. This establishes a solid grounding in the subject. Subsequently, the paper elucidates the choice of the Cybersecurity Capability Maturity Model (C2M2) for evaluating DLP maturity and details the process of tailoring C2M2 into a bespoke DLP Maturity Model. Subsequently, theresults section (Section 3) presents the findings from the model’s application in a banking context, highlighting its efficacy in identifying DLP capabilities and gaps. A key aspect of this section involves the practical application of the model, demonstrating its relevance and utility in safeguarding sensitive customer data and ensuring compliance with regulatory standards. Finally, the discussion section (Section 4) concludes by contextualizing the outcomes within the broader cybersecurity challenges, underscoring the model’s contribution to enhancing organizational data protection strategies.

2. Materials and Methods

In the development of this study, the Design Science Research (DSR) methodology as outlined by vom Brocke et al. was adopted [13]. This choice was motivated by the structured and iterative approach the methodology provides, enabling a rigorous and systematic exploration of the research problem.

To organize the iterative process and its resultant outcomes, we employed the DSR grid, shown in Figure 1, also developed by vom Brocke et al. [14]. For this reason, we have structured this chapter into the six dimensions of the DSR grid: Problem, Input Knowledge, Research Process, Concepts, Solution (referred to as Results in this paper, see Section 3), and Output Knowledge.

2.1. Problem

In the realm of DLP, while there is a substantial body of research into DLP solutions, product comparisons, and cyber security maturity models [15], a conspicuous gap is evident in the literature: the lack of a structured DLP maturity model. This gap in both academic discourse and practical guidelines has led us to the development of a bespoke DLP Maturity Model, aimed at providing a structured approach to DLP implementation and management. This facilitates a systematic and holistic assessment of an organization’s DLP capabilities, enabling the identification of areas for enhancement and strategic investment.

While it is true that skilled and experienced personnel could manage several DLP measures efficiently through ad hoc practices, it is worth noting a caveat. This approach, although less resource-intensive, might not align with the structured, documented processes typically favored by regulatory bodies. Regulators often emphasize the need for structured, replicable procedures and clear documentation for compliance purposes. Hence, while an informal method might seem advantageous in terms of effort and resource allocation, its alignment with regulatory standards and compliance needs is an aspect that warrants careful consideration.

It is therefore important to understand that DLP serves not merely as a technical safeguard but also as a financial instrument, facilitating compliance and consequently averting regulatory penalties. This is particularly interesting for participants in highly regulated markets undergoing consolidation, such as the European banking sector [16]. While regulators increasingly mandate DLP requirements, to our knowledge, there exists no official framework or process dedicated to achieving a high level of DLP maturity. Often, DLP is integrated as part of a broader security solution, which, while generally beneficial, lacks detailed guidance on developing a step-by-step holistic DLP strategy. The approach by Alsuwaie et al. [17], though one of the few cited methodologies, primarily focuses on technical solutions, leaving a gap in strategic DLP planning and implementation.

2.2. Input Knowledge

This subsection delves into the foundational knowledge utilized in the development of the DLP Maturity Model.

2.2.1. DLP Definition

In alignment with the National Institute of Standards and Technology’s (NIST) Special Publication 800-137 [18], DLP (also known as data loss prevention) in this article is defined as the detection and prevention of intentional and unintentional policy violations concerning data in transit, data at rest, and data in use. DLP encompasses a range of techniques and technologies designed to protect data across all stages, ensuring compliance with legal and regulatory standards. Primarily, it is a task within a security operations center (SOC), where outgoing data are scrutinized against specified rules to secure customer data and intellectual properties and to prevent reputational damage.

2.2.2. DLP Solutions

Initially, DLP strategies focused on monitoring network traffic and preventing unauthorized user activities [19]. Over time, there was a shift towards more centralized monitoring. Today’s DLP solutions offer comprehensive monitoring across various data channels, encompassing web traffic, print jobs, email gateways, and file transfers to USB devices. They also incorporate advanced techniques like deep packet inspection. Both endpoint clients and centralized event collection mechanisms can be utilized together [20,21].

However, these advancements still come with challenges, notably performance limitations, e.g., when deploying sophisticated filtering rules such as advanced regular expressions to endpoint clients, which can significantly impact system performance.

In addressing the diverse landscape of DLP techniques, it is essential to distinguish between the various approaches. These techniques can be broadly classified into three categories: content-based analysis, context-based analysis, and hybrid approaches. The following provides a summary of the various approaches to DLP. For comprehensive evaluations and detailed discussions of the advantages and disadvantages associated with each DLP approach, refer to the extensive analyses in the literature, e.g., [22,23].

From the realm of data science and data mining, content-based analysis focuses on methods such as data fingerprinting, lexical content analysis (including rule-based systems and regular expressions), and statistical analysis. This technique [24] is adept at detecting sensitive information across various platforms, including laptops, servers, cloud storage, and outbound network traffic. Its approach is reminiscent of early spam filter technology [25]. It aims to prevent the accidental exposure of sensitive data, whether the data are static (at rest), being used (in use), or being transmitted (in transit) ([18], D-9). While effective in scenarios where sensitive data, along with potential senders and recipients, are clearly identifiable, this approach faces challenges. It often results in a high false positive rate due to several identifiable factors: the difficulty in crafting filters that account for all edge cases, the dynamic nature of DLP rules where yesterday’s valid rule might flag false positives today, inconsistent data classification leading to misidentification, and evolving language and communication patterns that surpass the DLP system’s rule update frequency. These limitations diminish the practicality of this method for routine business operations. Furthermore, it is vulnerable to obfuscation tactics employed by attackers, as sophisticated data alteration techniques can limit its effectiveness.

Contrastingly, context-based analysis eschews direct identification of sensitive content, instead analyzing the meta information associated with data or the context surrounding them [26]. This method models normal user behaviors and detects anomalous patterns, using machine learning to identify outliers. However, a significant limitation of this approach is its potential ineffectiveness in practical, everyday scenarios. For instance, it may fail to classify an email as a data leak risk based solely on metadata, without examining the content of attachments. Such scenarios include sending emails with attachments to personal addresses, where the actual content of the attachments is crucial for an accurate assessment of data leakage risk. Additionally, the effectiveness of this approach is often hampered by a lack of comprehensive training data, which are essential for accurately identifying false positive and false negative events and for refining the detection process.

Hybrid Approaches combine both content and context analysis [27,28,29]. This method leverages the strengths of both techniques to provide a more comprehensive solution. The hybrid approach is particularly effective in identifying sensitive content, achieving higher detection accuracy than pure context-based methods.

Therefore, content-based methods typically achieve higher accuracy but are susceptible to bypassing through data obfuscation. Context-based approaches, while often not as accurate, provide a broader scope of detection by considering user behavior and data context. Hybrid methods aim to balance these aspects, offering a more robust solution to DLP.

As illustrated, the domain of DLP techniques presents a diverse array of approaches. However, it is important to recognize that each method, while effective in certain contexts, also has its limitations.

2.2.3. Persistent Challenges in DLP

Theoretical perspectives position DLP as a crucial component of a comprehensive cybersecurity risk mitigation strategy. In practice, however, the implementation of DLP systems is associated with substantial costs, not only in initial deployment but also in continuous configuration and maintenance ([30], p. 218). Although the primary focus of this article is on the technical aspects of DLP, it is imperative to acknowledge that DLP encompasses a broader spectrum of issues. These additional considerations, vital for a holistic approach to DLP, have been extensively explored in the literature [31,32]. This multifaceted nature of DLP underscores the need for an integrated strategy that extends beyond mere technical solutions to include organizational, procedural, and human factors.

At first, identifying accurate true positive events for DLP alarms is a complex and non-trivial task. It demands a comprehensive understanding of the organization’s unique context, including its various departments and operations. This process often requires an experienced DLP analyst to meticulously define a range of exceptional cases, which can be extensive and intricate. Their expertise is crucial in finely tuning DLP systems to effectively distinguish between legitimate and malicious data transactions, thereby ensuring both security and efficiency.

Secondly, the task of establishing effective thresholds to minimize false positives in DLP systems presents a significant challenge, arguably more complex than defining true positives. Security teams are often caught in a difficult balancing act: on one hand, they can set less sophisticated filters, which, while reducing the number of false positives, run the risk of missing genuine threats (a high-risk appetite). On the other hand, they face the Base-Rate Fallacy [33], a well-documented phenomenon in intrusion detection systems that is equally relevant to DLP. This fallacy highlights the difficulty in accurately detecting rare events in a sea of non-events, leading to a high volume of false positives.

Configuring an efficient DLP rule set for identifying both true and false positive events is a complex and nuanced process, especially in varied email-based scenarios. For instance, consider the case where employees send sensitive documents to personal email addresses. While this might initially appear as a straightforward true positive, the reality can be more complex. Many organizations, aiming to save on postal costs, routinely send encrypted emails to employees’ personal addresses or have documents sent to business emails which are then forwarded or printed out. Further complicating matters, specific sectors like banking might regularly send sensitive, encrypted data to clients, such as wealthy private customers requesting encrypted Excel files. Additionally, human resources departments frequently exchange sensitive information with a large and diverse pool of applicants.

While technological solutions exist for these scenarios—like exact data matching for identifying large volumes of sensitive data, OCR for text recognition in scanned documents, allow-lists for different departments, and encryption gateways and deep packet inspection for analyzing encrypted traffic—the maintenance and continuous adjustment of a DLP rule set to accurately differentiate between legitimate and illegitimate data transfers is immensely challenging. The effort required to effectively manage, investigate, and handle both true and false positives in such dynamic environments can be substantial, reflecting the intricate balance between robust data protection and operational practicality.

In current practice, managing the complexities of DLP policies typically requires considerable effort, with most organizations facing a trade-off. Either they accept a higher risk of false negatives or adopt a conservative approach that leads to numerous false positives, necessitating significant investment in DLP. This situation highlights the need for more efficient DLP strategies that can balance these challenges effectively.

2.2.4. Impact of Large Language Models on DLP and Future Trends

The limitations of traditional DLP methods in large corporate settings are recognized and understood [1,22,34,35]. Extensive research has addressed specific aspects of DLP (among others [28,36,37,38,39]), yet a comprehensive solution to its complex practical challenges remains elusive. This gap underscores a significant opportunity for future exploration into the potential of large language models (LLMs) to revolutionize DLP strategies in dynamic business contexts. While recent studies have explored the use of LLMs in detecting phishing attacks [40], there is a notable absence of research on applying LLMs to DLP.

The prospective utility of LLMs in DLP remains speculative, yet their emerging capabilities suggest significant untapped potential. The current absence of LLMs from established DLP maturity frameworks is defensible, considering the technology’s incipient stage of development and application in this domain. Nevertheless, the prospective integration of LLMs promises to be transformative, potentially streamlining DLP operations and reducing costs. In the preliminary phase, organizations might explore the support of LLMs to augment DLP analysts’ capabilities in sophisticated data interpretation, which could lower the financial and logistical thresholds for attaining advanced DLP maturity. Close observation of these developments is imperative, as they may assist organizations in attaining elevated DLP maturity levels with diminished financial outlay.

2.3. Literature Research

A well-executed literature review should elucidate the subject matter, offering a comprehensive understanding of the topic at hand. Such an effective review establishes a solid groundwork, crucial for the progression of knowledge within the field, underscoring the pivotal role of literature reviews in academic research [41]. Furthermore, the essence of a literature review is unmistakably defined by the necessity to exclude a vast array of works during the search process ([42], p. 114), highlighting the discerning nature of scholarly research.

To construct a Maturity Model for the field of DLP, an in-depth understanding of DLP was indispensable. This constituted the initial phase of our literature research, aiming to lay a foundational comprehension that would underpin the entire model development process. Subsequently, the second phase of our literature exploration focused on identifying frameworks capable of assessing the maturity of a DLP infrastructure.

2.3.1. DLP Literature Review

A meticulous literature review was conducted with the primary objective of obtaining a profound understanding of DLP. This deep comprehension is essential for the development of a DLP Maturity Model, as it lays the groundwork for identifying and integrating the critical elements that define the maturity of DLP practices and technologies.

DLP represents a mature area of inquiry, characterized by a significant accumulation of research. This existing body of work necessitates a structured approach to literature review, as advocated by Webster and Watson [41].

The initial step in this structured approach involved querying knowledge databases using specific search terms, as detailed in

Table 1. Knowledge databases queried.

	Web of Science	IEEE Xplore	Science Direct	Wiley
Search Term	“Data Leakage Prevention” OR “Data Loss Prevention” OR “Information Leakage Prevention” OR “Data Leakage Detection”	“Data Leakage Prevention” OR “Data Loss Prevention” OR “Information Leakage Prevention” OR “Data Leakage Detection”	(“Data Leakage Prevention”) OR (“Data Loss Prevention”) OR (“Information Leakage Prevention”) OR (“Data Leakage Detection”)	“Data Leakage Prevention”, “Data Loss Prevention”, “Information Leakage Prevention”, “Data Leakage Detection”
Search Fields/Topics	Topic Information Security, IT Security, Awareness	Information Leakage, Information Security, Data Leakage Prevention	Title, Abstract or Author-Specified Keywords	Title or Abstract
Additional Requirements	Articles, Proceeding Papers, Review Articles, Conference Papers	Conferences, Journals	Research Articles, Review Articles	-
Hits	164	107	27	1
Hits with >5 citations	44	31	16	1

. This process ensured that the literature review was comprehensive and aligned with our research objectives. Following this initial step, our focus was directed towards grasping the broader landscape of DLP, rather than delving into niche topics. With the aim of ensuring that the review encapsulated widely recognized and influential studies, we made a deliberate decision to exclude results that had five or fewer citations. This criterion was applied to concentrate our efforts on contributions that have garnered academic attention and have thus played a substantial role in shaping the understanding of the DLP domain.

Subsequently, we undertook the task of removing duplicates, thus refining our collection of sources. This step was critical for maintaining the quality and relevance of the literature under review, enabling a focused examination of the field that supports the construction of a robust DLP Maturity Model. We imposed several additional constraints to align more closely with our research focus and to ensure the relevance and quality of the sources considered. Firstly, we opted to exclude studies related to blockchain technologies. Despite the growing interest in this area, there is a discernible absence of practical, implementable proof-of-concept projects within the entire cybersecurity domain utilizing this technology. Furthermore, we disregarded ideas and theories presented without a prototype and those of a purely speculative nature. Additionally, any literature that did not demonstrate relevance for the practical application of DLP was omitted. This included highly technical works that delved into specifics such as highly sophisticated exfiltration techniques. Lastly, topics centered on key management, access management, and digital rights management (DRM) were also set aside. While these areas are crucial to the broader field of information and access management (IAM), they do not directly address the nuances of detecting policy violations.

Through these judicious exclusions, our literature review concentrated on sources that offer substantive contributions to the understanding and advancement of DLP, ensuring that our research is both comprehensive and focused. After applying these criteria, 51 papers were reviewed.

In line with best practices in conducting literature reviews [41,43], a backward search was conducted, yielding over 900 additional papers. The same stringent criteria previously outlined were applied to these findings. Ultimately, this rigorous selection process culminated in a consolidated corpus of 128 papers, forming the foundation upon which the insights presented in this work are based.

Initial attempts to organize the findings within a Concept Matrix (as proposed by [41,43]) were not conducive to selecting an appropriate maturity framework. Therefore, we shifted our strategy to employ a concept graph, a method supported by both Wolfswinkel et al. [44] and Webster and Watson. [45], to better synthesize and visualize the research outcomes. Figure 2 shows this process, providing a comprehensive visual summary of the knowledge synthesized.

2.3.2. Selection of an Appropriate Maturity Model

In contrast to the initial DLP focus, our intention was not to compile an exhaustive theoretical overview of potential frameworks. Instead, the aim was to glean a comprehensive survey of well-established frameworks within the domain. Adhering to the methodology proposed by vom Brocke et al. [46], a sequential search for representative literature using a keyword-based approach was conducted. This strategy enabled the identification of frameworks that have been recognized for their applicability and effectiveness in organizational cybersecurity contexts.

A multitude of papers have been identified comparing various maturity models, such as [47,48,49]. Systematic literature reviews in the field were also examined, including the work of Rabii et al. [15].

The outcome of the literature research reveals that, while frameworks such as the NIST CSF 2.0 and the ISO/IEC 27002 standard [10] can be employed as maturity frameworks, they are not purpose-specific to maturity assessments. Frameworks with substantial practical application in industry, including ISO 21827 [50], C2M2, CMMI, and CMMC, have been recognized for their utility and adoption in the field.

2.4. Concepts

In the following, pivotal concepts underpinning the study are delineated. They describe the selection of the C2M2 and the creation of the DLP Maturity Framework.

2.4.1. Selection of a Suitable Maturity Framework

Leveraging an existing model proved advantageous due to its well-established nature, reducing the likelihood of overlooking crucial aspects. Established models not only come with extensive literature and practical examples but also with supporting tools for implementation and documentation, thus offering a solid foundation for a DLP Maturity Model.

After careful comparison, as detailed in

Table 2. Comparison of maturity frameworks.

	C2M2	ISO/IEC 21827	CMMC	CMMI
Update Frequency	Regular updates to align with evolving cybersecurity threats.	Last updated in 2008.	Regularly updated.	Regularly updated.
Industry Focus	Broad and adaptable to different sectors, making it suitable for a wide range of industries.	Broad and adaptable to different sectors, making it suitable for a wide range of industries.	Primarily for U.S. Department of Defense contractors, limiting broader applicability.	Broad but restricted due to accessibility.
Standards Compatibility	Highly compatible with NIST’s methodologies, ensuring a comprehensive and synergistic approach.	Compatible with the ISO ISMS approach.	Oriented towards suppliers and their cybersecurity maturity.	Unknown due to limited accessibility.
Proven Track Record	Well-established with a proven track record of reliability and effectiveness in various sectors.	Lacks extensive scientific implementation experiments due to its last update in 2008.	Track record for third-party security audits.	Maturity levels from this framework are well-established. The rest has restricted applicability due to limited accessibility. Further materials have a restricted applicability due to limited accessibility.

, we selected the Cybersecurity Capability Maturity Model (C2M2). This model was chosen for its synergistic alignment with the methodologies of NIST and its own comprehensive scope.

While considering other models, C2M2 emerged as the most fitting due to several factors. ISO/IEC 21827 [50], though significant, is somewhat dated, having not been updated since 2008. The Cybersecurity Maturity Model Certification (CMMC), heavily oriented towards the U.S. Department of Defense, presents limitations in a broader industrial context. In contrast, ISACA’s CMMI, not being publicly accessible, restricts its applicability. The popularity and well-established nature of C2M2, as indicated in [49], offer a proven track record of reliability and effectiveness crucial for a robust DLP maturity framework.

Moreover, the absence of extensive scientific implementation experiments for many models, noted in [15], necessitated a choice that best aligns with DLP’s unique demands. The historical reliability and experience offered by C2M2, coupled with its adaptability to specific sector needs, make it a suitable model for this purpose. The adaptation of general models to specific cybersecurity challenges, such as incident management as mentioned in [51], further reinforces the practical and academic viability of tailoring C2M2 for DLP.

In summary, the selection of C2M2 for DLP in critical infrastructures is justified by its industry-specific focus, detailed cybersecurity practices, modular structure, and compatibility with other standards. Its practical orientation, implementation focus, and proven track record make C2M2 an ideal choice for organizations seeking a robust, adaptable, and effective approach to data leakage prevention.

2.4.2. Adopting the C2M2

In the C2M2, maturity indicator levels (MILs) delineate the maturity of cybersecurity practices across a spectrum. The MILs serve as a yardstick to:

• Define the organization’s current state of DLP maturity.
• Determine the future, more mature state the organization aspires to reach, effectively guiding a gap analysis between the current and target cybersecurity postures.
• Identify specific capabilities and improvements needed to advance to that future state, providing a roadmap of actionable steps for progression.

MIL0 indicates no implemented practices, while MIL1 represents initial, potentially ad hoc efforts. MIL2 shows practices that are documented and resourced, becoming more refined than MIL1. MIL3 signifies advanced practices that are policy-driven and evaluated for effectiveness, an enhancement over MIL2. Furthermore, MIL3 institutionalizes a culture of continuous improvement, where activities are systematically tracked and quantifiably assessed, enabling both the immediate evaluation of DLP effectiveness and the long-term enhancement of the information security strategy.

The MILs are adapted for the DLP Maturity Model to provide an analogous structured assessment for DLP practices. As shown in Figure 3, these levels were integrated to define the progression from non-existent DLP measures (MIL0) through to a mature state of advanced DLP practices.

MILs are not merely a measure of adherence to standards but are indicative of an evolutionary growth in managing and safeguarding sensitive data. They enable organizations to set realistic goals and prioritize efforts to enhance their DLP maturity, all while offering a framework to benchmark against industry peers.

Aiming for MIL2 is recommended for robust cybersecurity, while MIL3 is the mark of excellence and should be pursued as part of a risk-based approach.

In both the C2M2 and the adapted DLP Maturity Model, there are domains that categorize high-level aspects. Within these domains, there are specific objectives that represent targeted goals. The described MILs are used to assess the attainment of these objectives.

The adaptation of the C2M2 to a DLP Maturity Model involved a meticulous, three-step process, ensuring that each domain aligned with the specific nuances of DLP.

Step 1: Domain Relevance Assessment. Domains in the context of the C2M2 model refer to specific areas of focus within the broader scope of cybersecurity. Each domain of the C2M2 model was rigorously evaluated for its applicability to DLP. This evaluation led to strategic decisions on the inclusion or exclusion of certain domains, as detailed in

Table 3. Evaluation of C2M2 domains for applicability to the DLP Maturity Model.

Domain	Analytical Justification for DLP Relevance	DLP Related
ASSET	Asset management’s crucial role in identifying and protecting sensitive data-bearing assets forms a foundational component of comprehensive DLP strategies.	Yes
THREAT	This domain, while pivotal in threat and vulnerability identification, does not engage directly with DLP’s specific operational methodologies.	No
RISK	Integral for establishing a risk mitigation framework, it indirectly supports DLP by identifying and assessing risks pertinent to data leakage.	Yes
ACCESS	In the context of policy breach via data exfiltration, the domain’s direct involvement in operational DLP processes is considered minimal.	No
SITUATION	This domain’s emphasis on operational security and threat intelligence monitoring is vital for the early detection of potential data exfiltration, aligning with DLP objectives.	Yes
RESPONSE	Its focus on responding to cybersecurity incidents, including data breaches, aligns this domain closely with the reactive component of DLP.	Yes
THIRD PARTIES	The management of third-party risk is essential for comprehensive data security but does not intrinsically involve the operational specifics of data leakage prevention. This premise is based on the assumption that policies of an organization are uniformly applicable to both internal and external systems.	No
WORKFORCE	The development of a cybersecurity-aware culture and skilled personnel supports DLP through enhanced adherence to data security protocols.	Yes
ARCHITECTURE	This domain is directly aligned with DLP, encompassing the implementation of specific controls, including data exfiltration prevention mechanisms.	Yes
PROGRAM	Provides strategic oversight and governance for cybersecurity initiatives, including DLP, ensuring comprehensive management of cybersecurity risks.	Yes

. Our evaluation revealed that no additional domains needed to be incorporated into the DLP Maturity Model. This is due to the C2M2 already encompassing a comprehensive breadth of cybersecurity aspects, adequately covering the scope required for an effective DLP Maturity Model.

Step 2: Objective Analysis. The objectives within each selected domain were then scrutinized. In this process, objectives were aligned with the elements depicted in the concept graph (Figure 2). Those directly corresponding to a node within the graph were retained. Conversely, objectives lacking relevance to the elements depicted in the concept graph were discarded, ensuring that the framework’s focus remained tightly aligned with DLP concerns. This alignment led to the addition of specific, DLP-relevant technical details within certain domains, notably within the ARCHITECTURE domain, to address any identified gaps. The meticulous mapping of objectives to the concept graph, distinguishable by different colored nodes in Figure 2, underscores our methodical approach to refining the framework for DLP applicability. Figure 4 illustrates the process and the adjustments made in detail.

Step 3: MILs Adjustment and Enhancement. A critical examination of the MILs within each objective followed. This involved tailoring each level (MIL1 to MIL3) to reflect the DLP context. The process included supplementing additional points to ensure a DLP-specific focus, especially in domains like ARCHITECTURE, where technical solutions are paramount. In this endeavor, among others, ISACAA’s best practices for DLP [52] were used as a reference, supplemented by professional judgment, to determine the appropriate placement of these enhancements within the MIL structure. These adaptations can be found in Appendix A.1.

2.5. Output Knowledge

To adhere to the constraints of this paper’s scope, the objectives have been relegated to Appendix A.1. These can now be employed to conduct a DLP Maturity Assessment.

3. Results

This section describes the results of implementing the DLP Maturity Model in a banking environment, emphasizing the completion of our work and the practical outcomes derived from applying the model. In the banking context, DLP plays a pivotal role in safeguarding sensitive customer information, as well as in meeting compliance standards. This case study serves to illustrate the structured application of the DLP Maturity Model in evaluating and enhancing the institution’s current DLP practices. It also provides a methodical approach for assessing the maturity level of these practices and gauging the bank’s overall capability to prevent data leakage.

The analysis results in a comparative review between the current state and desired targets of DLP practices. This comparison then informs further actions within the bank’s risk-based cybersecurity strategy, ensuring continuous improvement and alignment with regulatory requirements and best practices in data protection.

The implementation and evaluation of the DLP Maturity Model follows the structured approach outlined in the C2M2.

It should be taken into consideration that high-quality outcomes may be achieved with experienced and talented personnel even if practices are ad hoc.

3.1. Practical Implementation and Evaluation: Performing a Self-Evaluation

In the self-evaluation process utilizing our adapted DLP Maturity Model, each domain is assessed sequentially. Within each domain, objectives are evaluated individually. For every objective, the achievement of each MIL is contingent upon the responses given to the practices within that MIL and all preceding MILs.

A practice is considered Fully Implemented (FI) when it is complete and Largely Implemented (LI) when it is complete with some opportunities for improvement noted. Conversely, a practice is marked as Partially Implemented (PI) if incomplete with multiple improvement opportunities and Not Implemented (NI) if the practice is not performed at all by the organization. To achieve a particular MIL, all practices in that MIL, as well as those in all preceding MILs, must receive responses of either FI or LI. For instance, achieving MIL2 requires that all practices in both MIL1 and MIL2 are rated as either FI or LI. This stringent criterion ensures that each level of maturity is thoroughly and accurately assessed, reflecting a true picture of the organization’s DLP capabilities.

3.1.1. Case Study: Implementing the Self-Evaluation in the SITUATION Domain

The process of self-evaluation is exemplified through the SITUATION domain, chosen for its comprehensive coverage of diverse DLP-related topics. This analysis utilizes the Objectives of the SITUATION domain, detailed in Appendix A.1.3, encompassing:

• Perform DLP Logging;
• Perform DLP Monitoring;
• Establish and Maintain Situational Awareness for DLP;
• Management of Activities in the SITUATION Domain.

In the Perform DLP Logging scenario, as detailed in

Table 4. Assessment Outcome: The bank achieves MIL3 in this objective, as evidenced by the comprehensive implementation of objectives across MIL1, MIL2, and MIL3, with each objective meeting at least a Largely Implemented status.

Objective 3.1: Perform DLP Logging
MIL		Description	Outcome
MIL1	a	Logging occurs for sensitive data, at least in an ad hoc manner.	FI
MIL2	b	Logging is implemented for assets that contain sensitive data.	LI
	c	Logging requirements are established.	LI
	d	Logging requirements are set for network and host monitoring (e.g., web proxies, e-mail gateways, print-monitoring on endpoint-clients).	LI
	e	Log data are aggregated and accessible for DLP analysts.	LI
MIL3	f	Logging is enforced for assets with higher data leakage risk priorities (e.g., for data at rest and data in use).	LI

, the assessed bank showcases robust capabilities. This is primarily attributed to the integrated use of SIEM and DLP systems, which facilitate immediate and effective logging. For MIL2 and MIL3 requirements, the status is Largely Implemented, a strategic decision based on the financial impracticality of achieving 100% client coverage. This was deemed disproportionate to the risk mitigation achieved. The risk of a few machines not reporting to SIEM was, therefore, an accepted compromise. The outcome was the achievement of at least Largely Implemented status across all MIL stages, so the bank reached MIL3. This outcome is visually represented in Figure 5, particularly at point 3.1 Perform DLP Logging, indicating a peak at MIL3.

For the Perform DLP Monitoring objective, as outlined in

Table 5. Assessment Outcome: The bank achieves MIL2 in this objective, as evidenced by the comprehensive implementation of objectives (Fully Implemented, Largely Implemented) across MIL1 and MIL2 but not MIL3.

Objective 3.2: Perform DLP Monitoring
MIL		Description	Outcome
MIL1	a	Log data or alerts from the monitoring infrastructure are reviewed, at least in an ad hoc manner.	FI
MIL2	b	Requirements for DLP monitoring are established and maintained.	LI
	c	Enhanced rule sets are configured to trigger alerts when a potential data leakage attempt is discovered.	LI
	d	Monitoring activities are aligned with the organization’s risk-based security approach.	LI
MIL3	e	Enhanced monitoring is enforced for assets with higher data leakage risk priorities.	LI
	f	The DLP rule set undergoes periodic evaluation and updates, integrating insights from incident responses and false-positive alert assessments.	PI
	g	Adjustments to the DLP rule set can be executed on short notice if required.	NI

, the bank’s evaluation reveals that objectives at MIL1 and MIL2 levels are at least Largely Implemented, ensuring these levels are met. However, structural constraints impede the adjustment of the DLP rule set. Due to potential extensive impacts on IT operations and the absence of a dedicated test infrastructure, any changes would require high-level management risk acceptance. Consequently, this aspect is classified as Not Implemented. Furthermore, regular reviews of the DLP rule set are not conducted; only ad hoc corrections are made when absolutely necessary, warranting a classification of Partially Implemented. Given that not all objectives at MIL3 are at least Fully or Largely Implemented, the bank’s performance in this area is assessed as MIL2.

In the assessment process, as illustrated in

Table 6. Assessment Outcome: The bank achieves MIL2 in this objective, as evidenced by the comprehensive implementation of objectives (Fully Implemented, Largely Implemented) across MIL1 and MIL2 but not MIL3.

Objective 3.3: Establish and Maintain Situational Awareness for DLP
MIL		Description	Outcome
MIL1		No practice at MIL1.	-
MIL2	a	Methods for communicating the current state of DLP are established and maintained.	FI
	b	KPIs relevant to DLP are collected for operational state awareness.	LI
MIL3	c	KPIs and thresholds for the rule sets are established and harmonized with leadership and stakeholder requirements.	NI
	d	Internal data crucial for DLP activities (e.g., employee terminations) are methodically collected and processed, leading to (ad hoc) modifications in the rule set as necessary.	NI
	e	Predefined operational states, such as Triage and Incident Escalation, are meticulously documented and activated in response to incoming alerts.	FI

and

Table 7. Assessment Outcome: The bank achieves MIL2 in this objective, as evidenced by the comprehensive implementation of objectives (Fully Implemented, Largely Implemented) across MIL1 and MIL2 but not MIL3.

Objective 3.4: Management of Activities in the SITUATION Domain
MIL		Description	Outcome
MIL1		No practice at MIL1.	-
MIL2	a	Documented procedures are established, followed, and maintained for activities in the SITUATION domain.	FI
	b	Adequate resources (people, funding, and tools) are provided to support activities from the SITUATION domain.	LI
MIL3	c	Up-to-date policies define requirements for activities from the SITUATION domain.	PI
	d	Responsibility, accountability, and authority for the performance of activities in the SITUATION domain are assigned to personnel.	PI
	e	Personnel performing activities in the SITUATION domain have skills and knowledge needed to perform their assigned responsibilities.	FI
	f	The effectiveness of activities in the SITUATION domain is regularly evaluated and tracked.	FI

, a consistent methodology was applied. It was observed that the MIL1 level in both instances was deemed not applicable, thus defaulting to achieved status. The criteria for MIL2 were confidently met. However, certain objectives at the MIL3 level were either not achieved or only partially fulfilled. Consequently, both tables reflect an attainment of only the MIL2 level.

The achieved MILs across the four tables are traceable in Figure 5, specifically detailed under objectives 3.1 to 3.4. This visualization aids in comprehending the MIL outcomes in a consolidated and clear manner.

Finally, an overarching assessment was conducted for each domain across all tables, establishing a comprehensive MIL for each domain. This was achieved by first aggregating all MIL1 objectives from the four tables. The outcome showed that two objectives were fully implemented, while two were not applicable, reflecting the No practice at MIL1 status.

For MIL2, a cumulative count across all four tables yielded 11 objectives, with nine being fully implemented and two largely implemented, indicating that MIL2 was at least achieved.

When considering MIL3, all 11 objectives from the four tables were tallied. The results were three fully implemented, two largely implemented, three partially implemented, and three not implemented objectives. Due to the presence of partially implemented and not implemented ratings, MIL3 was not attained.

Therefore, the domain-wide MIL for the entire SITUATION domain was determined to be Level 2. This comprehensive assessment can be visualized in the management dashboard shown in Figure 6 under the SITUATION domain.

3.1.2. Synthesizing Outcomes across Domains

The detailed outcomes of our use case are visually presented in a management dashboard in Figure 6. This illustration provides an in-depth view of the results obtained from applying all domains from the DLP Maturity Model in our specific scenario.

3.2. Analyze Results

After self-evaluation, the organization will thoroughly analyze the results to pinpoint significant gaps in its DLP practices, adopting a risk-based approach. A detailed fulfillment of each objective might lead to an overload of information on a top-management level, so a management summary like the one provided in Figure 5 will suffice, providing a concise overview of the key findings.

It is crucial to acknowledge that attaining the highest level of maturity, MIL3—Fully Implemented, is not always necessary or optimal for every organization. Due to the fact that the necessity of reaching MIL3 should be carefully weighed against the potential risks and the specific context, the organization should tailor its DLP maturity goals to align with its own risk appetite and business objectives. This leads to the formation of a target profile, which represents the desired capability level across the various domains, ensuring a balanced and effective approach to DLP that is customized to the organization’s specific needs and circumstances.

3.3. Prioritize, Plan, and Implement

After analyzing the result, the organization must undertake the crucial steps of prioritizing, planning, and implementing actions to achieve the desired maturity levels. This process begins with prioritizing actions based on several factors: the impact of the identified gaps on business objectives, the relevance of supported business functions, the costs associated with implementing necessary practices, and the availability of resources. This prioritization process should be guided by both the organization’s immediate needs and its long-term strategic goals, ensuring that efforts are directed towards areas of greatest impact and value.

Upon formulating these plans, the next critical phase is their implementation. This phase demands focused efforts to operationalize the strategies laid out in the plans. Implementation might involve deploying new technologies, revising policies, conducting training programs, or other actions as dictated by the plan.

3.4. Continuous Improvement

Regular reviews and reevaluations are an integral part for continuous improvement. These periodic assessments ensure that the organization’s DLP practices are not only aligned with the current business, technology, and threat landscapes but also adaptable to their evolution over time. By continuously monitoring the effectiveness of implemented practices and being responsive to changing circumstances, organizations can maintain a robust and effective DLP posture that consistently aligns with their evolving business objectives and risk profiles.

4. Discussion

4.1. Limitations

This paper acknowledges certain limitations inherent in the field of DLP. Firstly, the challenge of evidence-based security in cybersecurity [54], particularly in practical contexts, is notable. DLP frameworks and organizational strategies, typically shrouded in confidentiality, pose a barrier to developing an evidence-based approach. This lack of transparent evidence may hinder the continuous evolution and validation of DLP practices. Secondly, while the DLP Maturity Model addresses a broad spectrum of potential threats, it may not fully encompass data leakage by highly-obfuscated cyberattacks, like [55,56,57]. Such sophisticated threats require a level of detection and response beyond the scope of most existing DLP solutions and might also be seen as part of SIEM or advanced anti-virus tools. This limitation suggests the need for ongoing refinement of DLP strategies to adapt to evolving and increasingly concealed cyber threats.

4.2. Further Work

Our meticulous analysis and adaptation of the C2M2 have culminated in the development of a structured approach to evaluate and enhance DLP practices across various organizational contexts. It has been demonstrated that an effective utilization of C2M2 is not only possible but also beneficial in creating a more robust DLP framework. The DLP Maturity Model’s effectiveness in providing a clear, gradational assessment from initial to advanced DLP practices aligns with our research question regarding the added value of a tailored C2M2 framework in DLP. Our findings confirm that the DLP Maturity Model, built upon the adapted C2M2 framework, significantly contributes to the realm of DLP by offering a comprehensive pathway for organizations to evolve from initial, ad hoc efforts to a mature, policy-driven level of data protection. In practice, the application of this model within a banking context has underscored its utility in safeguarding sensitive data and ensuring compliance with regulatory standards. The model serves as both a current assessment tool and a guide for future enhancements in DLP practices, indicating its potential to shape organizational strategies towards a more aligned approach with broader business objectives and risk appetites.

Looking ahead, this model lays the groundwork for future research and development in DLP strategies, particularly in aligning them with evolving business needs and cybersecurity landscapes. Establishing a DLP target profile that reflects an organization’s preferred capability level across multiple cybersecurity domains is a key step towards a more secure digital future.