DLP-01: Enable Sensitive Data Classification

DLP-01 is a security control that without data classification, you cannot protect what you cannot identify. sensitivity labels enable targeted protection policies, ensuring sensitive data receives appropriate controls regardless of where it is stored or shared. It requires that microsoft purview sensitivity labels are configured and at least 3 sensitivity levels are defined (e.g., public, internal, confidential), labels are applied to sensitive data in sharepoint and onedrive.

Without data classification, you cannot protect what you cannot identify. Sensitivity labels enable targeted protection policies, ensuring sensitive data receives appropriate controls regardless of where it is stored or shared.

DLP-01 requires manual implementation. Requires Microsoft Purview license and configuration

This control requires Microsoft 365 E5 Compliance add-on or E5 licensing.

DLP-01 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.