DLP-02: Block Bulk Data Exfiltration

DLP-02 is a security control that insider threats and ransomware attackers exfiltrate data before deploying payloads. detecting and blocking bulk data movement stops data theft in progress and provides early warning of compromise. It requires that dlp policies prevent bulk downloads of sensitive data and alerts trigger on exfiltration patterns (>1000 files or >1gb in <1 hour), automated blocking of suspicious bulk operations.

Insider threats and ransomware attackers exfiltrate data before deploying payloads. Detecting and blocking bulk data movement stops data theft in progress and provides early warning of compromise.

DLP-02 requires manual implementation. Requires Microsoft Purview DLP with advanced policies or E5 Compliance

This control requires Microsoft 365 E5 Compliance add-on or E5 licensing.

DLP-02 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.

DLP-02 is rated critical because failure to implement this control significantly increases the risk of security incidents. Insider threats and ransomware attackers exfiltrate data before deploying payloads. Detecting and blocking bulk data movement stops data theft in progress and provides early warning of compromise.