M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- High
- Pilar de Zero Trust
- Data (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.8.1 requires that a DLP solution be used, offering services comparable to the native Microsoft solution. DLP detects sensitive information in Exchange Online mail and prevents unauthorized disclosure. Without DLP, users may inadvertently or maliciously send sensitive data outside the organization with no automated detection or blocking.
Valor recomendado
At least one active DLP policy scoped to the Exchange Online workload
Remediación
Deploy a DLP solution that covers the Exchange Online mail workload and confirm at least one policy is enabled and applied. If using the native Microsoft DLP capability, create a policy in the compliance portal scoped to Exchange email. Validate that the policy is in enforce mode rather than test-only so disclosures are actually blocked.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-4, SC-7
- MITRE ATT&CK
- T1048