A confidential customer contract is stored in Microsoft 365. An employee shares it with an external partner, another colleague asks an AI assistant to summarise it and a connected application uses the content within an automated workflow.
Each action may support a legitimate business need. Together, however, they raise questions that many organisations cannot answer confidently. Who owns the information? Who should have access? Which protections should remain attached to it? Can the organisation identify inappropriate use without obstructing routine work?
This is the central challenge of a modern data security strategy. Information moves between people, applications and services as part of normal operations. Protecting it cannot mean preventing that movement altogether. The objective is to maintain appropriate control as data is created, accessed, shared, processed and eventually deleted.
An effective data security strategy identifies the information that matters, assigns accountable owners and applies proportionate controls throughout its lifecycle. It connects discovery, access, information protection, monitoring, data loss prevention and governance so organisations can use cloud collaboration and AI without accepting unmanaged exposure.
This guide presents six practical pillars for doing that. For each pillar, it explains the leadership question that needs an answer, the action required, the people who should contribute and the evidence that can show whether security is improving.
A data security strategy is an organised approach to protecting information against inappropriate access, use, disclosure, alteration or loss. It connects business priorities with information ownership, security controls and continuing assurance.
Technology forms part of the strategy, but technology alone is not the strategy. Organisations also need to decide which information matters most, who is authorised to make decisions about it and how exceptions will be handled. They must establish how leaders will know whether the controls remain proportionate and effective.
Four closely related disciplines contribute to this work:
These disciplines should reinforce one another. Security controls are more effective when information has a clear owner. Governance decisions are stronger when they reflect privacy and compliance requirements. Compliance evidence is more credible when it shows that controls operate in practice rather than existing only as written policies.
For personal data, the Information Commissioner’s Office states that organisations must use appropriate technical and organisational measures. The required level of security should reflect the nature, scope, context and purpose of the processing as well as the likelihood and severity of the associated risks. Its guidance also stresses that there is no single set of security measures suitable for every organisation. Read the ICO’s guide to data security.
The most useful starting question is therefore not, “Which security product should we deploy?” It is: How can our organisation protect sensitive information across cloud, collaboration and AI while keeping the business productive?
CyberOne’s six-pillar framework organises the decisions and activities required to answer that question. It is a practical model rather than a formally mandated industry standard.
| Pillar | Leadership Question | Practical Output | Typical Accountable Owner | Evidence Of Progress |
|---|---|---|---|---|
| Discovery and classification | What information matters and where is it? | Prioritised inventory and classification scheme | Business information owner with security and data teams | Coverage of priority repositories and assigned ownership |
| Identity and access | Who should be able to access it? | Access rules, reviews and exception process | Information owner with identity or IT operations | Overdue reviews, excessive permissions and stale access |
| Information protection | How should protection follow the information? | Handling standards, labels and protection policies | Information owner with security and compliance | Protection coverage and unresolved exceptions |
| Monitoring and investigation | How will we identify and investigate misuse? | Monitoring priorities and response responsibilities | Security operations with HR, legal and privacy input where appropriate | Investigation times and completion of corrective actions |
| Data loss prevention | How will we govern inappropriate data movement? | Tested DLP policies and managed exceptions | Security and compliance with business process owners | Policy events, false positives and business disruption |
| Governance and lifecycle management | Who owns risk throughout the lifecycle? | Retention rules, ownership and assurance reporting | Information governance and business leadership | Overdue actions, unowned repositories and unresolved decisions |
The framework is deliberately operational. Tools can discover data, apply policies and produce alerts. People still need to decide what matters, interpret the evidence and remain accountable for the outcome.
The first leadership question is straightforward: What information matters and where is it?
Organisations often store priority information across Microsoft 365, cloud platforms, SaaS applications, file shares, endpoints and legacy repositories. Copies accumulate as employees collaborate, migrate systems or create local working versions. Some repositories remain visible long after their original purpose has ended.
Without sufficient visibility, leaders cannot determine which information requires stronger protection or where the most material exposure exists. Discovery should therefore focus on business value and sensitivity rather than trying to catalogue everything with equal urgency.
A practical programme can begin with customer records, contracts, financial information, intellectual property or another clearly defined information set. The organisation should identify where the information resides, which business process it supports and who is authorised to make decisions about it.
Classification then gives the organisation a consistent language for expressing sensitivity. A manageable scheme is usually more useful than a highly detailed one that employees do not understand. Each category should connect to practical handling expectations, such as whether information may be shared externally, whether additional protection is required and when approval is needed.
For example, an organisation could begin with customer contracts in one business function. It could identify the main contract library, assign an accountable business owner and classify the documents before expanding the approach to other teams or repositories.
CyberOne’s guide to data security visibility explores how discovery, ownership, permissions and data movement contribute to a clearer understanding of organisational exposure. Its guide to Data Security Posture Management considers how organisations can use that visibility to prioritise data risk across cloud, SaaS and AI environments.
Once an organisation understands which information matters, the next question is: Who should be able to access it?
Access should reflect a current business need. This requires more than authenticating users successfully. Organisations must consider direct permissions, group membership, privileged roles, guest access, external sharing and permissions granted to applications or AI agents.
Access often becomes excessive gradually. Employees move between teams but retain their former permissions. Contractors finish assignments while guest accounts remain active. Project groups continue to exist after the work has ended. Applications receive broad permissions for a short-term requirement that nobody later reassesses.
Least privilege provides a useful principle: people and applications should receive the access needed for an authorised purpose, for as long as that need remains valid. Applying the principle requires an operating process rather than a one-off clean-up.
Joiner, mover and leaver procedures should update access when employment or responsibilities change. Access reviews should focus on repositories where inappropriate access could create material business, privacy or regulatory consequences. External sharing and privileged access require explicit ownership because technical administrators may not know whether a person still has a legitimate commercial need.
AI makes this work more urgent. An AI assistant may help an authorised user find and combine information more efficiently. If the underlying information is overshared, the AI experience can make that existing exposure easier to discover. AI-enabled SaaS products and agents may also operate through application identities and permissions that differ from an employee’s direct access.
The Microsoft Entra product family spans identity, access, governance and security. Microsoft Entra ID provides cloud-based identity and access management, while Microsoft Entra ID Governance supports automated access requests, assignments and reviews. Microsoft Entra Workload ID addresses identities used by applications, services and containers. Review Microsoft’s overview of the Entra product family.
CyberOne’s article on mapping AI exposure across Microsoft 365, SaaS and third parties provides a practical discussion of user identities, application permissions, connected repositories and the locations in which AI-generated outputs may be stored or shared.
For the contract example, the organisation should review whether former project members, outdated groups or external guests can still access the library. It should also consider whether connected applications have broader access than their approved purpose requires.
The third question is: How should protection follow the information?
Classification becomes valuable when it changes how information is handled. A confidential document may require restrictions on external sharing, defined access conditions or encryption. Less sensitive material may need fewer controls so that employees can collaborate without unnecessary friction.
Information protection should address data in three broad states:
Encryption is important, but it is not a complete answer. It can protect information against certain forms of unauthorised access or interception. It does not necessarily stop an authorised user or application from mishandling information it can legitimately read.
Protection therefore needs to reflect both sensitivity and intended use. Sensitivity labels, encryption and sharing restrictions can contribute to this model, but their value depends on clear classification standards and appropriate configuration.
Microsoft Purview Information Protection is documented as a set of capabilities that helps organisations discover, classify and protect sensitive information. Its documented capabilities include sensitive information types, trainable classifiers, data classification, sensitivity labels, encryption and data loss prevention. Microsoft also states that licensing requirements depend on the scenarios and features an organisation uses. Review Microsoft Purview Information Protection capabilities.
For the contract library, the organisation could apply a sensitivity label aligned with its definition of confidential commercial information. The corresponding handling rules might restrict external sharing, define who may remove protection and establish how approved partner access should work.
A phased rollout is usually safer than attempting to classify and protect every repository at once. Piloting the controls with a defined information set allows the organisation to identify confusing labels, operational conflicts or legitimate exceptions before extending enforcement.
CyberOne’s guide to Microsoft Information Protection services provides additional context on classification, sensitivity labels and information protection. Product capabilities and licensing should still be checked against current Microsoft documentation before an organisation selects or deploys a control.
The fourth leadership question is: How will we identify and investigate potentially inappropriate activity?
Collecting logs is not the same as having an effective response process. Organisations can generate large volumes of technical evidence without knowing which activity matters, who should investigate it or who can authorise action.
Monitoring priorities should connect to sensitive information and credible business scenarios. Relevant events might include an unusual volume of downloads, a change to permissions, unexpected external sharing or activity involving restricted information. The presence of an event does not prove malicious intent, so investigators need identity, access and business context.
The organisation should define who triages alerts, who investigates them and when another function should become involved. HR, legal, privacy and business leadership may have roles in specific cases, but their responsibilities should be agreed before a significant event occurs.
Insider risk management also needs privacy safeguards. Monitoring should be proportionate to the risk and supported by transparent policies, controlled access to case information and appropriate oversight. The objective is to assess evidence fairly, not to treat every unusual action as misconduct.
Microsoft Purview Insider Risk Management correlates signals to help identify potential malicious or inadvertent insider risks. Microsoft describes the service as privacy-by-design, with users pseudonymised by default plus role-based access controls and audit logs intended to support user-level privacy. Its documented workflow covers policies, alerts, triage, investigation and action. Review Microsoft’s Insider Risk Management documentation.
In the contract scenario, a large download should trigger questions rather than an automatic conclusion. Is the employee preparing an authorised disclosure? Has their role changed? Are they using an approved device and destination? Does the activity align with the project?
CyberOne’s article on managing insider threats with Microsoft Purview offers additional context on behavioural signals, investigation and employee privacy. It should be treated as supporting CyberOne content rather than independent substantiation of Microsoft product claims.
The fifth question is: How will we govern inappropriate movement without obstructing legitimate work?
Data loss prevention applies handling rules when sensitive information is used, shared or transferred through supported channels. Depending on the scenario, a policy may monitor an action, warn the user, request a justification, restrict the activity or escalate it for review.
Microsoft documents DLP coverage across supported Microsoft 365 services and devices, including Exchange, SharePoint, OneDrive, Teams, Office applications, supported Windows and macOS devices, on-premises repositories and selected cloud applications. Some capabilities have additional prerequisites, licensing requirements or preview status. For example, Microsoft’s current documentation identifies DLP coverage for Microsoft 365 Copilot and Copilot Chat as preview. It also identifies non-Microsoft connected applications as preview.
The value of a DLP programme does not come from the number of policies configured. It comes from whether those policies reflect real information, workflows and risks.
Policies should be tested before broad enforcement. A rule that blocks routine business activity can delay decisions and encourage workarounds. A policy generating excessive alerts can make important events harder to identify. Legitimate exceptions need an owner, a documented rationale and a review date.
Microsoft recommends planning DLP policies around the business processes that use sensitive information. Its documentation advises organisations to deploy policies in simulation mode, evaluate their effect and tune them before moving to more restrictive controls. It also recommends continued monitoring so policies meet their objectives without adversely affecting valid workflows and productivity. Review Microsoft’s DLP planning and deployment guidance.
AI and third-party applications introduce additional data pathways that must be assessed individually. Sensitive information can reach AI services through prompts, file uploads, connected repositories or application integrations. Coverage varies by service, data pathway, configuration and licence. Organisations should verify which approved and unapproved AI services their controls can monitor or restrict rather than assuming that one DLP policy applies everywhere.
Microsoft documents inline web traffic options for selected unmanaged cloud applications through Edge for Business and network data security capabilities. Its examples include ChatGPT, Google Gemini, DeepSeek and Microsoft Copilot. These controls apply through defined technical pathways rather than providing universal DLP coverage for every AI service or interaction.
In the contract scenario, a policy might warn or restrict an employee attempting to send confidential contract information through an unapproved channel. An approved transfer to a named legal adviser may require a different response. Context determines whether the control supports the business or simply interrupts it.
CyberOne’s guide to how DLP protects business data distinguishes DLP from access management, encryption, backup and incident response. It also considers testing, exception handling and the need to keep legitimate work moving.
The final pillar asks: Who owns the risk throughout the information lifecycle?
Information needs governance from creation to deletion. Ownership should cover retention, access, protection, sharing and disposal rather than ending once a technical control has been configured.
Retention rules should reflect legitimate operational, legal and regulatory needs. Keeping information indefinitely creates unnecessary exposure and makes discovery more difficult. Deleting it without an appropriate basis can also create legal or operational problems. Relevant specialists should verify the requirements that apply to a particular information set and jurisdiction.
Governance also includes staff guidance and supplier responsibilities. Employees need clear handling expectations. Suppliers should understand the controls and contractual requirements relevant to the information they process.
Backup and recovery support resilience by helping an organisation restore information after accidental deletion, corruption or disruption. They do not replace preventative security controls. The ICO’s security guidance states that appropriate measures should protect the confidentiality, integrity and availability of personal data. It also says organisations should be able to restore access and availability following a physical or technical incident, with an appropriate backup process identified as one measure to consider.
For the contract library, the accountable owner should determine when contracts are active, when they should be reviewed or archived and when deletion becomes appropriate. The organisation should also decide how retention applies to working copies and connected systems.
CyberOne’s discussion of the cost of poor data governance explains how unclear ownership, inconsistent information and duplicate systems can affect productivity, security and AI readiness.
Secure AI adoption depends on more than approving an AI tool. Leaders need to understand which information the tool can access, which identity or application permissions enable that access and where prompts or outputs may move.
The six pillars create a connected basis for those decisions. Discovery and classification identify the information involved in an AI use case. Access management determines which users and applications can reach it. Information protection establishes the expected handling rules. Monitoring provides evidence of relevant activity. DLP governs defined forms of data movement across supported channels. Lifecycle governance determines who owns the remaining risk and how long information should persist.
Consider an employee using AI to summarise a customer contract. The security question is not simply whether AI is allowed. The organisation should ask:
Controls should match the sensitivity of the information and the purpose of the use case. A task involving public information will not require the same oversight as an automated agent processing confidential customer records.
This approach enables leadership to prioritise. Instead of attempting to solve every AI governance issue at once, the organisation can begin with the use cases involving its most sensitive information or broadest access pathways.
Microsoft provides a portfolio of capabilities that can support different parts of the strategy, but deploying a platform does not remove the need for ownership, policy and continuing operation.
The Microsoft Entra product family supports identity, access, governance and workload identity controls. Microsoft Entra ID provides authentication and policy enforcement for users, devices, applications and resources. Microsoft Entra ID Governance supports access requests, assignments, reviews and identity lifecycle management. Microsoft Entra Workload ID addresses applications, services and containers that require authentication and authorisation policies.
Microsoft Purview provides a portfolio of capabilities across data security, data governance and compliance. Depending on the products, features and licences in scope, these can support discovery, classification, information protection, data loss prevention, insider risk management, eDiscovery and information lifecycle activities. Microsoft states that information protection licensing depends on the scenarios and features an organisation uses.
Microsoft security monitoring capabilities can also contribute signals and investigation context across identity, endpoints, workloads and data. Organisations should define how applicable signals enter their wider triage and response processes rather than assuming that product integration creates an operating model automatically.
The distinction between platform and operating model is important. Microsoft can provide functionality. The organisation must still decide what information matters, who owns it, which policies are appropriate and whether the controls work as intended.
Product scope, preview status and licensing can change. Organisations should verify requirements against current Microsoft documentation and contractual information before implementation.
CyberOne’s guide to managed Microsoft Purview provides further discussion of why discovery, classification and DLP need clear ownership and continuing operational attention rather than initial configuration alone.
A phased roadmap helps organisations focus on material exposure while learning from each stage.
Identify the critical information, accountable business owners and workflows where inappropriate access or movement would have the greatest impact.
Outputs: Priority information list, named owners, initial scope and agreed risk scenarios.
Review access, external sharing, classification and obvious protection gaps. Prioritise issues that create avoidable access to sensitive information.
Outputs: Exposure register, remediation decisions and documented exceptions.
Test information protection and DLP policies with a defined user group and business process. Gather feedback before wider enforcement.
Outputs: Pilot results, policy changes, exception process and deployment decision.
Define monitoring, investigation, reporting and review cycles. Set out who can approve access, policy exceptions and corrective actions.
Outputs: Operating model, escalation process, reporting cadence and stakeholder responsibilities.
Apply the lessons to additional repositories, teams and AI use cases. Retain a risk-based sequence rather than treating expansion as a purely technical rollout.
Outputs: Prioritised expansion plan, updated measures and governance decisions.
There is no universal implementation timeframe. The appropriate sequence depends on the sensitivity of the information, the complexity of the environment and the organisation’s ability to operate the controls sustainably.
A useful scorecard should connect activity with business outcomes. It should measure progress against an agreed baseline and defined scope rather than presenting isolated numbers without context.
Leadership measures can include:
No single metric proves that data is secure. The scorecard should help leaders understand whether visibility is improving, material exposure is reducing and controls remain usable.
The ICO also expects organisations handling personal data to test the effectiveness of their security measures, review them regularly and make required improvements. This reinforces the importance of measuring operational outcomes rather than treating the existence of a policy as evidence of effectiveness.
CyberOne helps organisations connect Microsoft data security capabilities with practical governance and operational priorities.
The work can begin with discovery and prioritisation, identifying sensitive information, important workflows and areas of unnecessary exposure. Microsoft controls can then be configured and tested against those priorities rather than deployed without a clear business outcome.
CyberOne’s Data Security as a Service, powered by Microsoft Purview, supports data discovery and classification, data loss prevention, data lifecycle governance, insider threat detection, eDiscovery and Legal Hold plus Microsoft 365 Copilot readiness.
Governance decisions and accountability remain with the organisation. CyberOne provides managed capabilities aligned with the agreed service scope, which should define responsibilities, reporting and operational boundaries.
For organisations requiring implementation support, CyberOne’s Microsoft Purview Deployment service can include discovery workshops, reviews of existing controls and licensing, classification strategy, policy design, information protection configuration, DLP design, lifecycle management, phased pilot deployment and production rollout support. The precise scope depends on the organisation’s requirements and agreed engagement.
The objective is not to suggest that one platform or managed service will remove all data risk. It is to create a continuing process through which the organisation can identify exposure, make accountable decisions and improve controls as its information, systems and AI use evolve.