Subcontrol 14.7

[adammontville]

Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when the data is copied off a system.

Measures

None provided

Metrics

None provided

[adammontville]

For Controls Team: Is this relative to data or endpoints? When considering a measure for this one, it seems difficult to do. I want to look at endpoints to ensure that DLP software at least "covers" that endpoint. Looking at specific data seems more difficult.

[adammontville]

Inputs:

• EI: Endpoint inventory
• SI: Software inventory

Operations:

• Enumerate endpoints capable of storing data
• Enumerate all DLP software
• For each instance of DLP software:
  • Enumerate the endpoints covered by the DLP software
• Enumerate all endpoints covered by the set of DLP software
• Complement the list of covered endpoints with the list of endpoints enumerated in the first operation to get the enumeration of endpoints not covered

Measures:

• M1 = List of endpoints capable of storing data
• M2 = List of DLP software instances
• M3 = List of all endpoints covered by the set of DLP software
• M4 = List of all endpoints not covered by the set of DLP software
• M5 = |M1|
• M6 = |M2|
• M7 = |M3|
• M8 = |M4|

Metrics:

• M7 / M5 = Ratio of endpoints covered by at least one DLP software instance to the total number of endpoints capable of storing data