Going live with a Data Loss Prevention solution is just the first step. Achieving genuine DLP maturity requires an ongoing, repeatable cadence of continuous improvement.
When a compliance-oriented—or “set and forget”—mindset is driving the DLP initiative, it is almost inevitable that the commitment will fade post-launch, and that continuous improvement will not be forthcoming. Today, however, the repercussions of data loss are escalating rapidly, not only in terms of direct penalties and fines but also in terms of the long-term reputational and competitive damage that can result from a breach. As these consequences increase, a growing number of organizations are recognizing that initial compliance alone is inadequate protection against significant DLP risk.
The limitations of a compliance-only mindset manifest themselves in a variety of ways. For example, many organizations, after a successful DLP launch, fail to fully leverage the advanced detection and response technology their systems can support. When response rules and technical controls remain static, the burden on day-to-day business operations can become significant, as false positives mount.
At the same time, though, failure to adapt to changing threats can allow significant new vulnerabilities to go undetected. The combination of greater inconvenience and lower effectiveness can quickly undermine the entire effort, as key stakeholders—and end users—see reduced benefits and greater costs.
Maintaining momentum requires a constant input of energy and effort through all phases of risk reduction—from initial visibility and understanding of the risk, through remediation and correction of inadequate controls and other process weaknesses, then on to prevention and expanding scope, adaptation of the solution over time, and ultimately to the establishment of a genuine culture of security that drives continuous improvement of the DLP program.
Maintain momentum by consistently and repeatedly asking questions such as: