MS Purview Information Protection & Data Loss Prevention

Executive Summary

This engagement delivers a two-phase implementation designed to establish Microsoft Purview Information Protection and Data Loss Prevention capabilities while building an enterprise Information Governance program aligned with NeoCurrency's SOC 2 certification objectives.

Phase 1 – Microsoft Purview Information Protection & DLP

Phase	Hours	Deliverables
Discovery & Planning		Requirements, compliance objectives, licensing review
Purview Foundation		Configure Purview, roles, readiness
Information Protection		Up to 5 sensitivity labels, publishing policies, manual/container labeling
Data Loss Prevention		Exchange, SharePoint, OneDrive, Teams DLP, policy tips, notifications
Endpoint DLP		USB, copy/paste, browser, print controls
Testing & Optimization		Pilot, tuning, reporting
Documentation & KT		Runbooks, policy matrix, knowledge transfer

Phase 2 – Corporate Information Governance & Data Classification

Phase	Hours	Deliverables
Information Governance Assessment		Governance workshop, SOC 2 objectives, data owners
Corporate Classification Framework		Classification matrix, handling standards, ownership
Enterprise Data Discovery		Assess SharePoint, OneDrive, Exchange, Teams
Automatic Classification & Labeling		Auto-labeling, classifiers, policy tuning
Corporate Data Tagging & Validation		Validation, reporting, bulk tagging strategy
Governance Documentation & Handover		Governance framework, standards, executive handover

SOC 2 Alignment

• Security – Microsoft Purview, DLP, Endpoint DLP
• Confidentiality – Sensitivity Labels and encryption
• Privacy – Data classification and governance
• Processing Integrity – Policy validation and auditing
• Availability – Operational documentation and runbooks