# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 3 Results
### Practical Implementation and Evaluation: Performing a Self-Evaluation
#### 3.1.1 Case Study: Implementing the Self-Evaluation in the SITUATION Domain  
The process of self-evaluation is exemplified through the SITUATION domain, chosen for its comprehensive coverage of diverse DLP-related topics. This analysis utilizes the Objectives of the SITUATION domain, detailed in Appendix A.1.3, encompassing:  
* Perform DLP Logging;
* Perform DLP Monitoring;
* Establish and Maintain Situational Awareness for DLP;
* Management of Activities in the SITUATION Domain. In the Perform DLP Logging scenario, as detailed in Table 4, the assessed bank showcases robust capabilities. This is primarily attributed to the integrated use of SIEM and DLP systems, which facilitate immediate and effective logging. For MIL2 and MIL3 requirements, the status is Largely Implemented, a strategic decision based on the financial impracticality of achieving 100% client coverage. This was deemed disproportionate to the risk mitigation achieved. The risk of a few machines not reporting to SIEM was, therefore, an accepted compromise. The outcome was the achievement of at least Largely Implemented status across all MIL stages, so the bank reached MIL3. This outcome is visually represented in Figure 5, particularly at point 3.1 Perform DLP Logging, indicating a peak at MIL3. For the _Perform DLP Monitoring_ objective, as outlined in Table 5, the bank's evaluation reveals that objectives at MIL1 and MIL2 levels are at least _Largely Implemented_, ensuring these levels are met. However, structural constraints impede the adjustment of the DLP rule set. Due to potential extensive impacts on IT operations and the absence of a dedicated test infrastructure, any changes would require high-level management risk acceptance. Consequently, this aspect is classified as _Not Implemented_. Furthermore, regular reviews of the DLP rule set are not conducted; only ad hoc corrections are made when absolutely necessary, warranting a classification of _Partially Implemented_. Given that not all objectives at MIL3 are at least _Fully or Largely Implemented_, the bank's performance in this area is assessed as MIL2. In the assessment process, as illustrated in Tables 6 and 7, a consistent methodology was applied. It was observed that the MIL1 level in both instances was deemed not applicable, thus defaulting to achieved status. The criteria for MIL2 were confidently met. However, certain objectives at the MIL3 level were either not achieved or only partially fulfilled. Consequently, both tables reflect an attainment of only the MIL2 level. \begin{table}
\begin{tabular}{l l l l} \hline \hline  & \multicolumn{3}{c}{**Objective 3.1: Perform DLP Logging**} \\ \hline
**MIL** & & **Description** & **Outcome** \\ \hline MIL1 & a & Logging occurs for sensitive data, at least in an ad hoc manner. & **FI** \\ \hline MIL2 & b & Logging is implemented for assets that contain sensitive data. & **LI** \\  & c & Logging requirements are established. & **LI** \\  & d & Logging requirements are set for network and host monitoring & **LI** \\  & & (e.g., web proxies, e-mail gateways, print-monitoring on endpoint-clients). & \\  & e & Log data are aggregated and accessible for DLP analysts. & **LI** \\ \hline MIL3 & f & Logging is enforced for assets with higher data leakage risk priorities (e.g., for data at rest and data in use). & **LI** \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Assessment Outcome: The bank achieves MIL3 in this objective, as evidenced by the comprehensive implementation of objectives across MIL1, MIL2, and MIL3, with each objective meeting at least a Largely Implemented status.