# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 1 Introduction  
The narrative of data leakage prevention (DLP) technology has unfolded rapidly yet succinctly within the cybersecurity domain [1]. Initially, up to 2005, DLP solutions were largely niche products with minimal deployment across industries. The period between 2006 and 2009 marked a significant turning point, characterized by multimillion-dollar (USD) acquisitions. Almost every major player in the IT security market acquired firms, aiming to secure a foothold in the DLP sector [2; 3; 4; 5; 6; 7]. However, despite initial expectations for a widespread DLP adoption and integration into standards, the anticipated era of dominance for DLP tools did not unfold, with very few standards explicitly recommending their use. In 2019, the narrative experienced a refined shift, with the European Banking Authority (EBA) issuing updated information and communications technology (ICT) and security risk management guidelines, now adopted across numerous European nations [8], which recognized the significance of data protection yet refrained from explicitly requiring DLP. The next shift began with the broader adoption of monitoring tools and security information and event management (SIEM) systems, leading to a resurgence in DLP discussions. Contemporary standards, notably ISO/IEC 27001 and 27002 [9; 10] as of2022, now explicitly recommend the implementation of DLP tools. The discourse around the Digital Operational Resilience Act (DORA), mandating resilience for critical sectors in Europe, further exemplifies this trend, suggesting DLP's classification as essential according to the current perspective of the three European supervisory authorities (ESAs) [11].  
Simultaneously, the frequency and severity of breaches continue to rise [12], which underscores the importance of holistic strategies in the field of DLP. However, there remains a discernible gap between employing discrete DLP tools and forging an overarching DLP strategy, underscoring the necessity of evolving from singular solutions to a holistic approach for DLP. This paper aims to bridge the existing gap by developing a DLP Maturity Model, specifically adapted from the C2M2 framework due to its proven reliability, industry-specific focus, and alignment with NIST methodologies. This model is designed for assessing DLP maturity, enabling target-actual comparisons and subsequently providing relevant information to support cybersecurity strategy development and decision-making regarding DLP.  
The article makes several distinct contributions to the field of DLP.  
* It highlights the importance of a holistic approach to DLP.
* It introduces a novel DLP Maturity Model, meticulously adapted from the C2M2.
* It details the application of this model within the financial sector, providing a comprehensive case study on its implementation in a banking scenario.  
This study is structured into several key sections. Initially, it underscores the imperative for developing the DLP Maturity Model. It then delves into the essential definitions and themes underpinning DLP, setting the stage for a deeper exploration of DLP's principal components and maturity frameworks. This establishes a solid grounding in the subject. Subsequently, the paper elucidates the choice of the Cybersecurity Capability Maturity Model (C2M2) for evaluating DLP maturity and details the process of tailoring C2M2 into a bespoke DLP Maturity Model. Subsequently, theresults section (Section 3) presents the findings from the model's application in a banking context, highlighting its efficacy in identifying DLP capabilities and gaps. A key aspect of this section involves the practical application of the model, demonstrating its relevance and utility in safeguarding sensitive customer data and ensuring compliance with regulatory standards. Finally, the discussion section (Section 4) concludes by contextualizing the outcomes within the broader cybersecurity challenges, underscoring the model's contribution to enhancing organizational data protection strategies.