# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 3 Results
### Practical Implementation and Evaluation: Performing a Self-Evaluation
#### 3.1.1 Case Study: Implementing the Self-Evaluation in the SITUATION Domain
\begin{table}
\begin{tabular}{l l l} \hline \hline  & \multicolumn{3}{c}{**Objective 3.2: Perform DLP Monitoring**} \\ \hline
**MIL** & & **Description** & **Outcome** \\ \hline MIL1 & a & Log data or alerts from the monitoring infrastructure are reviewed, at least in an ad hoc manner. & **FI** \\ \hline MIL2 & b & Requirements for DLP monitoring are established and maintained. & **LI** \\  & c & Enhanced rule sets are configured to trigger alerts when a potential data leakage attempt is discovered. & **LI** \\  & d & Monitoring activities are aligned with the organization’s risk-based security approach. & **LI** \\ \hline MIL3 & e & Enhanced monitoring is enforced for assets with higher data leakage risk priorities. & **LI** \\  & f & The DLP rule set undergoes periodic evaluation and updates, integrating insights from incident responses and false-positive alert assessments. & **PI** \\  & g & Adjustments to the DLP rule set can be executed on short notice if required. & **NI** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Assessment Outcome: The bank achieves MIL2 in this objective, as evidenced by the comprehensive implementation of objectives (Fully Implemented, Largely Implemented) across MIL1 and MIL2 but not MIL3. The achieved MILs across the four tables are traceable in Figure 5, specifically detailed under objectives 3.1 to 3.4. This visualization aids in comprehending the MIL outcomes in a consolidated and clear manner. Finally, an overarching assessment was conducted for each domain across all tables, establishing a comprehensive MIL for each domain. This was achieved by first aggregating all MIL1 objectives from the four tables. The outcome showed that two objectives were _fully implemented_, while two were not applicable, reflecting the _No practice at MIL1_ status. For MIL2, a cumulative count across all four tables yielded 11 objectives, with nine being _fully implemented_ and two _largely implemented_, indicating that MIL2 was at least achieved. When considering MIL3, all 11 objectives from the four tables were tallied. The results were three _fully implemented_, two _largely implemented_, three _partially implemented_, and three _not implemented_ objectives. Due to the presence of _partially implemented_ and _not implemented_ ratings, MIL3 was not attained. \begin{table}
\begin{tabular}{l l l} \hline \hline  & \multicolumn{2}{c}{**Objective 3.3: Establish and Maintain Situational Awareness for DLP**} \\ \hline
**MIL** & **Description** & **Outcome** \\ \hline MIL1 & & No practice at MIL1. & **-** \\ \hline MIL2 & a & Methods for communicating the current state of DLP are established and maintained. & **FI** \\  & b & KPIs relevant to DLP are collected for operational state awareness. & **LI** \\ \hline MIL3 & c & KPIs and thresholds for the rule sets are established and harmonized with leadership and stakeholder requirements. & **NI** \\  & d & Internal data crucial for DLP activities (e.g., employee terminations) are methodically collected and processed, leading to (ad hoc) modifications in the rule set as necessary. & **NI** \\  & e & Predefined operational states, such as Triage and Incident Escalation, are meticulously documented and activated in response to incoming alerts. & **FI** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Assessment Outcome: The bank achieves MIL2 in this objective, as evidenced by the comprehensive implementation of objectives (Fully Implemented, Largely Implemented) across MIL1 and MIL2 but not MIL3.