# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 2 Materials and Methods
### Concepts
#### 2.4.2 Adopting the C2M2  
In the C2M2, maturity indicator levels (MILs) delineate the maturity of cybersecurity practices across a spectrum. The MILs serve as a yardstick to:  
* Define the organization's current state of DLP maturity. * Determine the future, more mature state the organization aspires to reach, effectively guiding a gap analysis between the current and target cybersecurity postures. * Identify specific capabilities and improvements needed to advance to that future state, providing a roadmap of actionable steps for progression. MIL0 indicates no implemented practices, while MIL1 represents initial, potentially ad hoc efforts. MIL2 shows practices that are documented and resourced, becoming more refined than MIL1. MIL3 signifies advanced practices that are policy-driven and evaluated for effectiveness, an enhancement over MIL2. Furthermore, MIL3 institutionalizes a culture of continuous improvement, where activities are systematically tracked and quantifiably assessed, enabling both the immediate evaluation of DLP effectiveness and the long-term enhancement of the information security strategy. The MILs are adapted for the DLP Maturity Model to provide an analogous structured assessment for DLP practices. As shown in Figure 3, these levels were integrated to define the progression from non-existent DLP measures (MIL0) through to a mature state of advanced DLP practices. MILs are not merely a measure of adherence to standards but are indicative of an evolutionary growth in managing and safeguarding sensitive data. They enable organizations to set realistic goals and prioritize efforts to enhance their DLP maturity, all while offering a framework to benchmark against industry peers. Aiming for MIL2 is recommended for robust cybersecurity, while MIL3 is the mark of excellence and should be pursued as part of a risk-based approach. In both the C2M2 and the adapted DLP Maturity Model, there are domains that categorize high-level aspects. Within these domains, there are specific objectives that represent targeted goals. The described MILs are used to assess the attainment of these objectives. The adaptation of the C2M2 to a DLP Maturity Model involved a meticulous, three-step process, ensuring that each domain aligned with the specific nuances of DLP. **Step 1: Domain Relevance Assessment**. Domains in the context of the C2M2 model refer to specific areas of focus within the broader scope of cybersecurity. Each domain of the C2M2 model was rigorously evaluated for its applicability to DLP. This evaluation led to strategic decisions on the inclusion or exclusion of certain domains, as detailed in Table 3.  
Figure 3: Authors’ synoptic depiction of DLP Maturity Framework progression. Our evaluation revealed that no additional domains needed to be incorporated into the DLP Maturity Model. This is due to the C2M2 already encompassing a comprehensive breadth of cybersecurity aspects, adequately covering the scope required for an effective DLP Maturity Model. **Step 2: Objective Analysis**. The objectives within each selected domain were then scrutinized. In this process, objectives were aligned with the elements depicted in the concept graph (Figure 2). Those directly corresponding to a node within the graph were retained. Conversely, objectives lacking relevance to the elements depicted in the concept graph were discarded, ensuring that the framework's focus remained tightly aligned with DLP concerns. This alignment led to the addition of specific, DLP-relevant technical details within certain domains, notably within the ARCHITECTURE domain, to address any identified gaps. The meticulous mapping of objectives to the concept graph, distinguishable by different colored nodes in Figure 2, underscores our methodical approach to refining the framework for DLP applicability. Figure 4 illustrates the process and the adjustments made in detail. **Step 3: MILs Adjustment and Enhancement**. A critical examination of the MILs within each objective followed.