# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 4 Discussion
### Further Work  
Our meticulous analysis and adaptation of the C2M2 have culminated in the development of a structured approach to evaluate and enhance DLP practices across various organizational contexts. It has been demonstrated that an effective utilization of C2M2 is not only possible but also beneficial in creating a more robust DLP framework. The DLP Maturity Model's effectiveness in providing a clear, gradational assessment from initial to advanced DLP practices aligns with our research question regarding the added value of a tailored C2M2 framework in DLP. Our findings confirm that the DLP Maturity Model, built upon the adapted C2M2 framework, significantly contributes to the realm of DLP by offering a comprehensive pathway for organizations to evolve from initial, ad hoc efforts to a mature, policy-driven level of data protection. In practice, the application of this model within a banking context has underscored its utility in safeguarding sensitive data and ensuring compliance with regulatory standards. The model serves as both a current assessment tool and a guide for future enhancements in DLP practices, indicating its potential to shape organizational strategies towards a more aligned approach with broader business objectives and risk appetites. Looking ahead, this model lays the groundwork for future research and development in DLP strategies, particularly in aligning them with evolving business needs and cybersecurity landscapes. Establishing a DLP target profile that reflects an organization's preferred capability level across multiple cybersecurity domains is a key step towards a more secure digital future. Conceptualization, J.D. and A.H.; methodology, J.D. and A.H.; investigation, J.D. ; resources, J.D. ; draft preparation, J.D. ; writing--review and editing, A.H.; visualization, J.D. ; supervision, A.H.; project administration, J.D. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Data Availability StatementData are contained within the article. The authors declare no conflicts of interest. The following abbreviations are used in this manuscript:  
C2M2 Cybersecurity Capability Maturity Model  
DORA Digital Operational Resilience Act  
DLP Data Leakage Prevention  
EBA European Banking Authority  
FI Fully Implemented  
ICT Information and Communications Technology  
LI Largely Implemented  
LLM Large Language Model  
MIL Maturity Indicator Level  
NI Not Implemented  
NIST National Institute of Standards and Technology  
PI Partially Implemented  
SIEM Security Incident and Event Management  
SOC Security Operation Center \begin{table}
\begin{tabular}{l l l} \hline \hline
**MIL** & **Description** \\ \hline MIL1 & a & Logging occurs for sensitive data, at least in an ad hoc manner. \\ \hline MIL2 & b & Logging is implemented for assets that contain sensitive data. \\  & c & Logging requirements are established. \\  & d & Logging requirements are set for network and host monitoring (e.g., web proxies, \\  & e-mail gateways, print-monitoring on endpoint clients). \\  & e & Log data are aggregated and accessible for DLP analysts. \\ \hline MIL3 & f & Logging is enforced for assets with higher data leakage risk priorities (e.g., for \\  & data at rest and data in use). \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Objective 2: Management Activities for RISK Domain. \begin{table}
\begin{tabular}{l l l} \hline \hline
**MIL** & \multicolumn{2}{c}{**Description**} \\ \hline MIL1 & a & \begin{tabular}{l} \begin{tabular}{l} \multicolumn{1}{l}{\