Question

A financial services firm stores customer records, internal marketing plans, and public regulatory filings on the same file-sharing platform. The security architect has been asked to design a data protection scheme that applies the strongest controls (encryption, egress blocking, watermarking) only where warranted, while avoiding unnecessary friction for low-sensitivity content. Which approach should the architect implement FIRST to make the downstream control decisions defensible and consistent?

Accepted Answer

Establish a data classification scheme with defined sensitivity labels, then map DLP, encryption, and handling controls to each classification tier

Answer

Deploy a DLP engine in monitor-only mode across all repositories and refine rules based on the volume of alerts each dataset generates

Answer

Encrypt every file in the platform with the same customer-managed key and enable blanket egress blocking to the internet

Answer

Require all users to manually tag files as confidential during upload and rely on that tag to trigger the appropriate protection