One of the requirements is to have data leak policies and data access policies. This is very critical to enforce data governance standards, which relate to data classification, access control, data protection, and retention. It covers the entire lifecycle, helping us to protect, detect, and classify the documents. Challenges are mostly related to the security products onboarded into the bank; they have challenges in terms of those products complying with the internal standards. Sometimes, we cannot just use the DLP across the state. For example, using Microsoft products has been easy to adopt, such as OneDrive and SharePoint on-premise, but it becomes a challenge when it comes to AWS, as data also exists in S3 buckets. Testing is still ongoing, but it will eventually be done. The time it takes to scan is one issue; when we raise high-volume issues and tickets related to scanning failures, it relates to permission errors, which are technical challenges. These take time because we have high volume tickets in terms of connectivity, scanning failures, and related matters. There are also frequent change requests, especially regarding scoping or rescoping due to complexities, creating several challenges. In both organizations I work with, there are gaps, and there is no enterprise-wide data classification available. However, there are pockets of implementations for various products. Some agencies are using it, but otherwise, there's no product existing across the enterprise. Microsoft Purview Data Lifecycle Management is definitely a good solution, but there is significant room for improvement from a product perspective. Reporting is another area that needs improvement.
