CISA.MS.EXO.8.3 - The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.
Overview
The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.
Rationale: Any alternative DLP solution should be able to detect sensitive information in Exchange Online and block access to unauthorized entities.
This test will always skip by default.
Related links
- Purview admin center - Data loss prevention policies
- CISA 8 Data Loss Prevention Solutions - MS.EXO.8.3
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.8.3 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Data loss prevention |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.8.3 |
| Criticality | SHOULD |
| Upstream requirement | Removed (was MS.EXO.8.3v1) |
| Supports controls | cisa-scuba:MS.EXO.8.3 |
| PowerShell test | Test-MtCisaDlpAlternate |
| Services | ExchangeOnline, Graph, SecurityCompliance |
Source
- Test:
tests/cisa/exchange/Test.CISA.MS.EXO.8.3.ps1 - Documentation:
tests/cisa/exchange/Test.CISA.MS.EXO.8.3.md