ASD's Blueprint for Secure Cloud

Microsoft Purview encompasses a number of solutions which can be used to protect organisational data. The following solutions are used to assist in meeting the requirements outlined in the Protective Security Policy Framework (PSPF), ASD’s Information Security Manual (ISM), and other related standards and regulations:

• Information Protection assists the discovery, classification and protection of information
• Data Loss Prevention prevents the unauthorised use and sharing of information
• Compliance Manager automatically assess and manage information compliance against known standards
• Data Lifecycle Management retains and deletes information
• Auditing captures, records and retains user and administrative operations

While the Purview solutions outlined above integrate with several end-user applications and services, the design guidance is largely focussed on email communications. This approach has been taken due to the detailed email marking requirements outlined in the PSPF and the complexity associated with using Purview to detect implicit sensitive and security classified information.

Purview has many specific requirements depending on which applications, services and document types are used across an organisation. Organisations must assess Microsoft’s minimum versions for sensitivity labels in Office apps documentation and the Purview deployment guides in conjunction with this design and configuration guidance to ensure suitable implementation. Known issues with sensitivity labels in Office apps are also tracked and should be checked prior to implementation.

Related information

Security & Governance

• System management

Design

• None identified

Configuration

• Audit
• Compliance Manager
• Data Lifecycle Management
• Data Loss Prevention
• Information Protection

References

• Govern your data with Microsoft Purview
• Known issues with sensitivity labels in Office
• Learn about auditing solutions in Microsoft Purview
• Learn about data loss prevention
• Microsoft Purview Compliance Manager
• Microsoft Purview Information Protection Guide for Australian Government compliance with PSPF
• Minimum versions for sensitivity labels in Office apps
• Protect your sensitive data with Microsoft Purview