Incident Response & Insider Risk

THIS SECTION NEEDS TO BE WRITTEN

Purview provides cloud based data protection.

Activity Explorer: Investigating "Mass Downgrade" events.

Script: PowerShell to report on Label Downgrades (e.g., User changed "CUI" to "Public").

Insider Risk Management: Detecting "Flight Risk" behavior (e.g., downloading CUI prior to resignation).

AI Readiness (DSPM): How proper labeling today prevents Copilot from summarizing CUI for unauthorized users tomorrow.