Most data security programmes can list their tools but cannot say whether sensitive data is less exposed this quarter than last. This health check gives the programme 10 KPIs, each with a formula and thresholds, covering how much data is classified and owned, how much is exposed, how well it is protected at rest and how mature data loss prevention enforcement is. It measures the programme described in the Data Security Guide, which explains discovery, classification, posture management, access governance and monitoring; this page asks whether those capabilities are producing results.
It is written for data security leads, CISOs, data protection officers and internal audit. It is a programme-level review: it reads across storage, SaaS, warehouses and endpoints, and does not audit the configuration of any single tool.
What this health check covers
Scope is every store that holds data classified as confidential or restricted, whether in cloud object storage, managed databases and warehouses, SaaS collaboration and business applications, file servers, backups or endpoints. It measures inventory, classification, ownership, exposure, encryption, key management, DLP enforcement, sharing and retention. Access governance for the identities that read the data is measured in the identity health checks; where data access and identity meet, this page counts stores and grants, not accounts.
- Who runs it: the data security lead compiles the KPIs; platform owners supply exports; data owners confirm ownership and retention; the privacy team reviews the personal data figures.
- How it differs from the Data Security Guide: the guide explains what each capability is for and how to deploy it. The health check gives one ratio per outcome, read as a trend over at least three quarters.
- How it differs from a DLP tool review: a DLP product review looks at rule quality and agent coverage. This programme check uses DLP only for two outcome measures, enforcement share and incident trend, alongside everything else that keeps data safe.
Key takeaways
- The inventory is the denominator for everything. If the sensitive data store inventory is incomplete, every other percentage on this page is flattering.
- Exposure counts must fall, not just be found. Track public exposures and overshared links as counts that you drive to zero, with time to close.
- Ownership is a leading indicator. Stores with no data owner are where findings sit unresolved and retention never runs.
- Read DLP enforcement and incidents together. Moving policies from monitor to block should change the incident trend; if it does not, the policies are aimed at the wrong channels.
- Retention is a security control. Data deleted on schedule cannot leak, so retention policy coverage belongs on the security scorecard.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Data Security Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Public exposure and overshared links (DS-03, DS-08) | Weekly | Data security operations | Data security lead | Exposure findings export with open and close dates |
| DLP enforcement and incidents (DS-06, DS-07) | Monthly | DLP service owner | Data security lead | Policy mode export, incident summary by severity and channel |
| Encryption and key management (DS-04, DS-05) | Monthly | Cloud platform and cryptography owners | Data security lead | Storage encryption settings export, key inventory with rotation dates |
| Inventory, classification, ownership, retention (DS-01, DS-02, DS-09, DS-10) | Quarterly | Data security lead with data governance | CISO and data protection officer | Store inventory, classification coverage report, owner confirmations |
| Full programme health check | Quarterly | Data security lead | CISO; risk committee for red KPIs | KPI table for three quarters, findings log, signed approval |
Metrics
A sensitive store is any store that holds data classified confidential or restricted under your scheme. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| DS-01 | Classified data share | Data stores (or objects, for unstructured stores) with a classification label or tag / all discovered data stores (or objects) in scope | Discovery and classification scan results, label reports | Over 90% | 70 to 90% | Under 70% |
| DS-02 | Sensitive data store inventory completeness | Sensitive stores found by discovery scans that are already in the inventory / all sensitive stores found by discovery scans | Data store inventory, discovery scan results across cloud and SaaS accounts | Over 95% | 85 to 95% | Under 85% |
| DS-03 | Public exposure count | Sensitive stores, snapshots or objects readable by anonymous users or unknown external accounts (count) and median days open | External access findings, storage posture findings | 0 open over 2 days | Any open over 2 days, none over 7 days | Any open over 7 days |
| DS-04 | Encryption at rest coverage | Sensitive stores with encryption at rest turned on / all sensitive stores; track customer-managed keys separately for restricted data | Storage and database encryption settings export | 100% | 98% to below 100% | Under 98% |
| DS-05 | Key rotation compliance | Customer-managed keys protecting sensitive stores that were rotated within the period set by the key management policy / all such keys | Key management service inventory with rotation dates | Over 95% | 85 to 95% | Under 85% |
| DS-06 | DLP enforcement mode share | DLP policies for confidential and restricted data in block or justify mode / all DLP policies for confidential and restricted data | DLP policy configuration export | Over 70% | 40 to 70% | Under 40% |
| DS-07 | DLP incident trend | Confirmed high-severity DLP incidents this quarter / the same count last quarter, read with the false positive rate (dismissed alerts / all alerts) | DLP incident queue, case management | Falling, false positives under 30% | Flat, or false positives 30 to 60% | Rising two quarters, or false positives over 60% |
| DS-08 | Overshared link count | Anonymous or organisation-wide sharing links on content labelled confidential or restricted (count), plus the share removed within 30 days | Collaboration platform sharing reports, label reports | Falling and over 90% removed in 30 days | Flat or 70 to 90% removed | Rising or under 70% removed |
| DS-09 | Data owner assignment | Sensitive stores with a named, current data owner confirmed in the last 12 months / all sensitive stores | Data store inventory, data catalogue, HR leaver feed | Over 95% | 80 to 95% | Under 80% |
| DS-10 | Retention policy coverage | Sensitive stores with an applied retention or lifecycle rule that matches the records schedule / all sensitive stores | Retention policy and lifecycle rule export, records schedule | Over 90% | 70 to 90% | Under 70% |
Reading the KPIs together
- DS-01 and DS-02 set the confidence level: report them first. A green DS-04 over an 80% inventory means one in five sensitive stores is unmeasured.
- DS-03 and DS-08 are exposure: both are counts you manage to zero, with time to close. A rising DS-08 after an AI assistant rollout usually means permissions were not cleaned before enablement.
- DS-06 and DS-07 test DLP maturity: a high block share with a rising false positive rate shows users being stopped by noisy rules and losing trust; see the Data Loss Prevention Programme Maturity Model.
- DS-09 predicts DS-10: stores without owners rarely get retention rules, because nobody can approve deletion.
How to collect the data
- Discovery and classification scans: results from your data discovery or posture tooling across cloud accounts, SaaS tenants and file servers, with scan date and sampling depth. Record the coverage of the scan itself; a store marked "no sensitive data" after a shallow sample is not proof. Feeds DS-01 and DS-02.
- Data store inventory: the register of sensitive stores with owner, classification, retention rule and location. Reconcile it against scan results each quarter. Feeds DS-02, DS-09 and DS-10.
- External access and posture findings: cloud storage policy findings and external access analysis listing resources shared with anonymous users or unknown accounts, with first-seen and closed dates. Feeds DS-03.
- Encryption and key inventory: encryption settings per store from the cloud and database platforms, and the key management service inventory with key type, last rotation date and the stores each key protects. Feeds DS-04 and DS-05.
- DLP configuration and incidents: policy export with mode per rule (monitor, notify, justify, block), and the incident queue with severity, channel, disposition and false positive status. Feeds DS-06 and DS-07.
- Collaboration sharing reports: the collaboration platform's sharing and access governance reports listing anonymous links, organisation-wide links and sites shared with everyone, joined to sensitivity labels. Feeds DS-08.
- Retention configuration: retention policies and storage lifecycle rules, compared with the records schedule for each data category. Feeds DS-10.
The scanners and exporters that produce these figures need broad read access to sensitive stores. Treat them as privileged non-human identities: read-only roles, federated or rotated credentials, and their own entry in the access review. See the DSPM Implementation Playbook.
Red flags that need action now
- A store holding restricted data readable by anonymous users, for any length of time. Start the Cloud Storage Exposure Playbook.
- A sensitive store discovered by scanning that no team will claim.
- Encryption at rest turned off on a store holding restricted or regulated personal data.
- A customer-managed key for restricted data more than a year past its rotation date, or scheduled for deletion while stores still depend on it.
- DLP policies for restricted data switched from block back to monitor without a recorded decision.
- A confirmed DLP incident involving bulk export of customer records by a single identity.
- Organisation-wide links to restricted content created by a service or integration identity rather than a person.
- Production data copies in test or staging stores with no retention rule.
- Discovery coverage falling because scanner credentials expired or an account was not onboarded.
Findings log
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-DATA-01 | [Example: 42 analytics buckets with customer data have no named owner] | DS-09 | [High] | [Head of data platform] | [DD/MM/YYYY] | [Open] |
| HC-DATA-02 | [Example: 60% of restricted-data DLP rules still in monitor mode 9 months after launch] | DS-06 | [Medium] | [DLP service owner] | [DD/MM/YYYY] | [Open] |
| HC-DATA-03 | [Finding] | [DS-xx] | [Critical, High, Medium, Low] | [Named owner] | [DD/MM/YYYY] | [Open, In progress, Closed, Risk accepted] |
Suggested service levels: public exposure of restricted data within 24 hours, critical within 7 days, high within 30 days, medium within 90 days. Risk acceptances need an expiry date and the data owner's signature.
Remediation map
| Finding type | Metrics | Where the fix is described |
|---|---|---|
| Unclassified or unknown data | DS-01, DS-02 | Data Classification Guide; Data Classification Policy Template |
| Public exposure | DS-03 | Cloud Storage Exposure Playbook; Data Security Guide, data exposure section |
| Missing encryption or overdue key rotation | DS-04, DS-05 | Cryptographic Key Management Policy Template; Cloud key management service (KMS) rollout playbook |
| DLP stuck in monitor mode or noisy | DS-06, DS-07 | Data Loss Prevention (DLP) Guide; Data Loss Prevention Policy Template |
| Oversharing in collaboration platforms | DS-08 | SharePoint and OneDrive Security Guide; AI data access review |
| Ownerless stores | DS-09 | Data Mapping and ROPA Guide |
| Missing retention | DS-10 | Data Retention and Secure Deletion Guide; Data Retention and Disposal Policy Template |
Related guides
- Data Security Guide: the programme this health check measures.
- Data Security Maturity Model: where your KPIs place the programme and what the next level needs.
- Security Metrics and KPIs Programme Guide: how to report these KPIs to leadership.
- Cloud Storage Exposure Playbook: response when a public exposure is confirmed.
- Data Loss Prevention Programme Maturity Model: deeper staging for the DLP KPIs.
References
- NIST: SP 1800-28, Data Confidentiality: Identifying and Protecting Assets Against Data Breaches
- NIST: Cybersecurity Framework 2.0 (ID.AM-07, PR.DS-01, PR.DS-02, GV.OV-03)
- NIST: SP 800-53 Rev. 5 (RA-2 Security Categorization, CM-8 System Component Inventory, SC-12 Cryptographic Key Establishment and Management, SC-28 Protection of Information at Rest, AC-21 Information Sharing, SI-12 Information Management and Retention)
- CIS: Critical Security Control 3, Data Protection
Related NHI Mgmt Group resources: Data Security Guide · Data Security Maturity Model · Data Classification Guide · Data Loss Prevention (DLP) Guide