Fortellar

Classify the data. Label the data. Govern the AI that sees the data.

Data Protection & Governance classifies your data, enforces sensitivity labels across the environment, scopes DLP to in-flight patterns, and sets the guardrails that decide what AI and third-party tools are allowed to surface.

Talk to Us
Why This Matters

AI doesn't have a security model. Your access model is the security model.

AI sees whatever your users can see. Give an assistant a user's context and it inherits every document, mailbox, and file share that user can already reach, across every platform, cloud, and tool, not just one vendor's. Most organizations haven't audited what their users can actually reach in years.

Data Protection & Governance closes that gap. A classification taxonomy built against the data your business handles, enforced with sensitivity labels, encryption, and access controls wherever the data lives. DLP is scoped to the patterns in flight, and every AI tool, sanctioned or shadow, is governed by the same rules. The controls follow the data across environments, not a single tenant.

What your access model is exposing
01

User reach

Most organizations haven't audited what a single user can actually reach in years.

02

Classification

Without a taxonomy, every control is applied to data nobody has graded.

03

Data in flight

DLP scoped to default patterns instead of the flows your business runs.

04

Shadow tools

Unsanctioned AI and SaaS inherit the same access as everything else.

Who this is for

Three situations where data classification has to come before the next decision.

Situation 01

Copilot for M365 is on the procurement list

The license is sitting in the cart, the executive team wants the productivity story, and the security team is the only group asking what data Copilot will see on day one. Activating without classification is AI-powered data leakage.

The outcomeA Copilot readiness assessment with the seven prerequisites checked, the critical data classified, oversharing remediated, and the policy that governs third-party AI tools published before the license is turned on.
Situation 02

An auditor asks you to prove data classification

HIPAA, SOC 2, HITRUST, PCI-DSS, or a customer contract requires a documented classification scheme and evidence of enforcement. The team has a draft policy in SharePoint and no labels in the wild. The auditor is asking for the artifact.

The outcomeA documented taxonomy, sensitivity labels deployed in Microsoft Purview, DLP policies enforcing the labels, and the monitoring dashboard that produces the evidence the auditor reads first.
Situation 03

An incident or audit named oversharing as the gap

An incident review surfaced a SharePoint site shared with the wrong audience. An audit named external sharing as a finding. A customer found data they shouldn't have through a search box. The next conversation is about the access model, not the perimeter.

The outcomeA SharePoint and OneDrive sharing audit, an access review across the affected scope, label-driven site protection enforced, and the monitoring that catches the next oversharing event before the next incident does.
What's included

Everything you walk away with, and can prove.

A documented classification taxonomy

Four levels, mapped to the actual data types the business handles and the regulations it reports against. Approved by client leadership, signed by the engagement partner, written for the audit committee and the regulator.

Sensitivity labels deployed across your data platform

Public, Internal, Confidential, and Highly Confidential labels created and published. Encryption configured for Confidential and Highly Confidential. Visual markings, mandatory labeling, default label, and downgrade justification enforced.

DLP policies scoped to the data in flight

Policies for PHI, PII, financial, and label-enforcement scenarios. Tuned against the actual content in the environment, not a template. False positive rate driven below 10% before enforcement is turned on.

An AI readiness assessment

An AI readiness checklist, run against the environment. Gaps identified, oversharing, access review currency, guest access, third-party AI policy, with a remediation plan and a sign-off date before activation.

Auto-labeling tuned and scoped

Sensitive information types matched against actual data patterns. Simulation mode reviewed before enforcement. Auto-labeling coverage measured against PHI and PII content as a KPI, not a hope.

A monitoring dashboard and KPI scorecard

Label adoption rate, DLP match trends, false positive rate, downgrade rate, consumer-AI blocks, Copilot active users. Reported weekly to the team, monthly to the CISO, and quarterly to the audit committee.

How it works

Four phases. Framework first. Activation last.

Phase 01

Framework & AI readiness

The classification taxonomy is built against the actual data types in the business and the regulations on the books. The AI tool inventory is captured, Claude, Copilot for M365, Azure OpenAI, custom apps, and the third-party tools already in use. The readiness checklist is run against the environment and a gap list is published.

You walk away with
  • An approved classification taxonomy mapped to compliance frameworks.
  • An AI tool inventory and readiness gap list.
  • A remediation plan and a sign-off date before Copilot activation.
Phase 02

Label deployment & site protection

Sensitivity labels created and published in Microsoft Purview. Encryption, visual marking, and access controls configured per level. Site and group labels enforce sharing, privacy, and unmanaged-device access. Mandatory labeling, default label, and downgrade justification turned on. End-to-end testing validates every behavior.

You walk away with
  • Four labels published, encryption configured.
  • Site and group labels enforcing sharing and access.
  • Test cases validated and evidence captured in SharePoint.
Phase 03

DLP, auto-labeling & AI controls

DLP policies scoped against PHI, PII, financial, and label-enforcement scenarios. Tuned in simulation mode until false positives are below the published threshold, then turned on in enforcement. Auto-labeling tuned against actual data patterns. Third-party AI tools blocked or governed via App Governance and endpoint policy.

You walk away with
  • DLP policies tuned and enforced.
  • Auto-labeling enabled against PHI and PII patterns.
  • Third-party AI tool policy published and technically enforced.
Phase 04

Monitoring, KPIs & handover

The data protection dashboard is configured. Weekly metrics collection automated. KPIs published, label adoption, DLP false positive rate, auto-labeling coverage, consumer-AI blocks, downgrade rate. Reporting cadence wired into the existing security reporting from the operations program.

You walk away with
  • A data protection dashboard with weekly metrics.
  • Published KPI targets and a monthly executive readout.
  • A handover packet and a defined next step into Managed Security.
Expertise this work draws on

The components behind a Data Protection & Governance engagement.

Cybersecurity & Compliance

Data Protection & AI Governance

The published Data Protection and AI Governance Framework Playbook, the Sensitivity Labels and Label Policies Runbook, and the Data Protection Monitoring and Reporting Runbook anchor the engagement. The methodology is repeatable, the evidence shape is consistent, and the KPIs are published.

See expertise
Cybersecurity & Compliance

GRC Program Design

Classification cross-mapped to HIPAA, SOC 2, HITRUST, PCI-DSS, and the state and sectoral rules that reach the mid-market. Drawing on the firm's experience as former auditors and GRC leaders, the taxonomy is built to satisfy the audit, not the template.

See expertise
Technology & Security Operations

Identity & Access Management

The access model is the AI security model. The IAM practice runs the oversharing remediation, the access reviews, and the guest governance that make Copilot deployment safe, joiner-mover-leaver, privileged access, and the certification cycle behind them.

See expertise
Secure AI

Secure AI Activation

When the engagement is the prelude to a Copilot for M365 rollout, the AI Activation practice picks up at handover, model selection, prompt governance, agent design, and the data-aware controls that operate on top of the labeled tenant.

See expertise

Classified data, sensitivity labels, tuned DLP, and a signed readiness checklist.

Bring the AI tools on the procurement list, the regulations the business reports against, and the data types the team handles, and we'll scope the program.

Talk to Us