🚦 WS2 — Exception Management
🔒 WS3 — Quarantine Optimization
📊 WS4 — Reporting, Automation & AI Engineering
🛡️ WS5 — DLP Expansion (Policy & Channels)
🏷️ 4-label sensitivity taxonomy
📡 DSPM operating model
⚙️ Non-standard policy dev (SitPak)
✅ Deliverable tracker · 📋 Platform workbook
DLP enforcement ladder, policy scope, and channel coverage. SOW3 WS5: expand net-new policies using WS1-validated SITs. February 2026 Discovery Policies are the evaluation baseline.
→ 🏷️Four-label taxonomy — Public, Internal, Confidential, and Restricted — with automation matrix, protection controls, and rollout guidance. Classification integrity underpins all SOW3 DLP enforcement.
→ 📡Data Security Posture Management operating model — continuous visibility, risk scoring, and cross-platform signals. Feeds SOW3 WS3 quarantine baseline and WS4 reporting KPIs.
→ 📊Reporting architecture feeding SOW3 WS4. Dual-ingestion model: UAL audit + Defender XDR enrichment → normalized KPI marts → 5 dashboard tiers. Monthly cadence: 20th–25th rollup window. AI Builder → Copilot Credits migration required by Nov 1, 2026.
→ 🏆Microsoft-core, Splunk-consumer hybrid model with SOW3 context. 7 reasoning points, platform ownership matrix, 8 implementation phases. SOW3 delivery closes November 30, 2026.
→ 🛡️Microsoft-native reporting path: Defender XDR → Sentinel/Log Analytics → KQL semantic functions → Sentinel Workbooks + Power BI dashboards + Logic Apps automation. Supports SOW3 WS4 reporting automation build.
→ ⚙️AI-assisted SIT engineering — core methodology for SOW3 WS1 net-new SIT builds. Single-prompt pipeline with PowerShell automation, SitPak 2026 methodology, and Power Automate approval gates. WS1 SIT validation gates WS5 policy deployment.
→Purview Data Map, Data Catalog, classification scanning, SHIR on-prem onboarding, and two-lane governance model. Discovery Policy baseline (Feb 2026) evaluated across all channels as part of SOW3 WS1.
→ ♻️Retention policies, records management, lifecycle stages, disposition review, and auto-apply label strategy. Lifecycle controls support SOW3 quarantine optimization (WS3) and exception workflows (WS2).
→ 🔍Upcoming module covering Insider Risk Management policy design, indicator tuning, and integration with DLP and Labeling.
→Canonical design spec for this platform — file structure, naming rules, LLM reconstruction prompt, token system reference, and section skeleton template for new topics.
→Default four-label schema: Public → Internal → Confidential → Restricted. Tailored for healthcare and enterprise environments. Override in Setup to match any client’s approved taxonomy.
SOW No. 3 planning workbook — five work streams: SIT Maturation, Exception Management, Quarantine Optimization, Reporting & Automation, DLP Expansion. Includes Q&A log, task tracking, decisions log, weekly sync log, and Q2–Q4 2026 execution plan.
→ ✅Leadership-facing SOW No. 3 tracker — status per work stream (WS1–WS5), audit-defensibility scope notes, AI-Assisted Engineering operating assumption notice, AI Builder credit migration warning (Nov 1, 2026 deadline), and executive print/PDF view.
→Data Map + DSPM scan all workloads
Apply sensitivity labels per taxonomy
DLP rules enforce based on label + content
Activity Explorer + DSPM posture + lifecycle