With these data security steps, you can start using Copilot safely

Nipping Copilot risks in the bud 

If you don't have your data security in order, then using generative AI tools such as Copilot leads to various risks. Think of dark data with sensitive content appearing in responses. Or outputs with factually incorrect information. Still, there is no reason to despair. With the right data security measures, you can drastically reduce the risks.

First of all: many of the steps we mention below should also be taken for data use in general. Copilot only requires, as the following roadmap shows, some additional efforts. Partly because the tool can access all data and documents within a user's Microsoft environment to generate outputs, even if the user is unaware of them. 

Step 1: discover data 

To protect data, you first need to know more about the how, what, where and why of that data. In the discovery phase, you investigate where the data resides. You'll also look at data quality, (the classification and labeling of) sensitive data, access rights and the lifecycle of data (even that Copilot will generate).

Purview is an all-in-one solution for data management, data governance and data security that is perfect for Copilot. With this centralized platform, you can provide data visibility and risk mapping within the discovery phase, among other things. Copilot can also intentionally or unintentionally (and provided you have configured it) contribute to data protection itself. For example by providing insight into the risks of dark data containing personal or confidential information.

Step 2: classification and labelling 

After the exploration, it is time to classify and label your data. When classifying, you establish the sensitivity and value of data. This is how you build the foundation for further protection measures. Do you label data based on these classifications? Then from now on, all employees will know how to handle the data.

Copilot can, of course, generate responses and commands for applications based on information in prompts and uploaded files. But also based on other data. If that data is not correctly classified and labelled, there is a risk that sensitive information could unintentionally and wrongly appear in responses.

Step 3: Apply concrete data security measures 

Do you know all the ins and outs of your data and are you done with classification and labelling? Then take concrete data security measures to ensure data access and integrity. Consider, for example, access management and automated content validation. In addition, prevent certain sensitive information from leaving the organization, for example, by not allowing sensitive information to be stored in places accessible to anyone or shared externally.

Step 4: Protect during full lifecycle 

Suppose you write a project proposal with help from Copilot. In it, you include sensitive information such as customer data or business strategy. What you certainly don't want in such a case is for this information to become freely available when storing the content in another environment.

With Purview, you can control that. Labels such as “sensitive” or “confidential” remain valid throughout the data lifecycle. Within all your productivity tools. And across your entire environment, whether on-prem, in the cloud or hybrid. Plus: not only do the labels remain intact for existing data Copilot works with, but also for the outputs it generates. And then again for all subsequent steps, such as storing the created content in another environment.

With Purview's automated content validation, you can easily detect and correct misinformation in your existing data. When Copilot works with accurate and consistent data, you prevent misinformation from leading to bad decisions. By the way, validation also applies to outputs from Copilot. Purview can automatically detect incorrect and unsafe content in responses and attach labels to them.

Last but not least within this step: the comprehensive features for compliance checks and auditing help you use Copilot guaranteed to be secure and compliant.

Establish policies and procedures. 

An important aspect within this step: establish robust rules and procedures. For example, how will you handle sensitive data such as personal data and intellectual property? An essential data governance measure is also setting up controls, monitoring and incident management.

All rules, procedures and controls should be explicitly focused on Copilot (and, where applicable, also on other generative AI tools in your landscape).

Step 5: Knowledge, culture and awareness through adoption 

Adoption is not only necessary for users to get maximum value from Copilot. With training, you also ensure that employees have sufficient knowledge of the rules, procedures and best practices surrounding data security and Copilot. What's more, the trainings contribute to an organizational culture in which data protection is considered an important asset. 

Is your organization Copilot-ready? 

In short: if you want to be able to use Copilot safely and compliantly, you need a nice set of data security measures. With our Data Security Engagement - in close collaboration with Cegeka - you can find out if your organization is ready for large-scale use of Copilot. 

The assessment creates visibility and insights. Dark data and sensitive data are exposed and risks identified, for example. You might discover that some employees have unauthorized access to sensitive data. Or that they exhibit anomalous (and therefore suspicious) behaviour.

Microsoft Purview as the foundation 

For Data Security Engagement, we use Microsoft Purview. This centralized platform allows you to gain 360° visibility into your data landscape. Cegeka helps to set up and configure Purview. Then you experience what it's like to gain data insights within your own environment.

Once Purview has been running for a few weeks, we have a good picture of all your (sensitive and confidential) data and the risks. We then incorporate the results of the scan into a final presentation. 

The assessment is also good for gaining knowledge about issues such as dark data, sensitive data and anomalous behaviour. After the process, there is a solid foundation. That is the starting point for the concrete data security measures you need to realize for safe and compliant Copilot use. A large part of those measures you simply realize with Purview.

Are you interested in Copilot? 

Are you interested in learning more about our pragmatic way of implementing Copilot? Watch our webinar of Cegeka’s own early adoption of Copilot below.