1. Organisation & scope
Assessment name
Customer
Prepared by
Industry Banking & financial services Insurance Government & public sector Healthcare & life sciences Telecommunications Energy, oil & gas, utilities Retail & e-commerce Manufacturing Education Technology & services Other Primary country / region Saudi Arabia United Arab Emirates Qatar Kuwait Bahrain Oman Egypt European Union United Kingdom United States Asia-Pacific Other Programme scope DLP and DSPM DLP only DSPM only Deployment preference No preference On-premises (customer hosted) SaaS / cloud-delivered Hybrid On-premises and in-country residency often decide the shortlist on their own.
In-country / in-region data residency is required Incident data and content must stay in the selected country or region.
2. Users & endpoints
Users Everyone covered by policy Windows endpoints Laptops, desktops, servers macOS endpoints Linux endpoints VDI sessions Citrix / AVD / Horizon Sites / branches Annual growth % Sizing term years
3. Email, web & network
Mail platform Microsoft 365 / Exchange Online Google Workspace (Gmail) Exchange Server on-premises Other on-prem mail gateway (MTA) Email out of scope Messages per user per day Sent + received that pass the DLP point
Inspect web uploads (web DLP)
Existing web proxy No proxy - need a web gateway On-prem proxy with ICAP (e.g. Squid, ProxySG, Skyhigh) Cloud SWG from another vendor Peak internet egress Mbps Busy-hour outbound + inbound web Internet egress points
Passively monitor egress traffic (SPAN / TAP) Visibility of non-web protocols such as FTP, IM and custom TCP.
4. Cloud apps & GenAI
Sanctioned SaaS apps to protect with API scanning
Microsoft 365 (OneDrive, SharePoint Online, Teams) Google Workspace Salesforce Box Dropbox Slack ServiceNow GitHub
Inline CASB Unsanctioned apps, personal vs corporate instances, activity-level control. GenAI app protection Stop sensitive data in prompts and uploads to ChatGPT, Copilot, Gemini and similar.
5. Data at rest (on-premises discovery)
File shares (CIFS/NFS) TB SharePoint / collaboration TB Databases to discover Full scan within days Target for a complete pass Scanning hours per day h Out-of-hours window
6. DSPM (cloud data posture)
AWS accounts Azure subscriptions GCP projects Cloud data stores Buckets, blobs, DBs, warehouses IaaS / PaaS data volume TB 0 = estimate from store count SaaS data in scope TB M365, Google, Salesforce ...
7. Capability priorities
Endpoint, channel, cloud and DSPM needs are derived from the sections above. Rate the rest here: a must have the vendor does not offer is a gap and pushes it down the ranking.
8. Operations & compliance
High availability N+1 for detection and endpoint servers, clustered management and database. Disaster-recovery site Standby management and database at a second site.
Incident retention months Incidents per day 0 = estimate from users
Regulatory frameworks in scope
Saudi PDPL (SDAIA) NCA ECC / DCC (Saudi Arabia) SAMA Cyber Security Framework UAE PDPL / NESA (IAS) EU GDPR PCI DSS v4 HIPAA ISO/IEC 27001 SOX
9. OEMs to compare
Symantec (Broadcom) Symantec DLP 26.1 with Enforce, detection servers, cloud detectors, CloudSOC CASB and DSPM
Forcepoint Forcepoint DLP 10.4, Data Security Cloud, Risk-Adaptive Protection and DSPM
Netskope Netskope One SSE: inline and API DLP, Endpoint DLP, CASB, SWG and DSPM on NewEdge
Proofpoint Human-centric Enterprise DLP: Endpoint DLP & ITM, Email DLP, Cloud DLP and DSPM
Fortra (Digital Guardian) Fortra DLP (Digital Guardian) endpoint & network DLP, Clearswift gateways, Data Classification and DSPM
Run sizing & comparison
Nothing is stored unless you press Save on the result page.