Introduction to the Information Protection Life Cycle and Framework

The Information Protection Life Cycle (IPLC) and its accompanying Information Protection Framework (IPF) focus specifically on protecting information across its entire usable lifespan, addressing a gap left by broader IT and cybersecurity frameworks. The IPLC defines three stages—Acquire & Assess, Active Use Life, and Disposition—supported by six categories of controls to reduce risk as information is created, used, shared, stored, and eventually removed.

In Acquire & Assess, the core requirement is to discover and classify information so protections match real sensitivity and value. Data objects should be analyzed by content, semantics, criticality, and intended audience, recognizing that not all information deserves equal protection. Classification approaches differ by data type: structured data can track sensitivity at the database row/column/table level, while unstructured content can be tagged via metadata. Data inventories—made more common through GDPR-driven DPIAs—support this foundational step and improve downstream handling.

During Active Use Life, five control categories apply. Control Access aims for granular, policy-based access decisions using attributes of users, devices, and resources, but remains difficult at enterprise scale across mixed environments. Secure controls protect confidentiality and integrity via encryption, masking, pseudonymization, and tokenization, though deployment and interoperability are challenging. Monitor and Detect emphasizes endpoint, server, and network detection (EPP, EDR, SIEM, IDS, and ML-based NTDR), requiring skilled analysts. Contain and Recover prioritizes incident containment backed by preparation—backups, response plans, recovery procedures, and communications. Deceive introduces Distributed Deception Platforms to lure attackers into realistic fake environments, accelerating detection and reducing response time, especially where IoT/medical devices can’t run standard tools.

In Disposition, information that is no longer needed and not legally required should be archived or deleted, aligning with data minimization to reduce liability.

• The IPLC defines three stages: Acquire & Assess, Active Use Life, and Disposition.
• The framework describes six categories of controls used to secure information.
• Discovery and classification tools are the initial controls applied in the Acquire & Assess phase.
• Data objects are classified according to content, semantics, criticality, and intended audience.
• GDPR Data Protection Impact Assessments (DPIAs) have made data inventories more commonly conducted.
• Structured data classification can involve adding rows, columns, or tables to track cell-level sensitivity.
• Unstructured data classification can be implemented by applying metadata tags to individual data objects.
• Endpoint Protection (EPP) is described as anti-malware and should run on all endpoints and servers.
• Intrusion Detection Systems (IDS) are primarily rule-based and prone to false positives.
• Network Threat Detection & Response (NTDR) uses machine learning to baseline network activity and alert on anomalies.

• “To properly protect information, it must be discovered and classified.”
• “The company picnic announcement is not as sensitive and valuable as the secret sauce in your company’s flagship product.”
• “Access to information must be granular, meaning only authorized users on trusted devices should be able to read, modify, or delete it.”
• “Encryption tools are widely available but can be hard to deploy and manage.”
• “Interoperability is often a problem.”
• “Sometimes attackers get past other security controls.”
• “Once an event is underway, the top priority must be to contain the possible damage.”
• “Few organizations are truly as prepared as they need to be for the inevitable.”
• “If any activity is detected on these deception assets, it is highly likely that attackers have found them and are probing them.”
• “The principle of data minimization is a good business practice to limit liability.”