DHRisk domain
Data handling
Data handling covers how people move, share and protect information: bulk downloads and uploads, external sharing, personal cloud storage, email forwarding, misdelivery, classification, disposal and DLP bypass. The domain joins each action to the sensitivity of the data a person can reach and to their employment status. It catches honest mistakes and deliberate removal with the same signals. Vigilant handling counts too: labeling documents, returning assets and completing data-handling training.
Classification
- Dimensions Every signal answers one of 3 questions.
- Evidence levels
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.DS-01
- PR.DS-02
- PR.DS-10
- PR.AA-05
- MITRE ATT&CK
-
- TA0009 Collection, TA0010 Exfiltration · T1567 Exfiltration over web service, T1052 Exfiltration over physical medium, T1114 Email collection
Error and Misuse are both VERIS action categories, and the Verizon DBIR tracks misdelivery and misconfiguration under its Miscellaneous Errors pattern. Data handling is where insider risk and honest mistakes show up in the same telemetry.
Three dimensions in data handling.
- Threat0 signals
- Threat arrives from other domains, such as a phishing lure aimed at a sensitive-data holder or a compromised account reaching a repository; the domain defines no level 1 threat signal of its own.
- Access3 signals
- Access is who can reach sensitive data repositories, who handles regulated data (PCI, PHI, PII) and who is in a notice period or a role change.
- Behavior12 signals
- Behavior is what a person does with data: bulk downloads above their own baseline, external sharing, personal cloud storage, forwarding work email to personal accounts, misdelivery and DLP bypass on the risky side; labeling, secure disposal and completed data-handling training on the vigilant side.
Signals
15 signalsScroll sideways to see every column.
| ID | Signal | Dimension | Polarity | Source |
|---|---|---|---|---|
| DH-A-01 | Access to sensitive data repositories | Access | Neutral | DATA |
| DH-A-02 | In a notice period or role change | Access | Neutral | HRIS |
| DH-A-03 | Handles regulated data (PCI, PHI, PII) | Access | Neutral | DATA |
| DH-B-01 | Downloads data in bulk above own baseline | Behavior | Risky | SSE |
| DH-B-02 | Uploads data in bulk | Behavior | Risky | SSE |
| DH-B-03 | Shares sensitive data externally | Behavior | Risky | SSE |
| DH-B-04 | Violates data-handling policy | Behavior | Risky | SSE |
| DH-B-05 | Attempts to bypass DLP | Behavior | Risky | EDR |
| DH-B-06 | Forwards work email to personal accounts | Behavior | Risky | |
| DH-B-07 | Misdelivers email or shares to the wrong party | Behavior | Risky | |
| DH-B-08 | Stores work data in personal cloud | Behavior | Risky | SSE |
| DH-B-09 | Disposes of data and devices securely | Behavior | Vigilant | ITSM |
| DH-B-10 | Classifies and labels documents | Behavior | Vigilant | DATA |
| DH-B-11 | Completes data-handling training | Behavior | Vigilant | SAT |
| DH-B-12 | Blocked data transfer attempts | Behavior | Risky | SSE |
Headline metrics and grade bands
4 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-DH-1Data-handling incidents | DLP incidents per 100 people per quarter | ≤ 0.5 | ≤ 1 | ≤ 3 | ≤ 6 | Framework benchmark |
| M-DH-2Misdelivery | misdirected messages per 1,000 people per quarter | ≤ 1 | ≤ 2 | ≤ 5 | ≤ 10 | DBIR Miscellaneous Errors pattern |
| M-DH-3Leavers moving data | % of leavers with bulk movement in their notice period | ≤ 0 | ≤ 2 | ≤ 5 | ≤ 10 | Framework benchmark |
| M-DH-4Sensitive access recertified | % of sensitive-data holders reviewed in 12 months | ≥ 98 | ≥ 90 | ≥ 75 | ≥ 50 | NIST CSF PR.AA-05 |
Indicator library
33 indicators- I.0014Forwards email messages to an unauthorized mailbox
- I.0022Sends email messages to risky distribution lists
- I.0023Sends files to personal accounts
- I.0025Shares meeting links on public websites
- I.0027Removes sensitivity labels from email messages
- I.0032Shares sensitive content via email messages
- I.0033Shares sensitive data to public folders
- I.0034Shares sensitive content via chat
- I.0035Uses personal email for work correspondence
- I.0036Reveals project codes names or internal initiatives in public channels
- I.0038Screenshares confidential content in virtual meetings with external participants
- I.0100Uses personal tools to access enterprise documents
- I.0101Syncs enterprise data to personal cloud storage
- I.0126Uploads sensitive files to unauthorized web apps
- I.0128Uploads code to unsanctioned repositories
- I.0132Shares documents using view-only permissions by default
- I.0203Stores sensitive data in unprotected local folders
- I.0204Copies sensitive data to removable media
- I.0205Transfers sensitive content via clipboard
- I.0303Copies corporate files to personal devices or media
- I.0307Configures auto-forwarding of work email to personal accounts
- I.0308Shares sensitive data during screen sharing sessions
- I.0309Records meetings without participant consent
- I.0310Posts sensitive content in unsecured chat applications
- I.0316Enables video or audio in non-private settings
- I.0317Views sensitive data on screen in public areas
- I.0318Displays sensitive data on external monitors in public
- I.0323Applies privacy measures when working in shared spaces
- I.0325Avoids printing or transporting sensitive documents
- I.0326Uses blurred or virtual backgrounds during video calls
- I.0328Uses encrypted platforms for file sharing
- I.0354Posts corporate data to paste sites or public bins
- I.0355Shares internal documents on public file hosts
Cohorts in this domain
2Sequences that start here
1"Data handling" (DH), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/data-handling
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.