Symantec DLP
by Broadcom
Covered
7
controls
Partial
2
controls
Gaps
4
controls
Overview
Symantec DLP by Broadcom is a data protection solution that covers 7 NIST 800-171 controls (6% total coverage). It addresses key requirements in the data protection domain for defense contractors pursuing CMMC compliance.
Implementation Notes
Deploy Symantec DLP with FIPS-validated configurations. Integrate with your SIEM for centralized audit logging. Review partial controls quarterly to identify supplementary tooling needs.
More Data Protection Products
Implementation Guidance for Symantec DLP
Configure Symantec DLP for NIST 800-171 compliance by focusing on four key control families. For SC-28 (Protection of Information at Rest), enable database and file system scanning with custom policies targeting CUI data patterns including SSNs, ITAR technical data, and contractor proprietary information. Set encryption requirements for identified sensitive data and configure automatic remediation actions. For AC-4 (Information Flow Enforcement), implement network DLP policies at email gateways, web proxies, and endpoint agents to prevent unauthorized CUI transmission. Create granular rules based on data classification tags and user groups with block/quarantine actions for policy violations. For AU-2/AU-3 (Audit Events), enable comprehensive logging for all DLP events including policy matches, user actions, and administrative changes. Configure centralized logging to SIEM systems using syslog or API integration, ensuring logs capture user identity, timestamp, data classification, and action taken. For SI-4 (Information System Monitoring), deploy endpoint agents across all workstations and servers processing CUI, with real-time monitoring of file operations, email, and removable media. Generate assessment evidence through DLP's built-in reporting dashboard, creating compliance reports showing policy coverage, incident counts, and remediation actions. Integrate with Active Directory for user context, SIEM platforms for correlation, and ticketing systems for incident response workflows. Common misconfigurations include overly broad data identification rules causing false positives, insufficient policy tuning leading to business disruption, inadequate logging configuration missing audit trail requirements, and failure to properly classify CUI data resulting in monitoring gaps that trigger C3PAO findings during assessments.
Gap Analysis & Compensating Controls
Symantec DLP's 4 uncovered NIST controls primarily fall within Access Control (AC) and System and Communications Protection (SC) families, representing critical security gaps for defense contractors. The largest gap exists in AC-3 (Access Enforcement) where DLP cannot enforce granular user permissions or role-based access controls to CUI systems - requiring integration with privileged access management solutions like CyberArk or BeyondTrust. AC-17 (Remote Access) gaps need VPN solutions with multi-factor authentication such as Cisco AnyConnect or Palo Alto GlobalProtect. SC-8 (Transmission Confidentiality) requires network encryption tools like Fortinet FortiGate or Check Point firewalls for IPsec tunnels protecting CUI in transit. SC-13 (Cryptographic Protection) needs dedicated key management systems such as Thales CipherTrust or AWS CloudHSM for FIPS 140-2 Level 2 compliance. Document these gaps in your System Security Plan (SSP) under control implementation status as 'Partially Implemented' with detailed compensating controls description. Create POA&M entries for each gap with specific milestone dates and responsible parties. Priority closure order should follow CMMC assessment weight: AC-3 (high weight, foundational access control), SC-8 (medium-high, data protection critical), AC-17 (medium, remote work enablement), then SC-13 (medium, encryption foundation). Budget 6-12 months for complete gap closure depending on organization size and existing security infrastructure maturity.
Compliance Cost Estimate
Symantec DLP licensing ranges from $85-150 per endpoint per year depending on deployment size and feature requirements, with enterprise packages including advanced classification and machine learning capabilities. Implementation costs typically run $75,000-200,000 for mid-size contractors (500-2000 users) including professional services, policy development, and initial tuning. Annual maintenance requires 0.5-1.0 FTE security analyst for policy management, incident response, and compliance reporting, representing $60,000-120,000 in ongoing operational costs. Compared to competitors like Forcepoint DLP ($70-130/user/year) or Microsoft Purview ($5-12/user/month), Symantec offers superior classification accuracy and enterprise-grade reporting but at higher implementation complexity and cost. Total 3-year TCO averages $400,000-600,000 for typical defense contractor deployments.
Compliance Cross-References
Symantec DLP directly supports DFARS 252.204-7012 requirements for safeguarding covered defense information through automated data discovery, classification, and protection controls. For CMMC Level 2 compliance, DLP satisfies Assessment Objectives in Asset Management (AM.2.057 - data classification), Data Protection (DP.2.060 - encryption of CUI), and System and Information Integrity (SI.2.214 - malicious code protection through content inspection). The solution addresses 40% of CMMC's Data Protection domain requirements and 25% of Asset Management objectives. However, additional tools are required for Identity and Access Management (IAM) domains, requiring Active Directory integration for AC.2.007-AC.2.016 objectives. For FedRAMP alignment, Symantec DLP maps to SC-28 (Protection of Information at Rest), SI-3 (Malicious Code Protection), and AU-2/AU-3 (Audit Events) controls. Defense contractors should document DLP's role in their continuous monitoring strategy and integrate with centralized logging platforms to demonstrate real-time security posture visibility required for FedRAMP and CMMC assessments.
Frequently Asked Questions
How many NIST 800-171 controls does Symantec DLP cover?
Symantec DLP covers 7 of 110 NIST 800-171 controls (6%), with 2 partially covered and 4 gaps.
Can Symantec DLP alone satisfy CMMC Level 2?
No single tool covers all 110 NIST 800-171 controls. Symantec DLP covers 6% and should be part of a layered security stack addressing the remaining controls.
What controls does Symantec DLP not cover?
Symantec DLP does not cover controls ia-3-5-1, pe-3-10-1, cm-3-4-1, ra-3-11-1. These require supplementary solutions such as physical security controls, additional access management, or media protection tools.
Map Your Full Security Stack
See NIST 800-171 control coverage for 80+ security products.
Open NIST Tool MapperTrack Symantec DLP NIST 800-171 coverage updates with AI-powered intelligence
Signals matches SAM.gov opportunities to your profile, monitors regulatory changes, and alerts you before competitors. Free for 90 days.
Start Free — 90 Days