The DOJ Just Raised the Bar on Data Security. Are You Ready?

The Department of Justice has sent an unmistakable message to U.S. businesses: You now have 90 days to prove you can control who accesses your sensitive data—or face serious consequences.

This mandate is part of the DOJ’s newly launched Data Security Program (DSP), aimed squarely at protecting critical data from unauthorized access, particularly by foreign adversaries. It’s not a guideline—it’s an operational and regulatory deadline.

“The Justice Department has made clear that companies have just 90 days to prove they can control who accesses their sensitive data—or face serious consequences.”

 — Bloomberg Law

What This Means for Enterprise Leaders

For executives, boards, and CISOs, this marks a shift from long-term compliance roadmaps to short-term accountability. The DOJ is not asking for intent. They expect proof.

This new standard requires:

• Full visibility into sensitive data assets across your entire environment

• Detailed understanding of who has access—human and machine
  

• Continuous monitoring for policy violations and trust boundary breaches

If your current tools can’t deliver this today, you may be at significant risk.

Why Legacy Tools Fall Short

Most security programs were built around infrastructure, endpoints, or identities. But the DOJ’s directive is focused on the data itself—where it resides, how it moves, who can access it, and whether that access is appropriate.

Security leaders now need to answer:

• Where is our sensitive data, and how is it classified?

• Who has access, and how was that access granted?

• Are we monitoring for unauthorized movement or exposure?

Very few platforms can answer these questions with the depth and speed regulators now require.

How Bedrock Can Help

Bedrock is purpose-built for this exact scenario. Our platform provides:

Real-Time Data Discovery and Classification
Automatically identifies sensitive data across IaaS, SaaS, and data platforms like Snowflake and Databricks.

Deep Entitlement Mapping
Unpacks access chains—across roles, services, and identities—to show who can and does access sensitive data.

Trust Boundary Monitoring
Detects when data moves outside approved environments or geographic zones.

Audit-Ready Reporting
Generates clear, defensible records of your data posture for internal and regulatory review.

The Clock Is Ticking

The DOJ’s 90-day window is already counting down. There is no time to wait for multi-month security initiatives to take hold. Boards, regulators, and customers are expecting answers now.

At Bedrock, we work with security and compliance teams to deliver real-time visibility, context, and control—at the scale today’s environments demand.

If you need to demonstrate data access control, policy enforcement, and audit-readiness in the next 90 days, we’re ready to help.

Contact us today to speak to a data security specialist.