A.8.12
Data leakage prevention
Technological controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires that the movement of sensitive/critical information beyond the organization's control boundary to unauthorized recipients or locations be detected and blocked. By monitoring and governing data movement across leakage channels such as email, web/cloud uploads, removable media, printouts, remote access, and screen capture, the objective is to prevent both deliberate exfiltration and accidental exposure, thereby protecting the confidentiality of personal data, trade secrets, and intellectual property.
Key checkpoints
- Are the types and classification criteria of sensitive/critical information subject to leakage prevention defined, and is the control scope (systems/networks/endpoints/storage media) identified?
- Are detection/blocking policies established and applied for each major leakage channel (email, web/cloud upload, removable media, printouts, remote access, and so on)?
- Are policy violation events logged, with response levels (alert/approval/block) distinguished according to severity?
- Are procedures and assigned responsibilities defined for reviewing, responding to, and handling exceptions for detected violation events?
- Is control effectiveness (false positives/negatives, bypass potential) reviewed periodically, and are detection rules and policies updated?
- Are the monitoring scope and the handling of logs reviewed from the perspective of worker privacy/personal-data protection, with a basis such as notice/consent in place?
Implementation guidance
- Working from the information classification scheme, identify the data to protect (personal data, trade secrets, authentication data, intellectual property) and define detection rules (regular expressions, fingerprinting, keywords, classification labels).
- Place control points by data state: in transit (network gateways, email/web proxies), in use (endpoint agents), and at rest (cloud access security broker (CASB), repository scanning).
- Distinguish response levels in policy: log only, warn the user, allow after approval, block, or enforce encryption.
- Manage tasks that require exceptions/bypass (bulk transfers, export of development/test data) on the basis of prior approval and a validity period, and keep audit logs.
- Use initial monitoring to evaluate false positives and business impact, then choose blocking, approval, and response levels according to risk. If detection-focused operation continues, verify its approval basis, responder timelines, and the effectiveness of other leakage-prevention measures.
- Store events/logs in an access-controlled repository, and finalize the monitoring scope and notices after legal/HR review to manage the risk of privacy intrusion.
Evidence
- DLP policy/operating procedure and the classification criteria for data to be protected
- Detection/blocking rule configuration screens and policy lists by channel
- DLP violation event logs and alert/response handling history
- Exception approval requests/records and a validity-period management register
- Policy-effectiveness review (false positive/negative analysis) results and detection-rule improvement history
- Employee notice/consent and legal/HR review materials related to monitoring
Nonconformity examples
- Types of data to be protected are not defined, so DLP rules are set only nominally and fail to detect actual sensitive information.
- DLP is applied only to the email channel, while major leakage paths such as web upload, cloud, and removable media are not controlled.
- Violation events occur in large volumes, but no reviewer/responder is assigned and they are left unattended.
- Exceptions are granted indefinitely without an approval process, effectively nullifying the control.
- Known leakage risk lacks needed blocking or prompt response, with no risk assessment or compensating controls supporting continued detection-only operation.
- Retention period/access control for DLP event logs is inadequate, so they cannot be used for later investigation and root-cause analysis.