Data leakage prevention

What the requirement asks

Every system, network and other device that handles, holds or sends sensitive information is to be covered by measures that stop data leaking. Purpose: spot and stop people or systems disclosing or taking out information without authorization. Guidance: to reduce leakage risk, consider identifying and classifying the information to protect, for example personal data, price models or product design material; monitoring leakage channels such as email, file transfer, mobile devices and portable storage; and acting to stop leakage, for instance by quarantining emails with sensitive content. DLP tools should find and watch sensitive information exposed to disclosure, including unstructured data on user systems; detect its disclosure, for example when it is uploaded to cloud services the organization does not trust or emailed; and stop user actions or network traffic that would expose it, such as copying database entries into a spreadsheet. Decide whether to restrict copying, pasting or uploading data to services, devices and media outside the organization, and if so use DLP or configure existing tools so users can view and work on remote data without moving it outside the organization's control. Where export is needed, let the data owner approve it and hold users accountable. Deal with screenshots and photographs of screens through terms of use, training and auditing. Protect sensitive information in backups by encrypting it, limiting access and physically securing the backup media. DLP should also be considered against an adversary's intelligence gathering on confidential or secret information of geopolitical, human, financial, commercial, scientific or other value, including actions that mislead the adversary by substituting false information, such as reverse social engineering or honeypots. Other information: DLP tools identify data, monitor its use and movement and act to stop leaks, for instance warning users or blocking transfers to portable storage; because DLP monitors staff and external communications, privacy, data protection, employment and interception law must be considered before deployment; access control and document management policies (5.12, 5.15) support it. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Data leakage prevention is a set of controls, not a product. The guidance asks for the data, the channel, the rule, the alert and the response.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep an inventory of information types and classifications in scope for leakage protection and one live sample together.

Evidence an assessor asks for

• Data leakage preventionAn inventory of information types and classifications in scope for leakage protection
• Data leakage preventionDLP policies and rules covering email, web uploads, file transfer, endpoints and removable storage, with the actions taken (alert, quarantine, block)
• Data leakage preventionDLP alert and incident records with triage and follow-up
• Data leakage preventionControls restricting copy, paste and upload outside the organization, such as virtual desktop or browser isolation settings, where the organization decided they are needed
• Data leakage preventionData export approval records from data owners
• Data leakage preventionA legal assessment covering monitoring of personnel communications before DLP was deployed

The question an assessor will ask

An assessor will ask for an inventory of information types and classifications in scope for leakage protection, then trace it to the system it protects. For A.8.12 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• DLP runs in monitor-only mode indefinitely and nobody reviews alerts
• Rules cover email but not cloud uploads or personal webmail
• Sensitive data is not classified, so DLP rules cannot target it
• Backups holding sensitive data are unencrypted

Before the next audit

Before the next audit, check one live sample for this gap: dlp runs in monitor-only mode indefinitely and nobody reviews alerts.