Data leakage prevention

What the control asks

Every system, network and other device that handles, holds or sends sensitive information is to be covered by measures that stop data leaking. Purpose: spot and stop people or systems disclosing or taking out information without authorization. Guidance: to reduce leakage risk, consider identifying and classifying the information to protect, for example personal data, price models or product design material; monitoring leakage channels such as email, file transfer, mobile devices and portable storage; and acting to stop leakage, for instance by quarantining emails with sensitive content. DLP tools should find and watch sensitive information exposed to disclosure, including unstructured data on user systems; detect its disclosure, for example when it is uploaded to cloud services the organization does not trust or emailed; and stop user actions or network traffic that would expose it, such as copying database entries into a spreadsheet. Decide whether to restrict copying, pasting or uploading data to services, devices and media outside the organization, and if so use DLP or configure existing tools so users can view and work on remote data without moving it outside the organization's control. Where export is needed, let the data owner approve it and hold users accountable. Deal with screenshots and photographs of screens through terms of use, training and auditing. Protect sensitive information in backups by encrypting it, limiting access and physically securing the backup media. DLP should also be considered against an adversary's intelligence gathering on confidential or secret information of geopolitical, human, financial, commercial, scientific or other value, including actions that mislead the adversary by substituting false information, such as reverse social engineering or honeypots. Other information: DLP tools identify data, monitor its use and movement and act to stop leaks, for instance warning users or blocking transfers to portable storage; because DLP monitors staff and external communications, privacy, data protection, employment and interception law must be considered before deployment; access control and document management policies (5.12, 5.15) support it.

Purpose in the standard’s terms, in our words: Spots and stops information being disclosed or taken out without authorization.

Attribute values in one line: Preventive, Detective; Confidentiality; Protect, Detect; Information protection; Protection, Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• An inventory of information types and classifications in scope for leakage protection
• DLP policies and rules covering email, web uploads, file transfer, endpoints and removable storage, with the actions taken (alert, quarantine, block)
• DLP alert and incident records with triage and follow-up
• Controls restricting copy, paste and upload outside the organization, such as virtual desktop or browser isolation settings, where the organization decided they are needed
• Data export approval records from data owners
• A legal assessment covering monitoring of personnel communications before DLP was deployed

Where audits commonly find gaps

• DLP runs in monitor-only mode indefinitely and nobody reviews alerts
• Rules cover email but not cloud uploads or personal webmail
• Sensitive data is not classified, so DLP rules cannot target it
• Backups holding sensitive data are unencrypted

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 8.7 Protection against malware
• 7.4 Physical security monitoring
• 8.20 Networks security

Read the five attributes All 93 controls