ISO 27001 A.8.12 - Data Leakage Prevention

Requirement

“Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.”

Plain-language meaning

The organization should prevent sensitive information from leaving approved locations, systems, networks, or channels without authorization. This requires understanding which information is sensitive, where it is allowed to flow, how transfers are approved, and which flows should be detected or blocked.

Data leakage prevention is not only a DLP tool. A tool can help detect or block leaks, but the real control depends on classification, approved transfer methods, user awareness, exception handling, incident response, and realistic tuning of false positives.

Why this matters

Sensitive data can leak through email, web uploads, cloud storage, messaging apps, removable media, printing, screenshots, backups, file transfers, unmanaged devices, or legitimate business flows using weak channels.

DLP is difficult because the organization must distinguish between unauthorized leakage, approved transfer, and legitimate business need that still violates risk appetite. Without clear rules, DLP alerts become noise or block business unnecessarily.

Implementation guidance

1. Define sensitive information in scope

Use classification, asset inventory, privacy records, and business requirements to define which information needs DLP controls.

Examples include:

• personal data and special category data;
• payment card data;
• intellectual property;
• source code;
• credentials and secrets;
• regulated records;
• confidential customer or supplier information.

2. Map approved data flows

For each sensitive information type, define:

3. Apply DLP controls where risk justifies them

DLP measures may include endpoint DLP, email DLP, web upload controls, cloud app controls, removable media controls, print controls, network DLP, content inspection, classification labels, encryption enforcement, or alert-only monitoring.

4. Tune alerts and false positives

False positives can make DLP unusable. The organization should define how alerts are reviewed, tuned, prioritized, and closed. High-risk data types should not be buried under noisy rules.

5. Train users on approved transfer methods

Users with access to sensitive data should understand what they may transfer, where, how, and with what authorization. They should know how to report suspected leakage.

Audit guidance

Auditors should verify:

• sensitive information scope;
• systems, networks, and devices processing sensitive information;
• approved data flow map;
• DLP tool/rule configuration;
• alert examples and prioritization;
• false-positive handling;
• blocked and allowed transfer records;
• transfer approval records;
• user awareness evidence;
• leakage incident handling and escalation.

Interview users who handle sensitive data. They should know approved sharing methods, authorization routes, and what to do if they suspect leakage.

Evidence examples

Strong evidence

• DLP scope is traceable to classified/sensitive information.
• Rules are configured for actual sensitive data flows.
• Alerts are reviewed, prioritized, tuned, and closed.
• Users know approved transfer methods and reporting routes.
• Legitimate transfers have approval evidence.
• Leakage incidents link to incident response where needed.

Weak evidence

• DLP tool is deployed but rules are generic.
• No approved data flow map exists.
• Alerts are ignored due to false positives.
• Users do not know approved sharing channels.
• Sensitive transfers happen by informal email or consumer cloud tools.
• DLP exceptions are unmanaged.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.3 Information Access Restriction
• A.8.10 Information Deletion
• A.8.11 Data Masking
• A.5.12 Classification of Information
• A.5.13 Labelling of Information
• A.5.14 Information Transfer
• A.5.34 Privacy and Protection of PII
• A.6.3 Information Security Awareness Education and Training
• Risk Assessment
• Statement of Applicability
• DLP Scope and Rule Register
• Approved Sensitive Data Flow Register
• DLP Alert Review and Tuning Log
• Sensitive Data Transfer Approval Record
• A.8.12 Audit Evidence Pack
• A.8.12 Audit Checklist

KB-ready summary

• Define sensitive information in DLP scope.
• Map approved data flows and transfer methods.
• Configure DLP rules to match risk and classification.
• Review and tune alerts.
• Train users on approved sharing and leakage reporting.

Templates and checklists

• DLP Scope and Rule Register
• Approved Sensitive Data Flow Register
• DLP Alert Review and Tuning Log
• Sensitive Data Transfer Approval Record
• A.8.12 Audit Checklist