A.8.12 Data leakage prevention
Apply data leakage prevention to systems and channels handling sensitive information.
15
artefacts
3
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Export of rule set definitions · Cloud console / configuration management
- Alert logs for outbound data transfers · SIEM / log platform
- Incident ticket for a DLP breach · Ticketing / ITSM
periodic reviewEvidence produced at each review
- Configuration screenshots of the DLP tool · Cloud console / configuration management
- Change management records for DLP rule updates · Ticketing / ITSM
- Monthly DLP incident summary report · SIEM / log platform
- Attendance register for DLP training sessions · HR system / LMS
governing documentDocuments that govern the control
- Data Leakage Prevention policy document · Policy repository / GRC workspace
- Policy approval meeting minutes · Policy repository / GRC workspace
- Version control log for the policy · Policy repository / GRC workspace
- Analysis of false positives and false negatives · Policy repository / GRC workspace
- Root cause analysis report · Document repository
- Corrective action plan with closure evidence · Policy repository / GRC workspace
- Curriculum for data handling and DLP training · HR system / LMS
- Quiz results confirming employee comprehension · HR system / LMS
First move
Mostly documents and reviews. Pull the 3 system-held artefacts from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Policy not enforced across all data channels
- DLP rules outdated and misaligned with business processes
- Insufficient monitoring and alert retention
- Lack of documented response to DLP incidents
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet