8.12 Data leakage prevention

Every system, network and other device that handles, holds or sends sensitive information is to be covered by measures that stop data leaking. Purpose: spot and stop people or systems disclosing or taking out information without authorization. Guidance: to reduce leakage risk, consider identifying and classifying the information to protect, for example personal data, price models or product design material; monitoring leakage channels such as email, file transfer, mobile devices and portable storage; and acting to stop leakage, for instance by quarantining emails with sensitive content. DLP tools should find and watch sensitive information exposed to disclosure, including unstructured data on user systems; detect its disclosure, for example when it is uploaded to cloud services the organization does not trust or emailed; and stop user actions or network traffic that would expose it, such as copying database entries into a spreadsheet. Decide whether to restrict copying, pasting or uploading data to services, devices and media outside the organization, and if so use DLP or configure existing tools so users can view and work on remote data without moving it outside the organization's control. Where export is needed, let the data owner approve it and hold users accountable. Deal with screenshots and photographs of screens through terms of use, training and auditing. Protect sensitive information in backups by encrypting it, limiting access and physically securing the backup media. DLP should also be considered against an adversary's intelligence gathering on confidential or secret information of geopolitical, human, financial, commercial, scientific or other value, including actions that mislead the adversary by substituting false information, such as reverse social engineering or honeypots. Other information: DLP tools identify data, monitor its use and movement and act to stop leaks, for instance warning users or blocking transfers to portable storage; because DLP monitors staff and external communications, privacy, data protection, employment and interception law must be considered before deployment; access control and document management policies (5.12, 5.15) support it.

Source: ISO/IEC 27002:2022, 8.12. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.