ISO 27001 A.8.12: Data leakage prevention

Build your DLP strategy around your data classification scheme. Identify which data categories need DLP protection, map the most likely leakage channels, and define what happens when a policy triggers - alert, block, or quarantine. Deploy DLP across all three domains. For data in motion: set up email DLP to scan outgoing messages and attachments for sensitive content. Configure web DLP to monitor uploads to cloud services, file sharing sites, and social media. Deploy network DLP to inspect outbound traffic for sensitive data patterns. Consider SSL inspection for encrypted channels where legally appropriate. For data in use: deploy endpoint DLP to monitor USB copying, printing, screen capture, and clipboard activity. Configure application-level restrictions on data export and sharing. Use information rights management (IRM) to enforce usage controls on classified documents. For data at rest: scan file servers, databases, and cloud storage to find sensitive data in places it should not be. Flag over-shared files and excessive permissions. Identify data sitting in locations without adequate protection. Write DLP policies that specify what to protect, what triggers alerts versus blocks, and how to handle exceptions. Start in monitoring mode. Seriously - run in monitor-only for a few weeks to understand your data flows and tune out false positives before you start blocking anything. Common policies include: blocking external email of credit card data, alerting on bulk downloads, restricting USB transfers of classified documents, and preventing uploads to unauthorised cloud services. Set up proper incident management for DLP alerts. Define who reviews them, how investigations work, and what actions follow. Separate accidental violations (which need user education) from potential data theft (which needs formal investigation). Report DLP metrics to management regularly.