DAT-017 Data Leakage Prevention
Description
Controls are in place to detect and prevent unauthorised exfiltration of sensitive and personal data from systems, networks and applications. This includes monitoring for anomalous bulk data access or export, egress filtering at network boundaries, and restrictions on unapproved data transfer mechanisms.
Rationale
Environments holding large volumes of customer data are high-value exfiltration targets. DLP controls reduce both insider and external threat impact.
Applicability (9 profiles)
Framework Mappings (14)
| DSP-17 | Sensitive Data Protection | partial |
| DSP-17 | Sensitive Data Protection | partial |
| GDPR-Art.32.1 | Technical and Organisational Security Measures | partial |
| GDPR-Art.5.1f | Integrity and Confidentiality (Security Principle) | informative |
| 8.12 | Data leakage prevention | full |
| NIS2-CIR-Art.3 | Significant Incident Criteria for the Relevant Entities | informative |
| AC-23 | Data Mining Protection | partial |
| AU-13 | Monitoring for Information Disclosure | partial |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | informative |
| SI-20 | Tainting | partial |
| SI-4(18) | System Monitoring | Analyze Traffic and Covert Exfiltration | partial |
| MP-4.1-001 | AI Technology and Legal Risk Mapping | MP-4.1-001 | informative |
| MP-4.1-009 | AI Technology and Legal Risk Mapping | MP-4.1-009 | informative |
| LLM02 | Sensitive Information Disclosure | informative |
Evidence (2)
DLP tool scan results or alert reports demonstrating that sensitive data egress is monitored and anomalous bulk data transfers are detected.
Example: DLP policy report from Microsoft Purview DLP, Nightfall AI, or equivalent, showing active policies covering email, cloud storage and API egress for Confidential and Restricted data, alert counts for the last 90 days, and any escalated incidents with disposition
Test: Request the DLP tool configuration and recent alert report. Verify: (1) DLP policies are active on all primary data egress channels (email, cloud storage, API exports, messaging), (2) policies cover at minimum: bulk PII exports, unencrypted sensitive data, and data matching Restricted classification, (3) alert workflow routes to a responsible reviewer, (4) no sustained high-volume alerts are unresolved.
Network egress filtering or cloud security group configuration showing that unapproved outbound data transfer channels are restricted at the network layer.
Example: AWS Security Group or VPC Network ACL export, or cloud firewall policy, showing outbound traffic restricted to approved destinations (internal services, approved SaaS), with all other egress blocked by default in production VPC
Test: Review the production network egress configuration. Verify: (1) outbound traffic is restricted by default and requires explicit allow rules, (2) allow-listed destinations are documented and reviewed, (3) bulk file transfer protocols (FTP, SMB) to external destinations are blocked unless explicitly approved, (4) configuration changes are logged.
Questions (2)
Does your organisation have technical controls to detect and prevent unauthorised exfiltration of sensitive and personal data?
DLP controls should monitor all major egress channels (email, cloud storage, API exports, messaging). Network egress should be restricted by default. Alerts should route to a responsible reviewer.
Which data leakage prevention controls are active in your environment?
A layered approach combining application-level DLP, network egress controls and anomaly detection provides the strongest coverage. At minimum, DLP should cover email and bulk export channels for Confidential and Restricted data.