Data leakage prevention

Plain-language summary

New in 2022: identifying the channels through which sensitive information could leave the organisation — email, cloud uploads, removable media, printing, messaging apps — and applying measures to detect and stop unauthorised disclosure, whether accidental or deliberate.

What the clause is really asking

Many data leaks are mundane: the wrong attachment to the wrong recipient, a customer list uploaded to a personal cloud drive, a spreadsheet of ID numbers sent over a messaging app. The control asks you to apply data leakage prevention measures to the systems, networks and devices that handle sensitive information. In practice that means knowing which information is sensitive (classification), knowing the channels it could leave by, monitoring those channels, and acting to block, quarantine, warn or alert when sensitive data moves somewhere it should not. It covers deliberate exfiltration by attackers and insiders as well as mistakes. The common misunderstanding is that DLP means buying a dedicated product; many organisations already hold capable tools in their Microsoft 365 or Google Workspace licences, and the work lies in defining what to protect and tuning the rules. The guidance also flags that monitoring staff communications raises legal questions. In South Africa that means POPIA and the interception provisions of RICA, so tell employees what is monitored, in policy and employment terms, and take legal advice before going further.

What auditors look for

Auditors ask what information you treat as sensitive and which leakage channels you have assessed — email, web upload, removable media, cloud sync, printing, personal messaging apps. They ask to see the DLP rules in your email or cloud platform and the alerts they generated last quarter, then trace one: what was detected, who reviewed it, what was done. They check USB storage controls on a sample laptop. They ask whether staff were told about monitoring and where that is written. The hard question: if someone emailed your full customer list to a personal webmail address this afternoon, would anyone know?

Typical evidence

Data leakage risk assessment covering channels and information types; information classification scheme; DLP policy and rule configuration in email, cloud and endpoint tools; removable-media and cloud-upload restrictions; DLP alert and incident records with review outcomes; staff notice of monitoring in policies or employment terms; legal review of monitoring; records of rule tuning and false-positive handling.

How to comply — recommendations

Start with your classification scheme and pick two or three high-value information types — customer personal information, ID and bank numbers, pricing or drawings. List the channels they could leave by and decide the response for each: block, warn the user, or alert. Use what you already license first: DLP policies in Microsoft Purview or Google Workspace for email and file sharing, external sharing restrictions, and removable-storage controls through endpoint management. Run new rules in audit-only mode for a month, tune out false positives, then enforce. Assign someone to review alerts weekly. Update the acceptable use policy and employment terms to state what is monitored, and take advice on POPIA and RICA before monitoring communications content.

Common nonconformities

No assessment of how sensitive information could leave the organisation; DLP capability licensed but never configured; DLP rules left in audit mode indefinitely with alerts unreviewed; unrestricted USB storage and personal cloud uploads; no restriction on external sharing; staff not informed of monitoring; leakage events not handled as security incidents.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.