Key takeaways
- Detect and prevent unauthorised disclosure of information.
- Preventing data leakage stops sensitive information leaving through email, uploads or devices.
- Start here: identify sensitive data and where it could leak.
Purpose
Detect and prevent unauthorised disclosure of information.
Requirement
Requirement summaryData leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.
Why it matters
Preventing data leakage stops sensitive information leaving through email, uploads or devices.
How to implement
- Identify sensitive data and where it could leak.
- Apply data loss prevention rules on email, cloud and endpoints.
- Block or warn on risky transfers.
- Review alerts and tune rules.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.12. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules to stop sensitive data leaking out (data leakage prevention).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.12 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Settings showing controls on email, file sharing, uploads and USB drives.
- Alerts raised and how they were checked.
- Approved exceptions with reasons.
Things you should be able to show or explain
- Be able to show a control blocking or warning about sensitive data being sent out.
How much to show: A few samples, such as example alerts or blocked-transfer records and how they were handled.
Common mistakes
- Alerts never checked.
- No controls on uploads or sharing.
- Rules so strict staff find workarounds.
- Alerts that nobody reviews.
- Tip: Start with DLP rules for your most sensitive data types.
Policies & documents to have
- Data Management Policy
FAQ
Is A.8.12 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.12?
Be ready to explain how the control works in your organisation and to provide things like: Your rules to stop sensitive data leaking out (data leakage prevention)…