IT-14 Data Loss Prevention (DLP)

What is IT-14 Data Loss Prevention (DLP) Control?

Data Loss Prevention (DLP) control ensures that your organization has implemented a process to make sure that employees are not sending sensitive information outside of the organization. There is no mandatory requirement on the type of DLP used (network DLP, endpoint DLP, or cloud DLP); the auditor wants to see the configuration settings for the type of DLP you have.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Tools

Trelix

Google cloud DLP

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: No templates are available for this control

Control implementation

To implement this control,

You need to install a tool and provide the configuration settings of the tool to pass this control.

Use these best practices when configuring the tool:

• Identify and control sensitive data. It’s important to know what critical information you want to control and not leave your organization.
• Know where the data resides.
• Set conditions for accessing the data and who can access it.
• Set the actions to take in case of a security issue.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. DLP configuration settings show the policies are enabled.
2. DLP actions to take when something occurs
3. A recent example of a DLP alert

Evidence example

For the suggested action, an example is provided below:

1. DLP configuration settings show the policies are enabled.
   Source
   The following screenshot shows the enablement of policies.
   
2. DLP actions to take when something occurs.
   Source.
   The following screenshot shows incident report settings.
   
   
3. A recent example of a DLP alert.
   Source.
   The following screenshot shows the DLP alert.