In this ultimate how to implement guide to ISO 27001 Annex A 8.12 Data Leakage Prevention, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
- 1. Define Sensitive Data Strings (RegEx)
- 2. Enforce USB and Removable Media Blocking
- 3. Configure Email Outbound Filtering
- 4. Restrict Uploads to Personal Cloud Storage
- 5. Implement Endpoint DLP Agents
- 6. Secure Print output
- 7. Disable Unsecured Network Protocols
- 8. Tune False Positives and Business Rules
- 9. Enable Digital Rights Management (DRM)
- 10. Establish a Violation Response Process
1. Define Sensitive Data Strings (RegEx)
Control Requirement: Identification and classification of information to be protected from leakage.
Required Implementation Step: Configure your DLP engine with specific Regular Expressions (RegEx) relevant to your data. Do not rely on generic “PII” templates. Input exact patterns for your customer IDs, project codenames, and specific credit card formats to ensure the tool knows exactly what to look for.
Minimum Requirement: You must technically define what “Sensitive Data” looks like in the scanning engine.
2. Enforce USB and Removable Media Blocking
Control Requirement: Prevent unauthorised data copying to physical media.
Required Implementation Step: Use Group Policy (GPO) or your Endpoint Detection and Response (EDR) agent to block write access to all USB mass storage devices by default. Create a whitelist for specific, encrypted, company-issued drives only if absolutely necessary.
Minimum Requirement: “Read-Only” access for USBs; “Write” access must be technically disabled.
3. Configure Email Outbound Filtering
Control Requirement: Monitor and block sensitive data transmission via email.
Required Implementation Step: Configure rules in your email gateway (e.g., Exchange Online, Mimecast) to block messages containing defined sensitive patterns (see Step 1) or more than 5 attachments. Implement a “Policy Tip” that warns users before they click send if sensitive data is detected.
Minimum Requirement: Automated encryption or blocking of emails containing PII or financial data.
4. Restrict Uploads to Personal Cloud Storage
Control Requirement: Prevent exfiltration to unauthorised cloud services.
Required Implementation Step: Configure your web gateway or firewall to block uploads to personal storage categories (e.g., Personal Gmail, Dropbox, WeTransfer). Allow download access if needed for business, but “Post/Upload” actions must be strictly denied to non-corporate tenants.
Minimum Requirement: Network-level blocking of “Shadow IT” storage repositories.
5. Implement Endpoint DLP Agents
Control Requirement: Monitor data movement at the user workstation level.
Required Implementation Step: Deploy host-based DLP agents to all workstations. Configure them to monitor the clipboard, screen capture tools, and file system. Prevent users from copying data from “Corporate” applications (e.g., Salesforce) and pasting it into “Personal” applications (e.g., Twitter/X).
Minimum Requirement: Preventing the “Copy/Paste” of sensitive data between managed and unmanaged apps.
6. Secure Print output
Control Requirement: Prevent leakage of data via hard copy.
Required Implementation Step: Implement “Follow-Me” printing where users must physically authenticate at the printer to release a job. Configure the print server to watermark documents with the username and timestamp of the person printing.
Minimum Requirement: Logs of exactly who printed what document and when.
7. Disable Unsecured Network Protocols
Control Requirement: Prevent data transfer via unencrypted or unmonitored channels.
Required Implementation Step: Block outbound traffic on ports associated with FTP (21), Telnet (23), and legacy SMB. Force all file transfers to occur via SFTP or HTTPS channels that can be inspected by your SSL/TLS decryption appliance.
Minimum Requirement: If you cannot inspect the traffic, you cannot prevent the leak.
8. Tune False Positives and Business Rules
Control Requirement: Minimise disruption to legitimate business activities.
Required Implementation Step: Dedicate a weekly review session to analyse DLP logs. Whitelist legitimate business workflows that are triggering false positives. A DLP system that blocks everything will simply be bypassed or ignored by frustrated users.
Minimum Requirement: Evidence of active tuning; a “Set and Forget” DLP system is useless.
9. Enable Digital Rights Management (DRM)
Control Requirement: Protection of information even after it leaves the network.
Required Implementation Step: Apply Azure Information Protection (AIP) or similar DRM labels that travel with the file. Configure the “Confidential” label to restrict access to authenticated employees only, rendering the file unreadable if leaked to an external party.
Minimum Requirement: Files must require authentication to open, regardless of where they are stored.
10. Establish a Violation Response Process
Control Requirement: Appropriate action must be taken when leakage is detected.
Required Implementation Step: Define the HR and Legal workflow for a confirmed data leak. Automate the alert to the Security Operations Centre (SOC). If a user attempts to copy the customer database to a USB, their account should be automatically disabled pending investigation.
Minimum Requirement: Automated response actions for high-severity data exfiltration attempts.
About the author
