The ultimate audit guide to ISO 27001 Annex A 8.12 Data Leakage Prevention
Table of contents
- 1. DLP Policy and Scope Formalisation Verified
- 2. Endpoint Data Exfiltration Controls Confirmed
- 3. Network Gateway Egress Filtering Validated
- 4. Email Content and Attachment Scanning Verified
- 5. Cloud Service (CASB) Integration Confirmed
- 6. Sensitive Data Pattern (Regex) Accuracy Verified
- 7. DLP Incident Alerting and Triage Workflow Validated
- 8. SSL/TLS Inspection Capability Confirmed
- 9. Administrative Override and Justification Logs Verified
- 10. Periodic DLP Rule Effectiveness Review Recorded
1. DLP Policy and Scope Formalisation Verified
Verification Criteria: A documented policy exists defining data classification categories and the specific technical rules for monitoring and blocking sensitive data transfers.
Required Evidence: Approved “Data Leakage Prevention Policy” or “Information Classification and Handling Standard” citing specific technical DLP triggers.
Pass/Fail Test: If the organisation cannot produce a formal document specifying the technical scope and rules for data leakage monitoring, mark as Non-Compliant.
2. Endpoint Data Exfiltration Controls Confirmed
Verification Criteria: Technical agents are active on all user endpoints to monitor and block unauthorised data transfers to USB, Bluetooth, or local printers.
Required Evidence: Endpoint DLP management console report showing “Active” status and “Block” rules for unmanaged removable media.
Pass/Fail Test: If a standard user can successfully copy a “Confidential” tagged file to an unencrypted personal USB drive without a system block or alert, mark as Non-Compliant.
3. Network Gateway Egress Filtering Validated
Verification Criteria: Network-level DLP controls are active at the perimeter to inspect outbound traffic (SMTP, HTTP/S, FTP) for sensitive data patterns.
Required Evidence: Configuration logs from the Web Proxy or Next-Gen Firewall (NGFW) showing active SSL inspection and DLP regex pattern matching.
Pass/Fail Test: If sensitive data (e.g. credit card numbers or PII) can be uploaded to a personal cloud storage site in plain text without detection, mark as Non-Compliant.
4. Email Content and Attachment Scanning Verified
Verification Criteria: Outbound email traffic is automatically scanned for sensitive keywords, metadata, or attachments that violate the classification policy.
Required Evidence: Email Security Gateway (e.g. Mimecast, Proofpoint) logs showing “Quarantined” or “Encrypted” events based on DLP rule triggers.
Pass/Fail Test: If an email containing a list of 100+ customer records can be sent to an external personal address without being blocked or automatically encrypted, mark as Non-Compliant.
5. Cloud Service (CASB) Integration Confirmed
Verification Criteria: Data Leakage Prevention extends to SaaS and Cloud environments (e.g. O365, G-Suite, Slack) via a Cloud Access Security Broker or native DLP tools.
Required Evidence: CASB dashboard or Microsoft Purview logs showing monitoring of “Public Link Sharing” and “External Guest” data access.
Pass/Fail Test: If sensitive files stored in corporate cloud drives can be shared via “Public Link” to any internet user without administrative oversight, mark as Non-Compliant.
6. Sensitive Data Pattern (Regex) Accuracy Verified
Verification Criteria: DLP rules utilise specific patterns, such as Regular Expressions (Regex) or Fingerprinting, to identify PII, Financial Data, or Intellectual Property.
Required Evidence: Review of the “DLP Rule Library” showing specific identifiers for National Insurance numbers, Credit Card PANs, or proprietary project codes.
Pass/Fail Test: If DLP rules are only based on generic “file extensions” rather than actual data content or metadata tags, mark as Non-Compliant.
7. DLP Incident Alerting and Triage Workflow Validated
Verification Criteria: Technical DLP breaches trigger automated alerts to the Security Operations Centre (SOC) or IT team for immediate investigation.
Required Evidence: Cross-reference of a “Blocked Transfer” event in the DLP console with a corresponding ticket in the Incident Management system.
Pass/Fail Test: If DLP events are logged locally but do not notify a responder for more than 24 hours, mark as Non-Compliant.
8. SSL/TLS Inspection Capability Confirmed
Verification Criteria: The organisation possesses the technical capability to decrypt and inspect encrypted outbound traffic (HTTPS) to prevent data hiding.
Required Evidence: SSL Inspection certificates installed on endpoints and “Decrypted Traffic” logs within the network security appliance.
Pass/Fail Test: If DLP monitoring is bypassed simply by using a website with HTTPS (which covers 99% of the web), mark as Non-Compliant.
9. Administrative Override and Justification Logs Verified
Verification Criteria: Where “Allow with Justification” rules exist, the organisation captures and reviews the business reason provided by the user for the transfer.
Required Evidence: DLP “Justification Report” showing user-entered comments and subsequent management review of those overrides.
Pass/Fail Test: If users can override DLP blocks without providing a recorded reason or if those reasons are never reviewed by a supervisor, mark as Non-Compliant.
10. Periodic DLP Rule Effectiveness Review Recorded
Verification Criteria: Management or Security teams perform regular “False Positive” and “False Negative” tuning to ensure DLP rules remain effective.
Required Evidence: Quarterly DLP Performance Reports or minutes from Security Committee meetings reviewing DLP efficacy.
Pass/Fail Test: If the DLP configuration has not been reviewed or updated to reflect new data types or business processes in the last 12 months, mark as Non-Compliant.
About the author
