How do we decide how to prevent data leakage and set the rules for sending information out, under ISO 27001?

Start

We must stop information leaving without authority and set rules

Two controls meet here. One protects information while it moves by email, file transfer, courier or conversation. The other detects and blocks it leaving without authority. The decision is which channels you control, how hard, and whether built-in settings are enough or a dedicated tool is justified.

• Then: Does a classification scheme exist that staff use?

Decision

Does a classification scheme exist that staff use?

The pack's rules are set by level, so an enforceable rule needs levels to work from. Without them every rule says 'sensitive' and nothing can be enforced. If staff do not use levels, answer no.

• Yes: List the channels information can leave by
• No, or not known: Classify first, then return

Outcome

Classify first, then return

A tool cannot tell what is sensitive until you tell it. Build the scheme and the handling rules, and then come back to the channels.

Step

List the channels information can leave by

Email, links to cloud sharing, messaging apps, removable media, uploads to personal and AI services, printing, and courier or conversation. The Library names email rules that ignore file-sharing links and messaging apps as a mistake. Include channels you do not want, to decide what to block.

• Then: Set a rule for each channel by level: tools, senders and recipients

Step

Set a rule for each channel by level: tools, senders and recipients

The pack's handling matrix has a row for sharing outside and one for transferring, per level. Confidential information goes only to an approved recipient, for a recorded purpose, by an approved channel, with the address checked. Write the rule per channel, not as one general sentence.

• Then: Can tools you already have limit external sharing and warn on content?

Decision

Can tools you already have limit external sharing and warn on content?

Email, office and cloud storage platforms usually have sharing limits, labels and basic content rules. The Library says to start with the tools you have. External sharing left open by default is its named mistake. If you have not looked at the settings, answer no.

• Yes: Would blocking stop legitimate work?
• No, or not known: Look at the sharing, labelling and content settings of each platform

Step

Look at the sharing, labelling and content settings of each platform

List what each email, office and storage platform can do now: external sharing limits, labels, warnings, upload restrictions. Turn on what the licence allows. Only then judge what is left for a product to do.

• Then: Does the risk justify a dedicated data loss prevention product?

Decision

Would blocking stop legitimate work?

A rule that blocks routine work is bypassed, and a tool left in monitor mode for ever is the Library's named mistake. If you do not know what normal sharing looks like, answer yes and start by warning.

• No: Block the transfer and give a safe way to do the task
• Yes, or not known: Warn and log first, with a date to move to blocking

Step

Warn and log first, with a date to move to blocking

Run the rule in warn or monitor mode for a short, fixed period, review what it catches, adjust it and then switch it to block. Record the date. Sharing with a regular partner can use an approved route that the rule allows.

• Then: Does a named person handle the alerts within a stated time?

Step

Block the transfer and give a safe way to do the task

Block what the rule prohibits and tell staff the approved alternative, such as the managed sharing site, so the task can still be done. Set a way to ask for an exception.

• Then: Does a named person handle the alerts within a stated time?

Decision

Does a named person handle the alerts within a stated time?

Rules so noisy that alerts are ignored are the Library's named mistake. Before turning on more rules, check someone reads the ones you have. If alerts go to a shared mailbox, answer no.

• Yes: Do you regularly exchange Confidential information with a partner?
• No, or not known: Name who reviews alerts, how fast, and what counts as an incident

Step

Name who reviews alerts, how fast, and what counts as an incident

Give the alerts an owner and a response time. Set a short list of what must go to the incident route, such as a bulk export or a Confidential file sent to a personal address.

• Then: Do you regularly exchange Confidential information with a partner?

Decision

Does the risk justify a dedicated data loss prevention product?

Then consider regulated data in volume, a customer or regulator expecting it, built-in tools that cannot cover a major channel, and your capacity to run it. Public sources say the control does not require a product, though some vendors claim otherwise. If the gaps in your list are small, answer no. If yes, trial a tool on your highest-risk channel, measure false alerts and cost the people to tune it.

• No: Record the rules and settings as the treatment, accepted by the owner
• Yes: Does a named person handle the alerts within a stated time?

Step

Record the rules and settings as the treatment, accepted by the owner

Write down what the built-in controls do and do not cover, and have the risk owner accept the remainder. This is a valid treatment, as long as it is a recorded decision. Say which built-in limits you turned on and which channels remain open.

• Then: Does a named person handle the alerts within a stated time?

Decision

Do you regularly exchange Confidential information with a partner?

The Library asks for transfer terms in agreements with parties you exchange information with regularly: what may be sent, how, who may receive it and what happens at the end. If you have such partners and no terms, answer yes.

• Yes, or not known: Put transfer terms in the agreement
• No: Can staff paste Internal or Confidential data into AI tools?

Step

Put transfer terms in the agreement

State the channel, the encryption, who may receive, the retention and how the partner reports loss. Use the clause library as a start.

• Then: Can staff paste Internal or Confidential data into AI tools?

Decision

Can staff paste Internal or Confidential data into AI tools?

AI tools and personal storage are channels. The pack's classification policy lets Internal and Confidential information into only the AI tools the organisation has approved for that level, under a contract that bars training on its data. If you have no list of approved tools, answer yes.

• Yes, or not known: Name the approved tools by level and block the rest
• No: Send a test item through each channel

Step

Name the approved tools by level and block the rest

Publish the list and the levels allowed, enforce it at the web or sign-in layer where you can, and ask staff to report accidental pastes. The AI tools question covers the terms.

• Then: Send a test item through each channel

Step

Send a test item through each channel

Use a harmless file marked at the highest level and try each channel, including a personal address. Show whether it is blocked, warned, logged or alerted. The Library lists the rules and how alerts were handled as evidence.

• Then: Did every channel behave as the rule says?

Decision

Did every channel behave as the rule says?

Any channel that let the item through silently is a gap. If you did not test, answer no.

• Yes: Leakage and transfer rules set, tested and owned
• No, or not known: Adjust the rule or the setting, then test again

Step

Adjust the rule or the setting, then test again

Fix the setting that failed, record the change and test the same channel again. Repeat until the test behaves as the rule says.

• Then: Send a test item through each channel (back to an earlier step)

Outcome

Leakage and transfer rules set, tested and owned

Keep the channel list, the rules, the settings, the alert handling record and the test result. Do not say you have data loss prevention because a product is installed in monitor mode, or that information cannot leave because one channel is blocked.