Control A.8.12Data leakage prevention
Data leakage prevention measures must be applied to systems, networks and any other devices that process, store or transmit sensitive information.
New in the 2022 edition, and one of the harder controls to implement well because its effectiveness depends on the organisation knowing what its sensitive information is — which is A.5.12’s classification doing the work.
Measures may be technical (monitoring or blocking transfers, controlling removable media and upload paths) or organisational (restricting who can extract data at volume). Technology applied without classification produces rules based on patterns, which catch card numbers and identifiers and miss everything that is sensitive for a reason a regular expression cannot express.
The failure mode particular to this control is the false positive. A blocking measure that interferes with legitimate work gets circumvented, and the circumvention route is one the organisation cannot see. Monitoring in detect-only mode first, tuned before enforcement, is the implementation that tends to survive.
How to put this in place
Information leaves through email, sharing links, removable media and personal uploads, often by accident. Your ISMS needs a reasoned way to spot and limit those routes for sensitive information.
- Use your classification scheme to identify what information is sensitive and the channels it can leave through.
- Rank the channels by risk and start with the top few.
- Apply restrictions and alerts using tools you already have, then add dedicated tooling only if the risk justifies it.
- Assign someone to review alerts and tune noisy rules, and tell staff what is monitored after checking privacy requirements.
- Move rules from monitor-only to enforcement once they are reliable.
Evidence an auditor usually looks for: sharing and upload restrictions, data loss prevention rules and alerts, and records of how alerts were handled.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.