What it means
DLP uses classification, content inspection, context, identity, destination, and policy to monitor or restrict actions. It must balance protection, privacy, business workflow, and false positives.
Why it matters
DLP can reduce accidental and intentional disclosure when it is tied to meaningful data categories and response processes.
Practical focus
- Start with well-defined sensitive data and use cases
- Pilot monitoring before broad blocking
- Connect alerts to owners and investigation procedures
- Cover sanctioned and unsanctioned transfer paths
Common mistakes
- Deploying rules before data is classified
- Blocking common business activity with no exception path
- Treating DLP as a substitute for access control
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: