A.8.12 Technological
Data leakage prevention
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (13)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-4mostlyaligns with — Both enforce controls on information flows to prevent sensitive data from moving to unauthorized recipients or external systems.
- SC-7mostlyaligns with — Both controls focus on preventing unauthorized exfiltration of sensitive data at network and system boundaries through monitoring and blocking mechanisms.
- SI-4mostlyaligns with — Both emphasize continuous monitoring of information flows and user actions to detect and respond to unauthorized disclosure of sensitive data.
- AC-21partialaligns with — Both require controls and approvals before sensitive information is shared or exported outside organizational boundaries.
- MP-7partialaligns with — Both address restrictions on the use of external media and devices to prevent unauthorized copying or removal of sensitive information.
- SC-8partialaligns with — Both protect sensitive information during transmission by preventing unauthorized disclosure through monitoring and blocking of data in transit.
Aligned NIST CSF 2.0 outcomes (11)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.DS-01mostlyaligns with — The ISO control's use of DLP tools to identify, monitor, and block unauthorized disclosure of sensitive data directly supports protecting the confidentiality of data-at-rest.
- PR.DS-02mostlyaligns with — Monitoring and blocking data exfiltration over email, file transfers, and uploads implements controls that protect the confidentiality of data-in-transit.
- DE.CM-03partialaligns with — DLP monitoring of user actions and data movements on endpoints and networks fulfills the outcome of detecting potentially adverse events through personnel and technology usage monitoring.
- ID.AM-07partialaligns with — Classifying and identifying sensitive information to protect against leakage presupposes an inventory of data and metadata for designated data types.
- PR.AA-05partialaligns with — Requiring data-owner approval for exports and holding users accountable for actions outside organizational control enforces access permissions and authorizations.
- PR.PS-04partialaligns with — The requirement to monitor channels and detect disclosure events generates log records that feed continuous monitoring and incident detection capabilities.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.2.3mostlyaligns with — Both require controls that stop sensitive data from leaving the organization to untrusted external parties.
- V13.2.4partialaligns with — Both rely on allow-listing permitted destinations to prevent unauthorized transmission of data.
- V14.2.1partialaligns with — Both emphasize keeping sensitive data out of URLs and other locations where it could be inadvertently disclosed.
- V5.4.3partialaligns with — Both call for scanning or blocking content that could carry sensitive or malicious data before it leaves the system.
Related weaknesses / CWE (43)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1323mostlyprevents — DLP mechanisms can detect and block exfiltration of trace data.
- CWE-200mostlyfinds — By continuously inspecting data flows and blocking transmissions that contain classified sensitive content, the control stops the unauthorized release of information that would otherwise occur through missing or bypassed access-control checks.
- CWE-359mostlyprevents — Monitoring and quarantining outbound messages that contain personal or private data directly reduces the chance that such information will be disclosed to unauthorized recipients.
- CWE-402mostlyfinds — Data-leakage-prevention technologies specifically block unintended transmission of sensitive resources.
- CWE-524mostlyprevents — Data leakage prevention can block unauthorized access to cached sensitive information.
- CWE-1230partialfinds — DLP solutions can detect and block metadata leakage, yet are not designed solely for this weakness.
- CWE-201partialmitigates — DLP controls inspect and block outbound flows that contain sensitive information.
- CWE-202partialfinds — DLP can detect and block queries or result sets that risk exposing sensitive information.
- CWE-212partialmitigates — DLP policies can block or sanitize sensitive data before it leaves the system.
- CWE-213partialmitigates — DLP can block unintended disclosure arising from policy mismatches.
- CWE-284partialmitigates — Enforcing egress rules on channels such as email and removable media reduces the impact of overly permissive access-control configurations by preventing data from leaving the authorized boundary even when access was granted.
- CWE-312partialfinds — When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.
- CWE-313partialfinds — DLP can detect and block attempts to write sensitive data in cleartext.
- CWE-314partialmitigates — DLP can detect leakage of registry-stored secrets but does not prevent the storage itself.
- CWE-315partialmitigates — Implements data leakage prevention that can block exfiltration of sensitive cookie data but does not stop the storage itself.
- CWE-316partialmitigates — DLP tooling can monitor and block processes that leave sensitive data unencrypted in memory.
- CWE-499partialmitigates — DLP can detect serialized sensitive data in transit but does not prevent the coding weakness itself.
- CWE-515partialfinds — DLP can detect or block covert storage flows but does not address all covert storage techniques.
- CWE-526partialmitigates — DLP policies can detect and block the placement of sensitive data into environment variables.
- CWE-528partialmitigates — DLP can detect or block leakage of core-dump contents, yet is not the primary control for file placement.
- CWE-532partialmitigates — DLP inspection of logs and file transfers can detect and block the inadvertent placement of sensitive tokens or credentials into externally accessible log files before they are written or transmitted.
- CWE-539partialmitigates — Data leakage prevention controls can block or encrypt sensitive information in cookies.
- CWE-598partialmitigates — DLP solutions can detect and block sensitive data in URLs.
- CWE-612partialmitigates — Data leakage prevention can block unauthorized index exposure but is supplementary.
- CWE-921partialmitigates — DLP can detect leakage but does not implement access controls on the storage mechanism itself.
- CWE-927partialmitigates — DLP policies and technical controls directly prevent sensitive data from leaving via insecure implicit intents.
- CWE-318nonenone — DLP can detect leakage of the stored secrets but does not stop their initial cleartext storage.
- CWE-591nonemitigates — DLP can detect leakage of sensitive data from swap, yet does not prevent the data from being written there.
- CWE-792nonenone — Data leakage prevention may catch some downstream effects of unfiltered data but does not address the root filtering weakness.
Mitigated MITRE ATT&CK techniques (7)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1041mostlyprevents — By inspecting traffic on common exfiltration channels such as email or web uploads, DLP can interrupt data being sent over established C2 channels.
- T1530mostlyprevents — DLP monitors uploads to untrusted cloud storage services, preventing the bulk transfer of sensitive files stored in cloud repositories.
- T1567mostlydetects — Web-service DLP rules detect and block the posting or uploading of sensitive information to external web or cloud destinations.
- T1005partialmitigates — DLP agents inspect local file-system and clipboard activity, blocking or alerting on attempts to read and stage sensitive files before they can be collected.
- T1025partialdetects — DLP policies can detect and block the transfer of classified data onto removable media, directly preventing collection via USB or other portable devices.
- T1113partialmitigates — Policy, training, and technical controls discourage or restrict screen-capture actions that would otherwise collect displayed sensitive information.
- T1114partialmitigates — Email-channel DLP inspects outbound messages for sensitive content and can quarantine or block messages that would otherwise exfiltrate mailbox data.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01partialmitigates — By blocking unauthorized exfiltration of data, the control limits the impact of access-control violations that would otherwise allow sensitive information to leave the application.
- A02partialprevents — Automated detection and blocking of sensitive data leaving the system compensates for misconfigured services or overly permissive outbound channels that would otherwise expose information.
- A04partialfinds — Requiring encryption of backups and restricting copy/paste or uploads outside organizational control reduces the chance that cryptographic weaknesses will lead to plaintext disclosure.
- A08nonemitigates — Preventing unauthorized copying or transmission of data to external services or devices directly counters integrity failures that could result from tampering or substitution during data movement.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.