DLP policy enforcement

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the DLP policy configuration; confirm classified-data patterns are defined and mapped to block or quarantine actions.
2. 2.Confirm DLP coverage extends to all collaboration channels in use (email, chat, file sharing), not only email.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Attempt to share a test file containing classified-data patterns through a covered channel and confirm it is blocked or quarantined.
2. 2.Select 25 quarantined events from the period and confirm each was reviewed and dispositioned.
3. 3.Review DLP policy change logs to confirm no unauthorized weakening occurred during the period.

Linked risks

• Customer data breachmitigation 2
• Data loss via collaboration toolsmitigation 3
• AI copilot data leakagemitigation 1

Framework mappings & latest test