ISO 27001 Annex A 8.12 Data leakage prevention measures
What it says
Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement measures to stop sensitive data from being leaked or stolen from your systems.
Data leakage prevention is about making sure sensitive information doesn't slip out of an organisation's control and into the wrong hands. This matters because if your private data leaks, it could lead to financial losses, legal troubles, or damage to your reputation. It's like locking the door when you leave your house to keep burglars out, ensuring your data stays safe and sound.
Free. Save your status, tasks and notes.
Why it matters
Without DLP controls, sensitive data may be exfiltrated via email, web uploads or removable media, causing financial loss, reputational damage and regulatory penalties.
How to implement
The IT manager should identify and label sensitive information across systems and networks.
This means going through all digital files to figure out which data is important, like customer details or product secrets, and marking them so that everyone knows they need extra protection. Use tools to scan and classify data automatically, and follow privacy rules set by OAIC and the Privacy Act 1988.
The security team should set up and maintain data leakage prevention tools.
These tools work by watching data as it moves through your systems and stopping it from being sent to places it shouldn't go, like an unknown cloud service. They should configure these tools to automatically alert and block transfers of sensitive data unless it is authorised.
HR should include data protection responsibilities in employee training programs.
This training should help staff understand why protecting data is crucial and what risky actions, like using personal emails for work, they should avoid. Regular workshops and online courses can keep this knowledge fresh, paired with organisation policies around data use.
The compliance officer should review and update the data protection policies regularly.
This ensures that the policies align with current regulations, like the Australian Signals Directorate's Essential Eight, and reflect any changes in business operations or technology use. Regular policy audits are necessary to confirm effective application.
The finance manager should ensure that budgets allow for necessary technology and training updates.
Investing in the latest data protection tools and skills is essential for effective data leakage prevention, helping to manage risks more effectively. Consider the costs of potential data breaches when planning budgets to justify these expenses.
Keep it running
Regularly tune DLP policies for email, endpoints and cloud apps; validate alerts, review false positives, and ensure incidents are triaged and remediated promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request to see records of the data classification process.
Good evidence
Shows a comprehensive inventory of sensitive data with clear classification criteria and regular updates.
- Check 2 of 5What an auditor asks for
Ask for
Request logs from the data leakage prevention tools.
Good evidence
Logs demonstrate the tools are detecting and preventing potential leaks and include follow-up actions.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the training materials used for employee awareness on data protection.
Good evidence
Materials are comprehensive, relevant, and there is evidence of regular training sessions.
- Check 4 of 5What an auditor asks for
Ask for
Request evidence of regular policy reviews.
Good evidence
Regular review schedules are documented and policies are updated according to the latest requirements.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the budget allocation reports related to data protection.
Good evidence
There is a clear and sufficient allocation for data protection tools and employee training initiatives.
Mappings
Closest match in ASD Information Security Manual: ISM-0240, Prevent sensitive data in messaging services, which this control covers in full and more.
ASD Information Security Manual: 30 mappings
This control is broader than ISM-0240.
Annex A 8.12 requires organisations to apply data leakage prevention measures wherever sensitive information is processed, stored, or transmitted. ISM-0240 directly relates by prohibiting the use of SMS/MMS/paging and messaging apps for communicating sensitive or classified data, reducing a common exfiltration channel. ISM-0240 is a channel-specific restriction, whereas Annex A 8.12 is broader and expects DLP across many channels and technologies.
This control is broader than ISM-0267.
ISM-0267 requires blocking access to non-approved webmail services. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems and networks, and restricting access to unapproved webmail is a practical control that reduces a common data exfiltration path. ISM-0267 does not provide the broader detection, classification, and policy enforcement capabilities usually expected of DLP under Annex A 8.12.
This control is broader than ISM-0565.
ISM-0565 requires email servers to prevent and track mislabelled emails by blocking, logging and reporting inappropriate protective markings. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems and networks, which commonly includes email DLP rules that enforce classification/marking policies and alert on violations. ISM-0565 is narrower because it focuses specifically on protective marking correctness in email, whereas Annex A 8.12 covers a wider set of exfiltration vectors and sensitive-data controls.
This control is broader than ISM-0589.
ISM-0589 requires that MFDs are not used to scan or copy documents above the sensitivity/classification of the network they are connected to. Annex A 8.12 requires data leakage prevention measures across systems, networks and devices that process, store or transmit sensitive information, which would commonly include controls on MFD scan-to-network and copy workflows. ISM-0589 is a specific, device/use-case rule, whereas Annex A 8.12 is broader and can be implemented via multiple technical and procedural DLP mechanisms beyond MFDs.
This control is broader than ISM-0591.
ISM-0591 specifies the use of evaluated peripheral switches to mitigate the risk of data leakage or unauthorized command execution across different systems. This supports Annex A 8.12 (Data leakage prevention measures) as it provides a technical solution to prevent unintended data transfer via shared peripherals.
This control is broader than ISM-0682.
ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to prevent data leakage via wireless pairing and short-range communications. This relates to Annex A 8.12, which requires data leakage prevention measures for systems, networks and devices that process, store or transmit sensitive information, including restricting unauthorised data transfer channels. ISM-0682 is a single, preventative DLP control focused on eliminating one exfiltration path (Bluetooth) on high-classification mobile devices, while Annex A 8.12 is broader and can include policy, monitoring, detection and enforcement across multiple leakage vectors.
This control is broader than ISM-1157.
ISM-1157 requires evaluated diodes to control the data flow of unidirectional gateways between networks. By physically enforcing one-way flow, a diode prevents information from leaking back out of the more sensitive network, which is a strong technical data leakage prevention measure under Annex A 8.12. Annex A 8.12 covers leakage prevention across all systems, networks and devices, whereas ISM-1157 addresses only product assurance for diodes in unidirectional gateways.
This control is broader than ISM-1400.
ISM-1400 requires organisations to keep classified work data separate from personal data on privately-owned devices accessing sensitive systems or data. Annex A 8.12 requires data leakage prevention measures across systems, networks and devices that handle sensitive information, and enforced separation reduces common leakage paths (e.g. copy/paste, personal cloud sync, consumer apps). ISM-1400 is not a full DLP program, but it strengthens Annex A 8.12 by limiting where sensitive data can flow and be stored on BYOD endpoints.
This control is broader than ISM-1457.
ISM-1457 requires evaluated peripheral switches shared between SECRET and TOP SECRET systems, or between such systems in different security domains, to preferably complete a high assurance evaluation. High assurance switches reduce the risk of information leaking between the connected systems through shared keyboards, displays and mice, which supports the data leakage prevention measures required by Annex A 8.12. Annex A 8.12 covers leakage prevention across all systems, networks and devices handling sensitive information, while ISM-1457 addresses only product assurance for peripheral switches in highly classified environments.
This control is broader than ISM-1482.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned devices. Annex A 8.12 requires data leakage prevention measures across systems and devices, which supports ISM-1482 by reducing the risk of classified data being copied into personal apps, accounts, or storage locations. However, DLP can operate without true separation (it can monitor/block flows), so it is complementary rather than the same requirement.
This control is broader than ISM-1534.
Annex A 8.12 requires DLP measures to prevent sensitive information leakage. ISM-1534 addresses physical leakage vectors-like residual data in printer ribbons-requiring their removal and destruction. ISM-1534 is a narrow, device-specific safeguard, while Annex A 8.12 covers broader DLP controls across exfiltration paths.
This control is broader than ISM-1866.
Annex A 8.12 requires data leakage prevention measures to be applied to devices and systems handling sensitive information. ISM-1866 relates by requiring controls that prevent personnel from using privately-owned devices to store classified data locally, reducing loss/theft and uncontrolled copying risks. ISM-1866 focuses on endpoint/BYOD storage restrictions, while Annex A 8.12 encompasses additional leak vectors such as transmission and cloud sharing.
This control is broader than ISM-1868.
ISM-1868 requires a strong preventative control: SECRET and TOP SECRET mobile devices must not use removable media unless ASD approval is granted in advance. Annex A 8.12 requires data leakage prevention measures across systems and devices to prevent unauthorised exfiltration of sensitive information. Restricting removable media on high-classification mobiles (ISM-1868) directly strengthens DLP objectives by reducing a common offline exfiltration channel, but Annex A 8.12 also covers many other leakage vectors (network, cloud, printing) not addressed by ISM-1868.
This control is broader than ISM-1875.
ISM-1875 requires networks be scanned at least monthly to identify credentials stored in clear text. Annex A 8.12 requires data leakage prevention measures across systems and networks to prevent sensitive information exposure, which can include preventing or detecting clear-text credential leakage. ISM-1875 is a specific detective control for one high-risk data type (credentials), while Annex A 8.12 is broader and can include preventive controls (e.g. blocking, redaction, policy enforcement) beyond scanning.
This control is broader than ISM-2094.
ISM-2094 requires AI applications to implement content filtering to detect and block sensitive data exposure and improper output. ISO/IEC 27001:2022 Annex A 8.12 mandates data leakage prevention (DLP) measures across systems, networks and devices handling sensitive information, which can be implemented using AI-based content inspection and blocking. Annex A 8.12 is broader because it covers all DLP approaches (not just AI content filtering) and applies across wider technology surfaces than AI application outputs alone.
This control is broader than ISM-2099.
ISM-2099 requires that mobile devices are not connected to the infotainment systems of connected vehicles. This prevents contacts, messages and other sensitive data from being synchronised to and retained in vehicle systems outside organisational control, which is a specific data leakage prevention measure for devices under Annex A 8.12. Annex A 8.12 applies leakage prevention across all systems, networks and devices, whereas ISM-2099 addresses one leakage path.
This control partially overlaps ISM-0659.
ISM-0659 requires content filtering of files traversing gateways or CDSs to prevent harmful or unauthorised content being imported/exported. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention (DLP) measures across systems and networks that process, store or transmit sensitive information, including inspecting content in transit. They overlap where gateway/CDS content inspection includes DLP-style checks (e.g. sensitive markers/classification) as part of filtering, but Annex A 8.12 is broader across many channels and focuses on preventing data exfiltration, whereas ISM-0659 is specifically about sanitising/validating transferred files for harmful/unwanted content in either direction.
This control partially overlaps ISM-0661.
ISM-0661 holds users accountable for data transfers they perform. Annex A 8.12 requires data leakage prevention (DLP) measures across systems, networks, and devices, including logging and alerts which overlap by attributing and monitoring transfers to reinforce accountability. However, Annex A 8.12 focuses on data leakage prevention, while ISM-0661 emphasises user accountability for transfers.
This control partially overlaps ISM-0664.
ISM-0664 requires that exports from SECRET and TOP SECRET systems are reviewed and authorised by a trustworthy source prior to release. Annex A 8.12 requires data leakage prevention (DLP) measures across systems and networks handling sensitive information, which can technically enforce or monitor attempted exports and reduce the likelihood of unauthorised exfiltration. The overlap is in preventing unauthorised data leaving controlled environments, but ISM-0664 is a human/process authorisation gate for classified exports, while Annex A 8.12 is primarily a technical control set.
This control partially overlaps ISM-0669.
Annex A 8.12 requires organisations to apply DLP measures across systems, networks, and devices processing sensitive information. ISM-0669 relates by prescribing specific DLP checks during manual export from SECRET and TOP SECRET systems, like validating digital signatures and keyword checks. ISM-0669 is focused on a high-side manual export scenario, while Annex A 8.12 includes other channels (e.g., email, endpoints) and non-manual leakage paths.
This control partially overlaps ISM-1187.
ISM-1187 requires that when data is manually exported from systems, it is checked to ensure it does not carry unsuitable protective markings before it leaves the system. Annex A 8.12 requires organisations to apply data leakage prevention (DLP) measures to prevent sensitive information being inappropriately transmitted or disclosed, which can include controls around export and exfiltration paths. The overlap is that both aim to prevent inappropriate release of sensitive information during transfer/export, but ISM-1187 is specifically about validating protective markings during manual export, whereas Annex A 8.12 is broader and technology/control-pattern focused (e.g., detection/prevention across systems and networks).
This control partially overlaps ISM-1192.
ISM-1192 requires gateways to inspect and filter data flows at the transport layer and above to prevent unsafe or unauthorised content traversing the network. This overlaps with Annex A 8.12 because data leakage prevention commonly relies on inline inspection and policy-based filtering at network egress/ingress points, often implemented on secure web/email gateways or similar controls. Annex A 8.12 extends beyond gateways into endpoint and application controls and focuses specifically on preventing sensitive information exfiltration, while ISM-1192 is not limited to sensitive data and is oriented to general traffic safety and policy enforcement.
This control partially overlaps ISM-1535.
ISM-1535 requires processes and supporting procedures to prevent AUSTEO, AGAO, and REL information (textual and non-textual) from being exported to unsuitable foreign systems. Annex A 8.12 requires data leakage prevention (DLP) measures across systems and networks to stop sensitive information being leaked or exfiltrated. They overlap where DLP rules, such as blocking uploads to foreign SaaS, restricting external sharing, and monitoring egress channels, are practical mechanisms to enforce ISM-1535's export-prevention objective. However, Annex A 8.12 is broader because it also covers non-foreign leakage scenarios, such as internal misuse or domestic unauthorised disclosure.
This control partially overlaps ISM-1885.
ISM-1885 requires system owners to implement emanation security mitigation advice to reduce the risk of information leakage via electromagnetic/physical emissions from systems. ISO/IEC 27001:2022 Annex A 8.12 relates by requiring data leakage prevention measures across systems, networks, and devices handling sensitive information, which can include controls to prevent unintended disclosure through technical channels. However, ISM-1885 is specifically focused on emanations (e.g., TEMPEST-style controls, zoning/shielding/separation) whereas Annex A 8.12 is broader and typically focuses on logical/endpoint/network DLP rather than side-channel emanation risks.
This control partially overlaps ISM-1965.
ISM-1965 requires content checking for files imported or exported through gateways or CDSs to confirm they comply with security requirements. This supports ISO/IEC 27001:2022 Annex A 8.12 because gateway/CDS content inspection is a common data leakage prevention mechanism to detect and block sensitive data exfiltration (e.g. classified markings, patterns, or prohibited file types). Annex A 8.12 is broader, covering DLP across systems, networks and devices beyond gateway transfers, including monitoring, policy enforcement and user/workflow controls.
This control partially overlaps ISM-2052.
ISM-2052 requires that event logs produced by software protect any sensitive data contained within them. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems, networks and devices that process, store or transmit sensitive information, which can include preventing sensitive data exfiltration via logs or log forwarding. ISM-2052 is specifically focused on the logging artefact and its contents, while Annex A 8.12 is broader and addresses leakage pathways beyond logging.
This control supports ISM-1293.
Annex A 8.12 requires DLP measures for systems and networks handling sensitive information. ISM-1293 supports this by requiring encrypted files transferred via gateways or CDSs to be decrypted, allowing content filtering. ISM-1293 is centrally focused on gateway/CDS transfers, while Annex A 8.12 covers DLP across all platforms and channels.
This control supports ISM-1924.
ISM-1924 focuses on preventing prompt injection so the AI does not generate or disclose sensitive or harmful content due to adversarial prompts. Annex A 8.12 supports this objective by requiring data leakage prevention measures that can reduce the chance of sensitive information being exposed even if a prompt-injection attempt partially succeeds. Annex A 8.12 is broader and applies across systems and data flows, while ISM-1924 is specifically about adversarial prompt detection/mitigation at the AI interface.
This control depends on ISM-0325.
ISM-0325 reduces the risk of mishandling by ensuring connected media is treated at the highest sensitivity/classification of the system it touches. Annex A 8.12 requires data leakage prevention (DLP) measures across systems, networks, and devices processing sensitive information. Reclassifying media per ISM-0325 supports DLP by ensuring controls and handling expectations follow the highest sensitivity, but Annex A 8.12 focuses on technical prevention/detection mechanisms rather than classification escalation rules.
This control depends on ISM-1089.
ISM-1089 requires email tooling to prevent users from lowering protective markings during reply/forward, reducing the chance of mislabelling sensitive content. ISO/IEC 27001:2022 Annex A 8.12 requires data leakage prevention measures across systems that process, store or transmit sensitive information, which commonly includes email DLP policies. ISM-1089 supports Annex A 8.12 by preserving correct classification/marking signals that DLP and handling rules can act on, but it does not itself constitute comprehensive DLP across channels and content types.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-09.1Inspect outbound content on egress paths to detect unauthorised data transfersBroader than
This control is broader than IT.PRO-09.1.
IT.PRO-09.1 requires outbound content flows to be inspected to detect unauthorised transfer of sensitive or high-value data. This is a specific data leakage prevention measure that directly contributes to Annex A 8.12 at the network egress point. Annex A 8.12 is broader, requiring data leakage prevention measures across systems, networks and other devices that process, store or transmit sensitive information, including measures that prevent rather than only detect leakage.
This control depends on IT.PRO-13.3.
IT.PRO-13.3 requires regular scanning of codebases, configuration files, file shares and user collaboration platforms to identify and remediate unsecured keys, secrets and credentials. This supports Annex A 8.12 by locating a particularly sensitive class of information that is at risk of disclosure in the systems that store it and removing that exposure. Annex A 8.12 is broader, applying leakage prevention to all sensitive information across systems, networks and devices, while IT.PRO-13.3 targets secrets and credentials only.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.