A customer register can leak through an intrusion, but also when someone shares a file with the wrong recipient. Here we offer practical data leakage prevention advice for organisations using ISO 27001. The reference for this topic is Annex A, control 8.12.

What is data leakage?

Data leakage means that information is accessed, transmitted, or extracted by unauthorized persons or systems - both internal and external. This includes:

Insider threats:

Employees copying customer data to personal devices
Staff sending trade secrets to competitors
Personnel taking sensitive information when they leave
Unintentional sharing of confidential documents

External threats:

Cybercriminals stealing data through breaches
Hackers exploiting vulnerabilities to access information
Malicious software extracting data automatically
Industrial espionage from competitors

Misconfigured databases exposing information
Insecure APIs leaking data
Backup systems without encryption
Cloud services with inadequate access controls

What does control 8.12 mean in practice?

Start with a sensitive set of information and follow its use. A customer register may live in a business system, be exported to Excel and be sent to a partner. Protection in the original system helps only partly if the export is left on a personal computer. Investigate the entire route, including storage and transfer outside the original system.

Then try a relevant failure scenario using test data. Could a colleague accidentally share the file with anyone holding the link? Would anyone notice an unexpectedly large export? Who could stop further sharing and investigate what happened? The answers help you choose a combination of permissions, sharing settings, training and technical safeguards. These are risk assessment examples, not a prescribed product list or a complete interpretation of the control.

Technical protection layers

The question that often comes up is “How do we protect ourselves?” and thoughts immediately turn to technical tools. Below we have a list of various tools available to do this. But - read on - it’s deeper than that.

Mimecast Incydr, Endpoint Protector, Teramind, and Microsoft Purview are all examples of technical solutions for handling insider threats.

But you also need to protect against external threats and ensure you have control over what your systems can do. Tools like Forcepoint, Zscaler, Netscope, Microsoft Defender, etc., come into scope here.

After that, you might start considering solutions like Symantec Data Loss Prevention or IBM Guardium.

In short - the list of vendors that can deliver technical solutions is long, and exactly what suits you should be based on a risk analysis - not because it’s technically impressive.

What you should do before considering system protection

Documentation and governance

Technical solutions must be complemented with:

Policies defining what is permitted and prohibited
Procedures for handling sensitive information
Training on both internal and external threats
Incident handling when leakages are detected
Regular risk assessment of new threats

Identify information assets

Map what sensitive information you handle:

Personal data and GDPR data
Trade secrets and intellectual property
Financial information and PCI data
Technical documentation and source code

Analyze the threat landscape

Understand where threats come from:

Which employees have access to sensitive data?
Which external parties can reach your systems?
What technical vulnerabilities exist?
What do your data flows look like? Tip: With AmpliFlow, you can easily document and follow up on all these parts according to ISO 27001 requirements. This is where you conduct governance of the technical solutions.

Implement protection layers

Only now is it time to start thinking about building technical defense in depth:

Preventive measures: Access control and encryption
Detective measures: Monitoring and logging
Responsive measures: Automatic blocking and incident handling It’s also wise to ensure the protection works and make these things a recurring part of how you work with information security:
Conduct penetration tests
Simulate insider threat scenarios
Test incident handling processes
Validate that legitimate business is not affected

FAQ - Frequently Asked Questions

Must we buy expensive technical solutions to comply with control 8.12?

No, not necessarily. ISO 27001 doesn’t require specific technical products. You can implement data leakage prevention through a combination of:

Policies and procedures that limit how sensitive data may be handled
Training that teaches employees to identify and avoid risks
Organizational measures like access control and authorization management
Existing tools already present in your systems Example: Instead of buying Google DLP, you can create rules that sensitive data may not be stored in Google Drive, or only allow specific folders with restricted access.

We don’t have budget for technical DLP solutions. What next?

Start with a specific leakage scenario and examine the safeguards you already have. For example, test whether a sensitive file can be shared outside the organisation. Record the gaps and discuss possible measures with the risk owner. A limited budget does not establish that a risk is acceptable or predict an audit outcome.

Is it sufficient with policies and procedures for data leakage prevention?

It depends on your risk profile. Ask yourself:

What type of sensitive data do you handle?
How large is the potential damage from leakage?
What threats do you face (internal vs. external)?
Are there regulatory requirements (GDPR, patient data laws)? For many smaller companies, well-written policies combined with training and basic technical measures are sufficient. Larger organizations with highly sensitive data usually need more advanced technical solutions.

How do we document data leakage prevention in AmpliFlow?

Below are non-exhaustive examples (there are of course many ways to do it that suit your specific needs) of how you can solve it by simply documenting using pages in AmpliFlow:

Information classification policy:

Define what counts as sensitive data
Rules for handling different information types
Requirements for labeling and protecting documents IT security policy:
Rules for internet use and email
Permitted communication channels for sensitive data
Requirements for passwords and access protection Security procedures for IT department:
Procedures for network monitoring
Log review routines
Incident handling process Risk register:
Identified data leakage risks
Selected measures or risk acceptance
Follow-up and regular reassessment

How do we assess whether control 8.12 is relevant?

Start with where sensitive information could leave your control and what the consequences would be. ISO 27001 clause 6.1.3 connects the choice of safeguards to risk treatment and the statement of applicability, SoA. Record why a safeguard is needed, how far implementation has progressed and why an Annex A control might not be necessary in your situation. Without the reasoning, you cannot distinguish a considered choice from an overlooked risk.

Risk acceptance means the risk owner takes a position on what remains after planned treatment. It is not a general exemption for measures that seem too expensive. The assessment also needs to work with the requirements applicable to your information. This article therefore makes no promise about audit results.

How often should we review our data leakage prevention?

Regularly — most organizations review at planned intervals, typically annually. Check:

New threats and vulnerabilities that may affect you
Changes in the business that create new risks
Updates to regulations that affect requirements
Effectiveness of existing measures
New technical possibilities that can improve protection Document all changes in your management system and ensure employees receive updated training.

Common mistakes

Only focusing on external threats: Studies show that the majority of data leakages come from insiders
Forgetting third parties: Suppliers and partners can also pose risks
Not monitoring privileged users: IT administrators and managers need extra monitoring
Missing mobile devices: Smartphones often contain as sensitive data as computers

Next steps

Conduct a threat analysis - identify both internal and external risks
Map information flows - understand how data moves in the organization
Prioritize protective measures based on risk and impact
Document everything in your management system according to ISO 27001 requirements
Select technical solutions that cover all identified threats Data leakage prevention according to ISO 27001 requires a holistic approach where you protect against both well-meaning employees who make mistakes and malicious actors who actively try to steal your information.

‍