What it asks for. This control expects data leakage prevention measures to be applied to systems, networks and any other devices that process, store or transmit sensitive information. It was new in the 2022 edition.
In practice. Good practice means first identifying and classifying sensitive information, then monitoring and controlling channels where it could leave, such as email, web uploads, removable media, cloud sharing and generative AI tools. Measures can block, warn or log. Auditors expect defined sensitive data types, configured controls, alert handling records and evidence of tuning.
Common gaps. Typical gaps are tools deployed in monitor mode only, policies that miss cloud collaboration and new AI services, and alerts nobody reviews. Data protection and works council requirements for monitoring staff are also sometimes overlooked, especially in Europe.