[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-12":3},{"item":4,"lessons":16,"controls":31,"related":49},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-12","Annex A 8.12","ISO\u002FIEC 27001:2022 Annex A 8.12: Data leakage prevention",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects data leakage prevention measures to be applied to systems, networks and any other devices that process, store or transmit sensitive information. It was new in the 2022 edition.\n\n**In practice.** Good practice means first identifying and classifying sensitive information, then monitoring and controlling channels where it could leave, such as email, web uploads, removable media, cloud sharing and generative AI tools. Measures can block, warn or log. Auditors expect defined sensitive data types, configured controls, alert handling records and evidence of tuning.\n\n**Common gaps.** Typical gaps are tools deployed in monitor mode only, policies that miss cloud collaboration and new AI services, and alerts nobody reviews. Data protection and works council requirements for monitoring staff are also sometimes overlooked, especially in Europe.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},3,[19,23,27],{"slug":20,"title":21,"published_at":22},"stolen-github-credentials-enable-mass-ci-secret-theft-across-61000-repositories","Stolen GitHub Credentials Enable Mass CI Secret Theft Across 61,000 Repositories","2026-11-12T09:20:57.681+00:00",{"slug":24,"title":25,"published_at":26},"italian-hospital-fined-10000-for-publishing-sensitive-candidate-data-online-for-five-years","Italian Hospital Fined €10,000 for Publishing Sensitive Candidate Data Online for Five Years","2026-09-08T10:22:33.886+00:00",{"slug":28,"title":29,"published_at":30},"employee-email-mistake-costs-electricity-company-212-in-gdpr-damages","Employee Email Mistake Costs Electricity Company €212 in GDPR Damages","2026-06-24T10:21:37.436+00:00",[32,37,41,45],{"slug":33,"name":34,"problem":35,"stories":36},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":38,"name":39,"problem":40,"stories":36},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":42,"name":43,"problem":44,"stories":36},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":46,"name":47,"problem":48,"stories":36},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[50,55,60,64,69,73,77,81],{"family":51,"item":52,"code":53,"title":54,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":56,"item":57,"code":58,"title":59,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":56,"item":61,"code":62,"title":63,"together":9},"3","Control 3","Data Protection",{"family":65,"item":66,"code":67,"title":68,"together":9},"nist-800-53","si-12","SI-12","Information Management and Retention",{"family":51,"item":70,"code":71,"title":72,"together":36},"32","Article 32","Security of processing",{"family":51,"item":74,"code":75,"title":76,"together":36},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":51,"item":78,"code":79,"title":80,"together":36},"25","Article 25","Data protection by design and by default",{"family":51,"item":82,"code":83,"title":84,"together":36},"17","Article 17","Right to erasure ('right to be forgotten')"]