What evidence does ISO 27001:2022 8.12 need?

Statement of Applicability entry for control A.8.12, showing inclusion or justified exclusion, implementation status and the risks it treats. An inventory of information types and classifications in scope for leakage protection. DLP policies and rules covering email, web uploads, file transfer, endpoints and removable storage, with the actions taken (alert, quarantine, block)

8.12 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

Yes, to 1 criteria in the other framework, each with a confidence and a reason. A link is a topical overlap, not a legal equivalence.

ISO 27001:2022 8.12 evidence: Data leakage prevention

ISO 27001:2022 8.12: Data leakage prevention

ISO 27001:2022 8.12 covers Data leakage prevention. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.8.12, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is DLP runs in monitor-only mode indefinitely and nobody reviews alerts.

Every system, network and other device that handles, holds or sends sensitive information is to be covered by measures that stop data leaking. Purpose (stated in ISO/IEC 27002:2022): spots and stops information being disclosed or taken out without authorization. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.12.

What evidence supports 8.12?

Annex A technological controlStatement of Applicability entry for control A.8.12, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A technological controlAn inventory of information types and classifications in scope for leakage protection
Annex A technological controlDLP policies and rules covering email, web uploads, file transfer, endpoints and removable storage, with the actions taken (alert, quarantine, block)
Annex A technological controlDLP alert and incident records with triage and follow-up
Annex A technological controlControls restricting copy, paste and upload outside the organization, such as virtual desktop or browser isolation settings, where the organization decided they are needed

Where this requirement comes from

This is our own statement of ISO 27001:2022 8.12, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

DLP runs in monitor-only mode indefinitely and nobody reviews alerts
Rules cover email but not cloud uploads or personal webmail
Sensitive data is not classified, so DLP rules cannot target it
Backups holding sensitive data are unencrypted

How it maps to SOC 2

CC6.7 high Data leakage prevention restricts transmission to authorised destinations.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.