Cybersecurity GRC 14 items
Data Loss Prevention (DLP) Program Audit
Audits the coverage, policy tuning, and incident handling of the data loss prevention program across endpoints, email, network, and cloud channels.
CIS v8NIST 800-53ISO 27001
Free PDF · enter your email to download.
Data Discovery & Classification
- Is sensitive data classified and labeled to drive DLP policy? *
- Is automated discovery used to locate sensitive data at rest? *
- Is a data inventory maintained mapping sensitive data to systems and owners? *
Channel Coverage
- Is DLP enforced on outbound email? *
- Is endpoint DLP deployed to control USB, printing, and local exfiltration? *
- Is DLP or CASB coverage applied to cloud and SaaS uploads? *
- Is network DLP inspecting web and file-transfer traffic?
Policy & Tuning
- Are DLP policies aligned to data classifications and regulatory obligations? *
- Are policies tuned to manage false positives while maintaining detection? *
- Are blocking, quarantine, and alert-only actions defined per policy severity? *
- Are exception and override requests logged and approved?
Incident Handling
- Are DLP alerts triaged by a defined team within an SLA? *
- Are confirmed data-loss events escalated to incident response? *
- Are DLP metrics and trends reported to management?
Download the full Data Loss Prevention (DLP) Program Audit checklist
Get it as a clean, printable PDF — free.