A data loss prevention strategy and approach are formally established to spot and stop sensitive data leaving the organization's network and controls, whether on purpose or by mistake, using directive, preventive and detective controls over data in use, in motion and at rest. Roles and responsibilities are defined and communicated; DLP policy, standards and procedures are applied in the same way on-premises and in the cloud; DLP tools are selected and implemented in line with the strategy; awareness and training are delivered; and effectiveness is measured and improved. Controls use cataloging and classification to set scope and may include enforced encryption and tokenization by classification, blocking egress to unexpected domains, blocking or monitoring transfers to endpoint devices, monitoring flow logs and cloud API and application logs, monitoring user behaviour and resource configurations, and incident triage, drawing on the providers' native DLP features.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.