Why it matters
Detects and blocks sensitive data leaving through channels you didn't intend (email, uploads, copy-paste).
How a self-led small team implements it
For most small teams, this is proportionate as access controls plus awareness training rather than dedicated DLP software.
What auditors expect to see
DLP configuration, or documented compensating controls.
Track A.8.12 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS