Management is concerned about sensitive information being intentionally or unintentionally emailed as attachments outside the organization by…

Before implementing any technical controls to prevent the leakage of sensitive information, an organization must first formally define what constitutes "sensitive information." This is achieved by developing and implementing an information classification scheme. This scheme categorizes data based on its level of sensitivity, criticality, and value to the organization (e.g., public, internal, confidential, restricted). This classification provides the essential foundation and criteria upon which all subsequent security controls, including email Data Loss Prevention (DLP) systems, are built and configured. Without a classification scheme, any control would be arbitrary and ineffective as it would lack a clear basis for identifying and protecting the targeted information.

A. Requiring nondisclosure agreements is a legal/contractual control that acts as a deterrent but does not technically prevent data leakage; it is not a prerequisite for configuring technical controls.

B. An acceptable use policy is a high-level administrative control. While important, it relies on an underlying information classification scheme to give specific meaning to terms like "sensitive data."

D. Notifying employees about monitoring is a crucial step for legal and privacy compliance during the implementation of the control, but it is not the first task. The organization must first decide what to monitor, which is determined by the classification scheme.

---

1. ISACA

CISA Review Manual

27th Edition (2019). Domain 5: Protection of Information Assets

Section 5.2.1 Information Classification. The manual states

"The initial step in protecting information assets is to classify the information... Classification provides the foundation for information security governance." This establishes classification as the foundational first step.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). APO14 Managed Data

APO14.02 Define and maintain data and information architecture. This practice includes activities for establishing a data classification scheme to ensure that data handling and security measures are commensurate with the data's value and sensitivity.

3. von Solms

B.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. The article emphasizes that a lack of a proper information classification scheme is a fundamental failure ("sin") in information security management

as it is impossible to protect assets if their value and sensitivity are unknown.