# Data-loss investigation and control improvement

Move from a DLP alert to data, recipients, copies and verified outcomes. Connect incident closure to cause and regression evidence.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Alert, disclosure and impact

A Harbor alert reports an attempted external share. Attempt, completed delivery and actual recipient access are different observations. Separate data category, channel, destination, time window and the stage covered by the record. Business/data owners assess potential consequences. Keep hypotheses apart from facts rather than filling evidence gaps with assumptions. This exercise makes no real breach or legal-notification decision. NIST SP 800-61 Rev.3 provides dated incident-response risk-management context, while actual scope and authority still depend on the affected organization and systems.

## Authorized response and business effects

Link revocation, account restrictions, DLP changes and contacting recipients have different authority and outcome requirements. Authorized responders preserve evidence while assessing business effects and scope. Do not assume one action recalls every copy. Harbor intervenes in no real account or recipient; it asks for approval, impact and target-outcome evidence for a proposed action. Consider critical work affected by automatic blocking. Actual reporting and external communication follow authorized organizational processes; this local tool sends no messages or notifications and decides no statutory deadline.

## Avoid creating new exposure through evidence

Attaching an entire file to a case can create an unnecessary sensitive copy. Use source references, minimal samples, appropriate access and retention plans. Track integrity and who collected what for which purpose. Matching hashes alone establish neither source truth nor legal admissibility. Harbor uses fictional metadata and acquires no actual files. Distinguish evidence needed to explain scope from extra data collected out of curiosity. Keep uncertainty and unavailable sources explicit rather than compensating with broader, uncontrolled collection that may itself require protection.

## Closure and regression testing

Closure records cause, changed controls, scope and follow-up validation. A user-error label should not conceal process or interface weaknesses. Retest legitimate and prohibited examples of the scenario, comparing revisions and sources within the same scope. Harbor workpapers record residual risks and owners. Choices on this page write no points, exam result or certificate to an account. The objective is not a closed-ticket count but evidence explaining how the defined data movement is now better controlled, including what the review could not establish.

## Working sequence

1. Identify the stage observed by the alert.
2. Map data, recipients, copies and time.
3. Preserve minimal evidence with appropriate access.
4. Separate authorized response and actual outcome.
5. Record cause, regression tests and residual risk.

## 1. A DLP alert exists

An alert establishes neither actual data nor recipient scope. Avoid premature exposure conclusions without data context, recipients and preserved source evidence.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.alertExists === true
```

### Corrected implementation
```js
s => s.alertExists === true &&
  s.dataContext === true &&
  s.recipientsScoped === true &&
  s.evidencePreserved === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "alertExists": true,
        "dataContext": true,
        "recipientsScoped": true,
        "evidencePreserved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-dataContext",
      "input": {
        "alertExists": true,
        "dataContext": false,
        "recipientsScoped": true,
        "evidencePreserved": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-recipientsScoped",
      "input": {
        "alertExists": true,
        "dataContext": true,
        "recipientsScoped": false,
        "evidencePreserved": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "alertExists": true,
        "dataContext": true,
        "recipientsScoped": true,
        "evidencePreserved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-dataContext",
      "input": {
        "alertExists": true,
        "dataContext": false,
        "recipientsScoped": true,
        "evidencePreserved": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-recipientsScoped",
      "input": {
        "alertExists": true,
        "dataContext": true,
        "recipientsScoped": false,
        "evidencePreserved": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Block immediately

A block request establishes neither scope nor business effects. Do not treat it as completed response without authorization and verified target outcomes.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.blockRequested === true
```

### Corrected implementation
```js
s => s.blockRequested === true &&
  s.authorized === true &&
  s.businessImpact === true &&
  s.targetOutcome === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": true,
        "targetOutcome": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-businessImpact",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": false,
        "targetOutcome": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-targetOutcome",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": true,
        "targetOutcome": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": true,
        "targetOutcome": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-businessImpact",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": false,
        "targetOutcome": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-targetOutcome",
      "input": {
        "blockRequested": true,
        "authorized": true,
        "businessImpact": true,
        "targetOutcome": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Ticket closed

Ticket closure is not cause or regression evidence. Without residual-risk ownership and validated correction, the same movement may recreate exposure.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.ticketClosed === true
```

### Corrected implementation
```js
s => s.ticketClosed === true &&
  s.rootCauseReviewed === true &&
  s.regressionTested === true &&
  s.residualRiskOwned === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": true,
        "residualRiskOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-regressionTested",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": false,
        "residualRiskOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-residualRiskOwned",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": true,
        "residualRiskOwned": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": true,
        "residualRiskOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-regressionTested",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": false,
        "residualRiskOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-residualRiskOwned",
      "input": {
        "ticketClosed": true,
        "rootCauseReviewed": true,
        "regressionTested": true,
        "residualRiskOwned": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Fact/hypothesis/data-recipient-copy scope matrix.
- Authorized action, outcome, regression and risk-ownership record.

## References

- [NIST SP 800-61 Rev.3 · Incident response · Final April 2025](https://csrc.nist.gov/pubs/sp/800/61/r3/final)
- [NIST SP 800-122 · PII confidentiality foundation · April 2010](https://csrc.nist.gov/pubs/sp/800/122/final)
- [Microsoft Purview · Data loss prevention overview](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)