SecNet.Work · 2026.10 · Sources checked: 2026-10-21

Data classification and DLP

Writing “confidential” on a document does not protect it by itself. Ownership, permitted use, recipients, storage and exceptions must work together. This guide connects discovery and labelling to a DLP pilot and incident review, using customer-list and proposal examples.

Download guide and workpapers

Original AI-assisted SecNet educational content. Examples are fictional, not publication or endorsement by referenced organizations. Implementation decisions require organization-specific approval.

What should I do tomorrow?

Choose one sharing area and its purpose with a data owner.
Classify ten synthetic documents and compare permitted recipient/channel decisions.
Pilot one DLP rule in observation mode and record false positives and misses.

Process map

Select a step to see its owner, action and exit evidence.

Scope and owner

Owner: Business owner + data governance
Action: Choose one business process and its data stores.
Exit evidence: Owned data map.

Contents and quick navigation

First three actions
Concepts
Connect classification to the business
Where discovery and labelling begin
Translate labels into handling rules
Run a controlled DLP pilot
Manage blind spots and privacy
From alert to verified improvement
Common mistakes
Decision practice
Downloadable workpapers

Put the concepts in context

Bilgi sahibi / data owner: Business role approving classification and sharing conditions based on purpose and impact.
DLP: Controls that detect, warn about or restrict defined data movements; not a replacement for labelling or access controls.
Yanlış pozitif / false positive: An activity flagged by a rule but found permissible after review.
Etiket / label: Classification metadata helping people or systems handle information; enforcement varies by tool.
Veri keşfi / discovery: Finding data and context in authorized stores without unnecessarily duplicating its contents.

Connect classification to the business

Design classes around disclosure, alteration and unavailability impacts rather than document counts. An internal lunch menu and an undisclosed merger document need different treatment. The data owner decides; IT implements. Personal data, trade secrets and contractual restrictions may need additional attributes.

Start with a few understandable classes. Public, internal, confidential and restricted are an illustrative model here, not universal legal classifications. Define authority to raise/lower labels and handle mixed-content documents. Test with representative users whether control effort matches the business need.

Label definitions include example documents and decision owners.

Related primary references: NIST SP 1800-39 — Initial Public Draft (12 February 2026) ↗

Where discovery and labelling begin

Begin with a bounded area such as a sales file share. Map repositories, email, SaaS exports and local copies. Set authorization, logging and sampling rules for discovery. Record location, suggested class and confidence instead of copying raw customer content into the report.

Automation infers from patterns and keywords but can miss business context. A test number may resemble a real identifier. Include owner review and representative validation. Test new-file labels, label propagation during copying and traceability of label removal as separate behaviours.

Discovery reports avoid unnecessary sensitive content.

Related primary references: NIST SP 1800-39 — Initial Public Draft (12 February 2026) ↗

Translate labels into handling rules

For each class define readers, external sharing, transfer channels and storage locations. Access groups and visible labels must stay consistent. Time-limited external sharing needs recipient verification, download decisions and revocation. Do not claim complete prevention of screenshots or onward disclosure.

Classification alone does not determine retention. Link purpose, legal holds and deletion rules to the separate retention matrix. Confidential files are not kept forever; public files still require integrity. Users without disclosure authority must not legitimize external sharing simply by relabelling a file.

Illustrative handling matrix; adapt locally
Class	Sharing	Control
Public	Approved publication	Publisher and integrity control
Internal	Defined staff group	Authenticated access
Confidential	Verified need-to-know recipient	Approved channel, expiring access
Restricted	Named authorized small group	Strong access, monitoring, explicit approval

Labels, access, channels and retention decisions are linked.

Run a controlled DLP pilot

Write the detection condition, covered channel and expected response. For a synthetic customer-list transfer to an unapproved external recipient, start in observation mode. Measure valid detections, false positives and missed synthetic tests separately. Silence from the tool does not demonstrate absence of leakage.

Move next to warnings and, where justified, blocking. Predetermine ownership, exception duration and rollback if essential work is disrupted. A user justification is not an unlimited bypass. Bind exceptions to recipient, purpose and duration instead of turning one case into permanent permission.

The pilot has success criteria, support and rollback paths.

Manage blind spots and privacy

An email control alone does not cover browser uploads, personal cloud, USB copies or API exports. Explicitly report visibility into encrypted archives, screenshots, unsupported files and offline devices. Assess unmanaged-device access separately. Do not assume labels survive every file format or conversion.

Alert reviewers do not need unrestricted access to every employee document. Limit previews and prefer incident IDs, rule IDs, file metadata and controlled references. Log reviewer access and justify retention. DLP deployment does not itself authorize unrelated employee-performance monitoring.

Channel gaps and reviewer permissions are recorded.

Related primary references: NIST SP 800-53 Rev. 5 — control catalog ↗

From alert to verified improvement

When a fictional proposal goes to personal email, first establish recipient, class, purpose and delivery status. Message recall does not remove every copy. Incident responders restrict access and preserve evidence; legal/privacy staff assess applicable notification duties. A choice in this teaching page is not an incident record.

Closure should go beyond warning the user. Examine the sharing workflow, missing labels and usability of approved channels. Record the rule version and reason for changes, then rerun the same permitted/prohibited samples. Report improvement only for the tested channels and sample population.

Closure is validated through rule testing and process correction.

Related primary references: NIST SP 800-53 Rev. 5 — control catalog ↗

Common mistakes and better approaches

Giving every file the highest class.: Justify classes with impact and usage examples.
Treating a label as access enforcement.: Test recipient, link and file-format behaviour separately.
Counting blocked events as success.: Measure reviewed accuracy, user impact and uncovered channels together.

Explore the reasoning behind your decision

Fictional learning situations, not an exam, score or compliance assessment. Choices and review checks last only on this open page and are not saved to your account.

False alarm

A test customer number is blocked during external sharing.

Labelled but exposed

A confidential proposal opens through an anonymous link.

Retention decision

An expired confidential report is under a legal hold.

Workpapers for your organization

Complete the four blank Markdown workpapers in your controlled organizational environment. The full guide includes tables, all decision rationales and sources.

Full guide and explained examplesMarkdown · EN Classification matrixConnect each class to impact and decision authority.Information handling rulesJoin recipients, channels and controls.DLP pilot test recordTest permitted and prohibited synthetic examples.Alert triage formReview using minimal data and clear ownership.

0 / 6 review checks selected on this page; these do not create operational evidence.

References and next work

References support the subject context; procedures and examples are original SecNet material. Verify legal applicability and current standard editions for actual use.

NIST SP 1800-39 — Initial Public Draft (12 February 2026) ↗
Discovery, identification and labelling context; an initial public draft, not a final standard. The example matrix and DLP workflow are original SecNet teaching.
NIST SP 800-53 Rev. 5 — control catalog ↗
Reference for control families; example workflows are SecNet adaptations, not automatic compliance mappings.