Use data masking, pseudonymization or anonymization to limit exposure of sensitive data, especially where full data is not needed for the task at hand.
What an auditor, or Sekit's evidence engine, asks for.
Data loss prevention configuration
The controls that prevent sensitive data from leaving the company without authorisation, and techniques to mask or anonymise data.
From the Sekit evidence catalog
In practice
Data masking gaps show up most often in test and staging environments, where a copy of the production database gets restored for debugging and nobody strips out real customer names, emails, or payment details first. The classification labels a company defines rarely extend automatically into DLP tooling, so confidential exports can slip past outbound filters that were configured once and never tuned. A working control masks or synthesizes data before it reaches non-production systems, sets a written policy for which data categories must never leave the company and through which channels, and reviews DLP alerts on a regular cycle so confirmed attempts to exfiltrate sensitive data get followed up rather than filed away.
Common gaps
Staging and test environments run on unmasked copies of production data, so a developer laptop breach exposes real customer records.
DLP rules were configured once at rollout and never tuned, so alerts either flood the queue or miss real exfiltration attempts.
No policy names which data categories must never leave the company, so blocking decisions are made case by case with no consistent basis.
Questions your auditor will ask
Is customer data masked before it lands in test or staging environments?
Yes, a masking or synthesis step runs before any production data copy reaches non-production systems.
What data is DLP tooling configured to block from leaving the company?
The categories named in the DLP policy, including payment details and customer PII, monitored across email and cloud sharing channels.
How often are DLP alerts reviewed and rules adjusted?
On a recurring cycle, where the security owner tunes rules and follows up every confirmed attempt to move sensitive data out.
Do classification labels drive what DLP filters block?
Where tooling permits, yes: confidential-labeled content triggers stricter sharing limits and outbound warnings automatically.
Where regulation demands it
NIS2 12.2 requires classified assets to be handled per their sensitivity, and ENS mp.info.1 sets protection obligations for personal data that pseudonymization and masking directly serve.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.