What an auditor, or Sekit's evidence engine, asks for.
Data loss prevention configuration
The controls that prevent sensitive data from leaving the company without authorisation, and techniques to mask or anonymise data.
From the Sekit evidence catalog
In practice
Test data protection usually fails quietly: a developer needs realistic data to reproduce a bug, so a copy of the production database gets exported into a test environment, and masking is treated as an optional step that gets skipped under deadline pressure. Auditors expect data loss alerts to be reviewed on a regular cycle, with confirmed attempts to move sensitive data into a lower environment followed up rather than dismissed as a false positive. The evidence that matters is not a masking policy on paper, but a record showing masked or synthetic data populating test and development environments where personal or sensitive information would otherwise sit unprotected.
Common gaps
Test environments are populated with an unmasked export of the production database, refreshed periodically with no anonymisation step in the process.
Data loss alerts flagging sensitive data moving into test environments are generated but not reviewed on any defined cycle.
A masking tool exists for the primary application, but a secondary system used for testing was never brought into scope.
Questions your auditor will ask
Is test data masked or anonymised before it's used outside production?
Yes, data headed for a test or development environment is checked against the masking process before use, and any unmasked sensitive data that slips through is caught by monitoring and logged as a finding.
How often do you review alerts about sensitive test data?
The security team reviews data loss alerts against a documented cycle, tunes the detection rules, and logs every confirmed incident in the DLP configuration record.
What happens once a confirmed attempt to move sensitive data into test is found?
It gets investigated and followed up as a recorded action, not left as an open alert, with the outcome captured in the data loss prevention configuration record.
Where regulation demands it
NIS2 art. 12.2 requires careful handling of assets, and ENS mp.com.2 requires cryptographic protection for the confidentiality of information in transit.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.