Glossary term
DLP
Also: Data Loss Prevention, Data Leakage Prevention
Software category for detecting and preventing unauthorised data outflow. Operates on endpoints, network and cloud. Classifies content (regex, fingerprinting, ML) and enforces policies.
Three domains: endpoint DLP (e.g. Microsoft Purview, Forcepoint, Trellix), network DLP (Forcepoint, Symantec/Broadcom, Check Point), cloud DLP/CASB (Netskope, Zscaler, Microsoft Defender for Cloud Apps).
Practical issues: classification accuracy, false positives, employee acceptance, EU labour-law (co-determination under BetrVG, DPIA needed). Pure pattern-matching DLP is often not enough; modern approaches use label-based or context-based classification.
In practice
Audit cases: NIS2 Art. 21 (supply-chain security, cyber hygiene), GDPR Art. 32 (TOMs), BAIT BTO 5 (information security). DLP is often part of an insider-threat programme.
Related terms
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
SSPM
Software category for reviewing SaaS configurations (Microsoft 365, Salesforce, Google Workspace, Slack, GitHub). Finds over-privileged apps, weak sharing settings, MFA gaps, external data flows.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
Dealbreaker
A hard requirement that immediately disqualifies an option if not met, independent of weighted scoring. Dealbreakers enforce non-negotiable constraints (EU hosting, specific certifications, data residency) and prevent weak options from winning on aggregate scores.
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Defensible record
A single versioned artefact that captures a decision in enough structure, with enough evidence and stakeholder context, that it can be defended under audit, in a board review, or 12 months later when the original team is no longer in place.
DMARC / DKIM / SPF
Three standards that together authenticate email senders and impede spoofing. SPF authenticates the sending IP, DKIM signs the content, DMARC links both via the From header and defines the policy.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.