Data loss prevention for the cloud means finding sensitive data in cloud services, controlling how it is shared, and detecting when it leaves approved places. The most useful first steps are classification and fixing sharing settings, because many cloud leaks come from permissive configuration, not from clever attacks.
What does DLP mean in formal terms?
The NIST glossary, citing CNSS guidance, defines data loss prevention as a system's ability to identify, monitor and protect data in use, in motion and at rest. That covers endpoint actions, network actions and storage, using content inspection and context such as who sent it, what it is, and where it is going, under central management.
Those three states are a useful frame for the cloud as well. Data at rest sits in storage services and SaaS apps. Data in motion crosses APIs and downloads. Data in use is open in a browser or a synced desktop folder.
Why is the cloud different?
NIST SP 800-144 on public cloud security makes the central point: you hand over control of some layers, and you still carry accountability for the data. Your own network no longer sits between users and the data, so a gateway at the office door sees little of it.
The control points move to three places: the cloud service's own settings, the identity of the person or service accessing data, and API-based inspection of what is stored.
A constructed example
A marketing contractor shares a folder of customer exports through a link that anyone can open, to avoid adding the client's team one by one. The link never expires. No hacker is involved, yet the file is public. A cloud DLP program catches this at two points: a rule that flags files containing customer identifiers shared through open links, and a default that disallows open links for that data class.
What controls does NIST point to?
SP 800-53 Rev. 5 has controls that map onto this work. Information flow enforcement (AC-4) controls where information may move. Boundary protection (SC-7) governs traffic at system edges. The system monitoring family (SI-4) covers detecting abnormal activity. Use these as a vocabulary for requirements, not as a product shopping list.
How should you start?
Begin with where your data is. You cannot protect what you have not found. Classify a small set of data types that matter, for instance customer identifiers, credentials and financial records. Accuracy matters more than breadth: a rule for a dozen types you tuned beats a hundred that no one trusts.
Then fix the settings. Disable public sharing where it is not needed, require sign-in for links, set expiry on external shares, and restrict who can create them.
Only then add blocking. Run new rules in monitor mode first, review false positives for a few weeks, and block when the rule is accurate.
What does it not cover?
DLP does not decide who should have access in the first place, so pair it with access reviews. It will miss data that is not in a pattern you defined, such as a design document with no obvious identifier. And it cannot stop a person from photographing a screen. Treat it as a way to catch common, accidental and careless leakage, and add other controls for the rest.
How to check or apply this
- List the cloud services that hold company data, including SaaS tools and storage buckets.
- Define three or four data classes and the pattern or label that identifies each.
- Scan storage for those classes and for publicly shared items.
- Turn off anonymous sharing for sensitive classes and add expiry to external links.
- Restrict download and sync of sensitive files to managed devices.
- Run each new DLP rule in monitor mode, tune it, then enforce.
- Log sharing events and review alerts weekly, with a named owner.
- Include contractors and service accounts in the scope, since they share data too.
Quick check
Is cloud DLP the same as encryption?
No. Encryption protects data from people without keys. DLP controls what authorized users and systems can do with data, such as sharing it externally.
What is the first thing to fix?
Public and unrestricted sharing links on sensitive data. They are common, easy to find and easy to remove.
Sources
- NIST Glossary, data loss prevention
- NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
Last reviewed: 18 October 2026.
