DLP monitoring inspects data as it is used, sent and stored, then alerts or blocks when it matches a policy. It covers data in use on endpoints, in motion across networks and at rest in storage. It sees only what it can inspect, so encrypted and unknown channels are blind spots.
How does NIST describe DLP?
The NIST glossary entry, taken from CNSS instruction 4009, defines data loss prevention as a system's ability to identify, monitor and protect data in use (for example endpoint actions), data in motion (for example network actions) and data at rest (for example data storage). It does this through deep packet content inspection and contextual security analysis of a transaction, looking at attributes such as the originator, the data object, the medium, the timing and the recipient or destination. All of this sits within a centralized management framework.
Three ideas in that definition are worth separating. Content inspection asks what the data is. Context asks who is sending it, when, and where to. Central management means one policy applied across endpoints, network and storage.
Which controls does it relate to?
NIST SP 800-53 has two controls close to this. AC-4, information flow enforcement, regulates where information can travel within a system and between systems, as opposed to who may access it. Its examples include keeping export-controlled information from being sent in the clear to the internet and restricting web requests that do not come from the internal proxy.
SI-4, system monitoring, requires monitoring to detect attacks and unauthorized connections, analyzing events and adjusting monitoring when risk changes. It also includes a line that is easy to miss: obtain legal opinion regarding system monitoring activities. Watching employees' data flows has privacy and employment law implications that vary by country.
What are the limits?
Inspection fails where content is hidden. Traffic encrypted end to end cannot be read in motion unless the organization decrypts it at a managed boundary. A user who photographs a screen, retypes data or uses a personal device never touches the monitored path.
DLP also needs a definition of sensitive. Pattern matching can find a card number format, but it does not know that a design document is a trade secret unless someone labels or catalogs it. NIST's information location control (CM-12) is the groundwork: identify and document where specific information types are processed and stored, who has access, and changes to those locations. Monitoring without that inventory leads to alert floods and gaps.
A constructed example
A support team exports a customer list to a spreadsheet and emails it to a personal address to work from home. A DLP rule matches the pattern of account numbers in an outbound attachment and holds the message for review. Next week the same person pastes rows into a chat application the monitoring does not cover. The first control worked because the channel was known. The second shows why the channel list is the policy.
How to check or apply this
- Inventory sensitive data first: types, locations, owners. Start with the types whose leak would trigger notification duties.
- Choose channels to cover: email, web uploads, removable media, cloud storage sync, chat, code repositories.
- Begin in monitor-only mode and measure false positives before blocking anything.
- Write rules by context, not only content: who, where to, how much.
- Get a legal and HR review of what you monitor and how long you keep it.
- Define response: who reviews alerts, how fast, and what happens next.
- Test with synthetic data, and review the channels you cannot see.
Safeguard is not a DLP product and does not monitor email, endpoints or networks. Its place is earlier, in the software you build, where dependency scanning shows which libraries handle sensitive data and whether they carry known vulnerabilities.
Quick check
What are the three data states in DLP?
Data in use, such as endpoint actions, data in motion, such as network traffic, and data at rest, such as storage. This is the framing in the NIST glossary entry.
Is DLP only a technology purchase?
No. It depends on knowing where sensitive data lives, on policies that name channels and contexts, and on legal review of the monitoring itself.
Sources
- NIST CSRC Glossary, data loss prevention
- NIST SP 800-53 Rev. 5, AC-4 Information Flow Enforcement (control text)
- NIST SP 800-53 Rev. 5, SI-4 System Monitoring (control text)
- NIST SP 800-53 Rev. 5, CM-12 Information Location (control text)
Last reviewed: 18 October 2026.
