Question

An organization has deployed a data loss prevention (DLP) technology to prevent exfiltration of confidential customer data through email and web channels. Six months later, the DLP tool generates thousands of alerts, but employees continue to inadvertently send sensitive files externally, and staff are unaware which data is considered confidential. Which action would MOST effectively improve the DLP program's outcomes?

Accepted Answer

Establish and communicate a data classification and handling standard supported by targeted user training

Answer

Tune the DLP rules to reduce the volume of false-positive alerts

Answer

Add endpoint DLP agents to cover additional exfiltration channels such as USB devices

Answer

Route all DLP alerts directly to the incident response team for investigation