Requirement
The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives.
Points of Focus
Restricts the Ability to Perform Transmission
Requirement: Data loss prevention processes and technologies are used to restrict ability to authorize and execute transmission, movement, and removal of information.
Uses Encryption Technologies or Secure Communication Channels to Protect Data
Requirement: Encryption technologies or secured communication channels are used to protect transmission of data and other communications beyond connectivity access points.
Protects Removal Media
Requirement: Encryption technologies and physical asset protections are used for removable media (such as USB drives and backup tapes), as appropriate.
Protects Endpoint Devices
Requirement: Processes and controls are in place to protect endpoint devices (such as mobile devices, laptops, desktops, and sensors).
Explanation
Data is most exposed when it moves — over networks, onto USB drives, or out through email. Auditors check that transmission and removal of information are limited to authorized users and processes, and that encryption, data loss prevention, and endpoint controls protect it along the way.
