The security administrator receives an email on a non-company account from a coworker stating that some reports are not exporting correctly. Attached to the email was an example report file with…

Configuring TLS connections encrypts the email in transit but does not prevent sensitive data from being attached to an email and sent from the originating mail server in the first place.

Creating a user training program is an administrative control, not a technical control, and relies on human compliance rather than automated enforcement to prevent data disclosure.

Implementing a Data Loss Prevention (DLP) solution on the email gateway provides the most effective technical control. DLP systems are specifically designed to scan outgoing emails and their attachments for predefined patterns of sensitive data, such as credit card numbers, PII, or PINs. Upon detection, the DLP solution can automatically block the email, remove the sensitive content, or quarantine it, thereby preventing the disclosure of confidential information before it leaves the organizational boundary.

Classifying data and informing users are administrative controls that educate users but do not provide an automated technical mechanism to actively stop sensitive data from being sent out.