3 questions from the package
From the RFI round. The first shows part of the guide each question carries; the workbook adds follow-ups, how to verify the answer, a priority and a weight.
1. Provide the list of built-in detectors your product ships for [data types in scope], including national identifier numbers for [jurisdictions in scope].
Why it matters. Any data type without a built-in detector has to be written and maintained by the buyer's team as custom patterns. Gaps for specific jurisdictions often surface only after rollout.
Good answer
- Named detector for each item in [data types in scope] and each jurisdiction in [jurisdictions in scope]
- Each detector entry states whether it applies validation beyond the character pattern
- Documented process and cadence for adding or updating detectors in the library
Red flags
- A total count of data types instead of a list mapped to the buyer's data types
- Jurisdiction coverage that relies on keyword lists alone
- Detectors marked as available only on some channels without saying which
2. Does your product match content against an index built from our structured records, such as [sample customer table]?
Why it matters. Pattern detectors flag any validly formatted number, so they cannot tell the buyer's own customer or employee records apart from unrelated values in the same format. Without an index of actual records, the buyer cannot write high-precision rules for its most sensitive structured data.
3. Provide a matrix showing which endpoint controls your agent enforces on each version in [operating systems in scope]: removable media, clipboard, print, screen capture, sync folders, browser upload and application restriction.
Why it matters. Endpoint controls often differ by operating system. A control that works on one platform but only monitors on another leaves a gap on part of the buyer's fleet, and that gap may not surface until rollout.
Capability areas
Content Classification & Detection (12)
How the engine identifies sensitive content: pattern and keyword detectors with validation, proximity and confidence logic, ML and trainable classifiers for unstructured content, OCR on images and screenshots, true file-type detection, handling of archives, encrypted files and embedded objects, and reading sensitivity labels or metadata tags already applied to files and messages as detection conditions. Exact data match and fingerprinting are covered in EDM. False-positive measurement during rollout is covered in TUN.
Exact Data Match & Document Fingerprinting (10)
Indexing of structured records for exact and partial-record matching, plus fingerprinting of confidential documents and partial-document derivatives: index creation, hashing and protection of source data, refresh cadence, index size limits, and which channels can evaluate the indexes. General pattern and ML detection are covered in CLS.
Endpoint Data-in-Use Controls (12)
Agent-based monitoring and enforcement on managed devices: removable media, clipboard, print, screen capture, local sync clients, browser uploads, and application-to-application transfers. Also covers offline enforcement, operating system coverage, agent tamper resistance, and agent performance impact. Network-side inspection is covered in NET.
Network & Web Egress Inspection (10)
Inline inspection of web, FTP and other network egress traffic: TLS inspection, proxy, ICAP or SSE-edge integration, upload blocking to unsanctioned destinations, and inspection of protocols beyond HTTP(S). API-based SaaS inspection is covered in CLD. GenAI destinations are covered in GAI.
Email DLP (9)
Outbound and internal mail inspection: attachment and body analysis, misdirected-recipient detection, enforcement actions such as policy-based encryption, quarantine and release, and integration with cloud and on-premises mail platforms. User coaching mechanics shared across channels are covered in POL.
Cloud & SaaS Data Protection (10)
Protection of data in sanctioned SaaS and cloud collaboration platforms through API-based inspection: external sharing and public links, upload and download controls, personal-versus-corporate instance detection, and remediation actions inside the SaaS app. Broad at-rest discovery and posture management are covered in DSC.
Generative AI Data Controls (8)
Detection and control of sensitive data sent to generative AI tools: prompt and file-upload inspection in browser, desktop and API use, sanctioned-versus-unsanctioned AI app distinction, and capture of the AI interaction as incident evidence. Governance of the vendor's own AI features is covered by the cross-cutting AI modules.
Unified Policy & Enforcement Actions (11)
Authoring one policy that applies across endpoint, network, email and cloud channels: policy structure, conditions, exceptions, and the available actions per channel (block, encrypt, quarantine, justify, notify, apply a sensitivity label or rights-management protection). Also covers end-user coaching and self-remediation at the moment of action, plus policy change control and versioning. Tuning workflows are covered in TUN.
Policy Simulation, Tuning & False-Positive Management (10)
Monitor-only and simulation modes, back-testing a new or changed policy against historical activity, per-rule and per-data-type false-positive reporting, analyst feedback loops into classifiers, and the effort required to keep policies tuned. Initial classifier capabilities are covered in CLS.
Insider Risk & Behavioral Context (9)
User risk scoring, behavioral analytics, and activity timelines that add context to content hits. Also covers risk-adaptive enforcement that changes policy actions based on user risk level, and privacy controls such as pseudonymization of user identity during investigation. Incident queue mechanics are covered in INC.
Data Discovery & Posture (DSPM) (10)
At-rest discovery across endpoints, file shares, databases, and cloud storage and SaaS repositories: scan scheduling and scale, access and exposure analysis, remediation actions on discovered data, and whether discovery shares the same classification model and console as in-motion DLP.
Incident Workflow, Evidence & SOC Integration (12)
The incident queue and triage workflow: grouping and prioritization, evidence capture and redaction, role-based access to incident content, location of evidence storage, audit trail of analyst actions, case export, and DLP-specific event integration with SIEM, SOAR and XDR. Generic API availability is covered by the integration module.
Questions about this package
How many Data Loss Prevention (DLP) RFP questions are there?
123 solution questions in 12 capability areas: 25 for the RFI, 62 for the RFP and 36 deep-dive questions for the finalists. The workbook adds 90 due-diligence questions on security, integration, implementation and exit.
What comes with each question?
Why it matters, good-answer signals, red flags, follow-up questions, how to verify the answer (a demo step, a test or a document), and a suggested priority and weight for scoring.
Can I edit the questions?
Yes. The workbook is an ordinary Excel file. Change, add or remove questions, and change the weights; the scorecard recalculates.
Which license do I need?
The Enterprise License covers any number of evaluations inside one organization. The Consultancy License covers use with any number of clients. Neither allows reselling or republishing the questions.
