1. Review all DLP incidents in DLP tools and take one of the following actions:

a. Close the false positive tickets.

b. Identify cases needing policy fine tuning and send them to the DLP admin.

c. Identify genuine cases and escalate for investigation.

2. Develop and document processes and procedures for DLP incident monitoring.

3. Develop status and progress reports related to DLP incidents on regular and Ad-hoc basis.