Mechanisms exist to monitor for evidence of unauthorized exfiltration or disclosure of non-public information.
Does the organization monitor for evidence of unauthorized exfiltration or disclosure of non-public information?