{"id":"GRD-007","section":"Runtime Guardrails","requirement":"Detect confidential commercial information","acceptance":"Cover pipeline, pricing, contracts, supplier terms, financial projections, M&A and investment data.","tier":"AT0–AT3","whyItMatters":"Pricing, contracts and deal information are often a company's most valuable data and rarely follow a pattern.","verificationMethod":"LT","verificationTest":"Commercial information in unstructured pilot prompts is detected on default configuration.","formerly":"DAT-011","alsoIn":[],"sort":17,"adoptionContext":"Commercially confidential information can appear across the listed employee AI settings; its sensitivity depends on the content and business context, not the tier.","mappings":[{"frameworks":["soc2","iso27001"],"explanation":"Recognition of designated confidential commercial information supports its identification, sensitivity classification and leakage rules. The buyer’s classification policy and enforcement action are still required.\nSOC 2: C1.1: The Confidentiality category and relevant information must be in scope.\nISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Recognizing M&A or financial content does not classify every record.","kind":"framework","references":{"soc2":["C1.1","CC6.7"],"iso27001":["A.8.12","A.5.12"]},"relation":null,"conditions":[]},{"frameworks":["csf"],"explanation":"Recognizing confidential commercial content supplies a specific input to data-in-transit protection. Use findings in an operated leakage-protection workflow; classification alone neither prevents release nor maintains an inventory.","kind":"framework","references":{"csf":["PR.DS-02"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-007","frameworkRefs":{"ISO27001":["A.8.12","A.5.12"],"NIST-CSF":["PR.DS-02"],"SOC2":["C1.1","CC6.7"]}}