# GRD-007: Detect confidential commercial information


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT3
- Formerly: DAT-011
- URL: /r/GRD-007

**Acceptance criteria:** Cover pipeline, pricing, contracts, supplier terms, financial projections, M&A and investment data.

**Why it matters:** Pricing, contracts and deal information are often a company's most valuable data and rarely follow a pattern.

**How to verify:** Commercial information in unstructured pilot prompts is detected on default configuration.

**OWASP adoption context:** Commercially confidential information can appear across the listed employee AI settings; its sensitivity depends on the content and business context, not the tier.

**Mappings:**
- SOC 2: C1.1, CC6.7; ISO 27001: A.8.12, A.5.12 — Recognition of designated confidential commercial information supports its identification, sensitivity classification and leakage rules. The buyer’s classification policy and enforcement action are still required.
SOC 2: C1.1: The Confidentiality category and relevant information must be in scope.
ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Recognizing M&A or financial content does not classify every record.
- NIST CSF 2.0: PR.DS-02 — Recognizing confidential commercial content supplies a specific input to data-in-transit protection. Use findings in an operated leakage-protection workflow; classification alone neither prevents release nor maintains an inventory.