Data_Loss_Prevention / Determine what data moved, classification, user/device, destination, business justification, and whether blocking/escalation is warranted. · size 20 · threshold 4 · max attempts 3