A clerk mailbox may have sent a large archive off-network, and the wastewater plant reported a PLC setpoint change in the same hour. Which source is useful for the data-leaving question and should not be first for the PLC change?
Select an answer to reveal the explanation.
Short Explanation
DLP is the loading-dock camera: it is great when something is leaving the building in a mail truck, and a lousy first camera for a pump-station setpoint. Match the sensor to the question. The historian and CAD radio will not tell you about the archive.
Full Explanation
Data-loss-prevention alerts on outbound mail are a useful source when the investigative question is whether data left through email. They are not the first source for an OT process change, which belongs on historian, jump-host authentication, or industrial-firewall telemetry. Using one civic source as a universal answer is the Domain 3.1 failure mode. Fit DLP to exfiltration questions and keep PLC questions on OT-adjacent logs.