Does your organization have a process to continuously discover and analyze ad hoc data to identify new instances of sensitive data types?

This question assesses whether your organization actively monitors and analyzes data across systems to identify previously unknown or newly created instances of sensitive information (like PII, financial data, or intellectual property). Continuous discovery helps prevent data sprawl and ensures that all sensitive information receives appropriate protection controls regardless of where it resides or when it was created. Evidence could include documentation of your data discovery tool configuration, scheduled scan reports, data classification policies, or screenshots of your data discovery dashboard showing regular scanning activities and results. Ideally, you should be able to demonstrate how newly discovered sensitive data is subsequently classified and protected.