Monitor and audit
After you identify your sensitive data and take steps to protect it, you must monitor activities that access this data. In many cases you can use the data that is generated by monitoring to comply with audit requirements, either regulatory or internal.