Resources: knowledge for safe digital transformation

DCS binds protection policies directly to documents instead of relying only on networks or devices. As a result, documents stay under control whether they are stored, shared, emailed or processed by AI tools, even after leaving the internal system.

AISA is a technology company in Vietnam that brings AI, data security and automation into the real-world operations of enterprises. DCS, one of AISA's core solutions, was developed from TRcore's DVC platform (Taiwan).

No. It is a reference tool to identify items to review, not a certification or legal conclusion. Results do not use percentages and do not replace professional legal advice.

Contact AISA through the About AISA page to discuss your business needs, or start with the free compliance assessment so AISA understands your current state before advising on a suitable solution.

DCS supports more than 400 file formats, including documents, spreadsheets, presentations, PDF and native CAD/engineering files — suitable for manufacturing, engineering, architecture and R&D enterprises.

DCS helps enterprises deploy data control and protection measures in real operations, contributing to meeting some personal data protection requirements. However, DCS does not automatically certify legal compliance; enterprises still need to review the relevant policies, processes and legal bases.

Contact information is used only so that AISA can respond and advise as requested. The contact form on the About AISA page opens your email application, and the website does not store the data. The Tally survey is managed under Tally's privacy policy.

Deployment time depends on the size and complexity of the enterprise. AISA usually starts with a pilot in one department before expanding, helping enterprises assess real-world results before full deployment.

Enterprise data security is the protection of important information such as customer data, contracts, financial reports, engineering drawings, source code, research and development data, and intellectual property from unauthorized access, copying, sharing or use.

Unlike traditional security that focuses only on networks or devices, Data-Centric Security (DCS) focuses on protecting the data itself throughout its usage lifecycle.

Data-Centric Security (DCS) is a security model in which protection policies are bound directly to data or documents.

As a result, control continues to exist even when a file is copied, emailed, stored on another device or shared with a partner.

Firewalls, antivirus software and Endpoint Detection and Response (EDR) mainly protect networks, devices and endpoints.

However, users with legitimate access can still copy, send or take data out. DCS adds a layer of protection directly on the data to reduce this risk.

Data Loss Prevention (DLP) mainly detects and stops data from leaving the enterprise via email, USB, websites or the cloud.

DCS focuses on protecting the file directly and keeps controlling how the file is used after it has been shared.

The two solutions complement each other.

Digital Rights Management (DRM) mainly controls usage rights for a document such as viewing, editing, printing or sharing.

DCS extends this toward protecting data throughout its lifecycle, combining encryption, permissions, audit logs and the ability to control documents after they leave their original environment.

DCS suits enterprises with:

intellectual property;

research and development data;

CAD drawings;

source code;

customer data;

contracts and quotations;

financial data;

data that must be shared with suppliers, partners or contractors.

Industries with typically high demand include manufacturing, electronics, semiconductors, technology, finance, logistics and enterprises with complex supply chains.

DCS focuses on protecting enterprise files and documents, for example:

Microsoft Office;

PDF;

engineering drawings;

file CAD;

R&D documents;

source code;

contracts;

quotations;

customer data;

intellectual property.

Specific compatibility with each specialized software or format should be checked during the survey or trial phase.

Files are encrypted (Encryption) and bound to a usage-rights policy.

The policy defines:

who may open the file;

who may edit it;

who may print it;

who may copy it;

who may share it;

how long the file may be used.

DCS configures automatic encryption according to policy to reduce reliance on manual user actions.

The goal is for protection to run in the background without noticeably changing how employees work day to day.

Yes.

Enterprises apply permissions such as:

View – Edit – Print – Copy – Screenshot – Share – Forward.

Permissions are set by user, group, department, project or document type.

In supported environments, the policy restricts the screenshot function.

In addition, DCS combines with dynamic watermarks (Dynamic Watermark) to display user information or access time.

A dynamic watermark is information displayed on a document while a user is viewing it.

The watermark content includes the user's name, time or identifying information.

The goal is to deter distribution of the document and support tracing when a leak occurs.

Copying a file does not necessarily mean the recipient can use the data.

When a file is protected under a DCS policy, the right to open and use it still depends on the user, the device and the permissions granted.

This is one of the key situations DCS targets.

Enterprises configure files to work only with authorized users, devices or environments.

When an employee leaves, their access rights are revoked.

In the persistent file control model (Persistent File Control), enterprises can revoke access to documents remotely in supported configurations.

This is useful when:

a file was sent by mistake;

a project has ended;

a partner no longer has access rights;

an employee leaves.

DCS applies expiry or usage-period policies to documents.

This feature is especially suitable for:

tender documents;

drawings sent to suppliers;

project documents;

M&A files;

documents shared with contractors.

An insider threat is a risk that arises from people with legitimate access such as employees, contractors, partners or suppliers.

The behavior may be intentional or unintentional, for example:

copying customer lists;

taking drawings to another company;

sending confidential documents by mistake;

uploading data to unauthorized services.

DCS helps reduce the risk by:

limiting file usage rights;

recording behavior;

blocking printing, copying or sharing when needed;

applying usage periods;

revoking access rights;

supporting investigations through activity logs.

An audit trail is a history that records activity related to documents.

The information includes:

who accessed;

when it was accessed;

the device used;

the action performed.

An audit trail supports incident investigation, audits and compliance management.

DCS tracks access history and actions on documents according to the system configuration.

This helps enterprises clearly understand who is using data and how it is being used.

Yes.

Instead of simply sending a file and losing control, the enterprise defines:

who may open it;

what they may do;

how long it may be used;

whether it may be printed;

whether it may be forwarded.

Shadow AI is the situation in which employees use AI tools that the enterprise has not approved or managed to handle work and internal data.

For example, employees put contracts, technical documents, customer lists or internal reports into public AI tools without the enterprise knowing.

The main risk of Shadow AI is that sensitive data leaves the enterprise's scope of control.

Shadow AI leads to:

data leaks;

loss of intellectual property;

unauthorized data sharing;

violations of internal policy;

difficulty tracing who used data where.

Enterprises therefore need to govern AI use together with data governance.

It helps reduce risk by controlling which documents may be copied, shared or moved out of the approved environment.

However, DCS should not be the only measure.

Enterprises should combine it with:

an AI policy;

data classification;

access rights management;

DLP;

endpoint security;

DCS.

AI can read the content only when it is granted appropriate access or when the enterprise designs a controlled decryption process.

It is therefore necessary to clearly define:

which data may be used with AI;

who may send data to AI;

which AI may be used;

which data is prohibited from being put into AI.

Yes.

The goal is not to lock down all data, but to create clear boundaries of use.

Enterprises classify data into three zones:

AI permitted – AI restricted – Confidential data / No AI.

Yes. DCS provides technical measures that support compliance:

• Encryption and access control.
• Usage rights management and permission revocation.
• Audit logs and sharing restrictions.

A security solution does not automatically make an enterprise "compliant" — compliance also depends on the accompanying policies, processes, people and data governance.

Encryption converts data from a readable form into an unreadable form for anyone without proper rights or the key — reducing the risk of unauthorized use when a file is copied or stolen.

Data sovereignty is the requirement that data be managed and processed in accordance with the law of the country whose jurisdiction the data falls under. For enterprises in Vietnam, this relates directly to where data is stored, where it is processed and whether it is transferred abroad.

This is the geographic location where data is stored or processed — important for enterprises required to store data in Vietnam or in an environment the enterprise itself controls.

No. ISO/IEC 27001 is the standard for an Information Security Management System (ISMS) — covering people, processes and technology. DCS is a technology solution that supports some technical controls within that ISMS, and does not replace the whole management system.

A DPIA is the process of assessing risks to personal data when an enterprise carries out data processing activities, identifying:

• What data is being processed.
• What risks exist.
• What control measures need to be deployed.

DCS can be deployed in an on-premise environment for enterprises that want to keep data in internal infrastructure.

This model is especially suitable for enterprises with R&D data, intellectual property or especially sensitive data.

The DCS architecture fits:

On-premise;

Cloud;

Hybrid.

The specific deployment model depends on each enterprise's infrastructure, security requirements and data policy.

DCS integrates with identity management systems such as Active Directory (AD) or equivalent authentication systems to manage users, groups and access rights.

DCS integrates with security monitoring and operations systems.

Security Information and Event Management (SIEM) helps centralize and analyze security events.

Security Orchestration, Automation and Response (SOAR) helps automate incident response workflows.

The specific integration capability must be confirmed against the systems the customer uses.

Integration capability through an Application Programming Interface (API) depends on the module and deployment architecture.

The API is used to integrate with management systems, automation or other enterprise applications.

DCS aims to protect data with the least impact on the user experience.

However, real-world performance depends on:

file type;

file size;

the software used;

the device;

network configuration.

For CAD, R&D or specialized application environments, a POC should be carried out before wide rollout.

A good design should minimize changes for users.

Many protection policies run automatically in the background, allowing users to keep opening, editing and saving files in their familiar workflow.

In supported configurations, enterprises grant time-limited offline access.

This is useful for employees who are:

on business trips;

working outside the office;

working in areas with an unstable network.

A proof of concept (POC) is a trial of the product in the customer's real environment before official rollout. A POC verifies:

• Compatibility and performance.
• Features and user experience.
• How well it meets real-world usage scenarios.

An effective POC focuses on the 3–5 most important scenarios:

• Automatic file encryption.
• Copying files to USB.
• Sending files to a supplier.
• Blocking printing or screenshots.
• Revoking permissions and checking access logs.

The time depends on the number of users, number of devices, systems to integrate, data types and the complexity of the policy. The standard process has 5 steps:

• Survey → Trial (POC) → Policy tuning → Department-by-department rollout → Enterprise-wide expansion.

A service level agreement (SLA) is a commitment between the provider and the customer on support quality, specifying:

• Response time and incident handling priority.
• Resolution time and support channels.
• Specific responsibilities of each party.

Total cost of ownership (TCO) is the total cost an enterprise pays over the lifetime of using a solution, including:

• Licenses and server infrastructure.
• Deployment, integration and training.
• Operations, maintenance and upgrades.

Return on investment (ROI) in data security comes not only from direct revenue but also from:

• Lower risk of data loss and incident-handling costs.
• Less downtime and protected intellectual property.
• Lower legal risk and a better ability to meet international customers' requirements.

The pricing model depends on the number of users, number of endpoints, module scope, server configuration, deployment model and accompanying integration services. For enterprise projects, AISA surveys your specific needs before issuing an official quotation.

Start with three questions:

• Which data matters most?
• Who currently has access?
• What happens when data leaves the enterprise?

Then choose one department or data group for a pilot rollout.

An enterprise should consider DCS if one or more of the following applies:

• You have intellectual property, R&D data or engineering drawings.
• You frequently send files to external partners.
• You worry about employees copying data to USB or cloud, or taking it with them when they leave.
• You hold sensitive customer data.
• You are rolling out AI and worry about Shadow AI risk.
• International customers require strict security controls.

The roadmap has 5 steps:

• Step 1 — Assess the current state: identify critical data, data flows and risks.
• Step 2 — Build the policy: define who may view, edit, share or use the data.
• Step 3 — Trial (POC): test 3–5 key scenarios.
• Step 4 — Deploy: start with the department that has the highest risk.
• Step 5 — Expand and optimize: extend to other data groups and departments.