How to setup DLP?

Follow

Updated:

theThere are multiple ways to apply and combine settings to DLP Classifiers and Policies. Each scenario is described below.

Important: DLP policy rules are assessed in the following order:

  1. Document
  2. Attribute
  3. Cabinet

For example, if you set policy both on a Cabinet and a Matter level, then Matter (Attribute level) overrides Cabinet policy.

How do I apply a single policy to the whole Cabinet or to the content profiled with a specific attribute?

Note: In this case, document classification is disabled.

  1. In the Policies tab, select the Settings mceclip0.pngicon.
  2. Turn on the Use Direct Policy Assignment(s) toggle (other toggles are turned off), and select Apply.

mceclip1.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Go to the Data Protection/DLP section, and select the Default DLP Policy from the drop-down list, then select Submit.

mceclip2.png

All documents in this cabinet are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

mceclip3.png

  1. Alternatively, on the Cabinet Administration page, in the DLP section, select the Data Protection Attribute from the drop-down list.

mceclip4.png

Then, select Go to lookup table, and set DLP Policies for different attributes.

mceclip5.png

Save your changes. All documents profiled with the attribute are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

mceclip6.png

Back to Top

How do I allow users with “A” rights to set a document-level policy?

Note: In this case, document classification is disabled.

  1. In the Policies tab, select the Settings mceclip0.pngicon.
  2. Turn on the Use Direct Policy Assignment(s) toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to a document to add document-level Policy toggle, and select Apply.

mceclip7.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Go to the Data Protection/DLP section, and select the Default DLP Policy from the drop-down list, then select Submit.

All documents in this cabinet are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

  1. Alternatively, on the Cabinet Administration page, in the DLP section, select the Data Protection Attribute from the drop-down list. Then, select Go to lookup table, and set DLP Policies for different attributes. Save your changes.

All documents profiled with the attribute are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

  1. For users with “A” rights to the document, a Set Document Level Policy link appears in the Details pane.
  2. Select the link and choose a policy from the drop-down list, then select OK.
  3. The new policy set at the document level now appears in the Details pane overriding cabinet or attribute-level settings.

mceclip8.png

Back to Top

Can I apply two or three different policies to the document?

Note: In this case, document classification is disabled.

  1. In the Policies tab, select the Settings mceclip0.pngicon.
  2. Turn on the Use Direct Policy Assignment(s) toggle.
  3. Turn on the Enforce Rules from Default Policies toggle. 
  4. Turn on the Allow Users with Admin (“A”) rights to a document to add document-level Policy toggle, and select Apply.

mceclip9.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Go to the Data Protection/DLP section, and select the Default DLP Policy from the drop-down list, then select Submit.

All documents in this cabinet are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

  1. Alternatively, on the Cabinet Administration page, in the DLP section, select the Data Protection Attribute from the drop-down list. Then, select Go to lookup table, and set DLP Policies for different attributes. Save your changes.

All documents profiled with the attribute are now set with the same policy, you can view it in the document Details pane, in the Data Loss Prevention section.

  1. For users with “A” rights to the document, a Set Document Level Policy link appears in the Details
  2. Select the link and choose a policy from the drop-down list, then select OK.
  3. Both cabinet (or attribute) and document-level policies now appear in the Details pane and the rules from both policies are combined.

mceclip10.png

With Enforce Rules from Default Policies enabled, you can set three policies at a time – Document, Profile Attribute, and Cabinet levels. Rules from all three policies will be combined.

mceclip11.png

Note: Three policies is the maximum possible number.

Back to Top

How do I connect a classification to a policy?

  1. In the Classifiers tab, select the Settings mceclip12.pngicon.
  2. Turn on the Enable Document Classification toggle, and select Apply.
  3. Create a classifier with an appropriate name and priority (or edit an existing one).

mceclip13.png

  1. In the Policies tab, create or edit a policy.
  2. In the drop-down list, select the Classification you want to link to the policy.

mceclip14.png

Back to Top

How do I apply a default classification to the whole Cabinet?

Note: In this case, the direct policy assignment is disabled.

  1. In the Classifiers tab, select the Settings mceclip0.png icon.
  2. Turn on the Enable Document Classification toggle (other toggles are turned off), and select Apply.

mceclip15.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Go to the Data Protection/DLP section, and select the Default Data Classification from the drop-down list, then select Submit.

All documents in this cabinet are now set with the same classification, you can view it in the document Details pane, in the Data Loss Prevention section.

mceclip16.png

Back to Top

How do I allow Cabinet Admins to downgrade classification at the profile attribute level?

Note: In this case, the direct policy assignment is disabled.

  1. In the Classifiers tab, select the Settings mceclip0.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Cabinet Administrators to downgrade classification at profile attribute level toggle (other toggles are turned off), and select Apply.

mceclip17.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Go to the Data Protection/DLP section, select the Data Protection Attribute from the drop-down list, and then select Go to lookup table.

mceclip18.png

  1. Double-click the Attribute, and the Edit Lookup Table dialog box appears.
  2. Data Classification appears as set in the Cabinet level and you can downgrade it. For example, change from 2-Secret to 5-Restricted.
  3. Select Save. Now, all documents profiled with the attribute have the downgraded Classification and you can view it in the Details pane.

 Back to Top

How do I allow users with “A” rights to raise the classification?

Note: In this case, the direct policy assignment is disabled.

  1. In the Classifiers tab, select the Settings mceclip12.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to set document-level Classification toggle (other toggles are turned off), and select Apply.

mceclip19.png

  1. For users with “A” rights to the document, Classification (set in the Cabinet level) appears as a link in the Details pane.
  2. Select the link, and the Document Level Classification dialog box appears with a drop-down box to change the classification.

Note: Users can only raise the classification, lower classifications are disabled.

mceclip20.png

  1. After selecting a higher classification, it appears in the Details pane as set at the document level.

This feature may be used, for example, on a final executed version of a contract that is considered a higher risk than the drafts.

Back to Top

How do I allow downgrading the default classification?

Note: In this case, the direct policy assignment is disabled.

  1. In the Classifiers tab, select the Settings mceclip0.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to set document-level Classification toggle.
  4. Turn on the Allow Documents to be downgraded from Default(s) toggle, and select Apply.
  5. In the Details pane, Classification (set in the Cabinet level) appears as a link.
  6. Select the link, and the Document Level Classification dialog box appears with a drop-down box to change the classification.

mceclip21.png

  1. After changing a classification, it appears in the Details pane as set at the document level.

Downgrading default classification may be used due to risk assessment, information appended to the document or business process.

Back to Top

What happens when I enable both Classifiers & Policies?

When you enable both Document Classification:

mceclip22.png

and Direct Policy Assignment:

mceclip23.png

the Details pane shows both Classification and Policy:

mceclip24.png

When creating a new Policy, you can link it to the Classifier.

mceclip25.png

Rules applied to this Policy will also be enabled for the linked Classifier.

If in the Cabinet Administration page you set both Default Data Classification with a linked policy, and Default DLP Policy, then rules from both policies are applied to documents.

Note: Default Data Classification and Default DLP Policy do not have precedence over each other.

Back to Top

What happens when I set the Default Classification, Direct Policy & Data Protection Attribute at the same time?

  1. In the Classifiers tab, select the Settings mceclip12.png icon.
  2. Turn on the Enable Document Classification toggle (other toggles are turned off), and select Apply.

mceclip26.png

  1. In the Policies tab, select the Settings mceclip12.png icon.
  2. Turn on the Use Direct Policy Assignment(s) toggle (other toggles are turned off), and select Apply.

mceclip27.png

  1. In the Navigation Pane, go to Cabinets > cabinet name.
  2. Set Default Data Classification, Default DLP Policy, and Data Protection Attribute.

mceclip28.png

  1. Select Go to lookup table, double-click the Attribute, and the Edit Lookup Table dialog box appears.
  2. Select Data Classification and DLP Policy for this attribute, and select Save.

mceclip29.png

  1. This Classification and Policy now apply to documents with the DLP attribute selected from the lookup table.

mceclip30.png

  1. Documents in the cabinet with other profile attributes have Classification and Policy that you set for the cabinet (in this case, Highly Confidential and NoOtherLocations).

mceclip31.png

Back to Top

How does downgrading classification at profile-attribute level work with Cabinet-level defaults?

  1. In the Classifiers tab, select the Settings mceclip12.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Cabinet Administrators to downgrade classification at profile attribute level toggle (other toggles are turned off), and select Apply.
  4. In the Policies tab, select the Settings mceclip12.png icon.
  5. Turn on the Use Direct Policy Assignment(s) toggle (other toggles are turned off), and select Apply.
  6. In the Navigation Pane, go to Cabinets > cabinet name.
  7. Set Default Data Classification, Default DLP Policy, and Data Protection Attribute.
  8. Select Go to lookup table, double-click the Attribute, and the Edit Lookup Table dialog box appears.
  9. Select Data Classification and DLP Policy for this attribute, and select Save.
  10. This Classification and Policy now apply to documents with the DLP attribute selected from the lookup table.
  11. Documents in the cabinet with other profile attributes have Classification and Policy that you set for the cabinet (in this case, Highly Confidential and NoOtherLocations).

Note: Rules from both Cabinet-level defaults and Attribute settings are applied to the documents.

Back to Top

How does allowing users with “A” rights to raise the classification work with Cabinet-level defaults?

  1. In the Classifiers tab, select the Settings mceclip12.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to set document-level Classification toggle (other toggles are turned off), and select Apply.
  4. In the Policies tab, select the Settings mceclip12.png icon.
  5. Turn on the Use Direct Policy Assignment(s) toggle (other toggles are turned off), and select Apply.
  6. In the Navigation Pane, go to Cabinets > cabinet name.
  7. Set Default Data Classification, Default DLP Policy, and Data Protection Attribute.

mceclip32.png

  1. For documents not profiled to the specific attribute, Classification set in the Cabinet level appears as a link in the Details pane.

mceclip33.png

  1. Select the link, and the Document Level Classification dialog box appears with a drop-down box to change the classification.

Note: Users can only raise the classification, lower classifications are disabled.

  1. For documents profiled to the specific attribute, Classification set in the Attribute level also appears as a link in the Details pane.

mceclip34.png

Users can select the link and raise the classification.

Note: Rules from both Cabinet-level defaults and Attribute settings are applied to the documents.

Back to Top

How downgrading document-level classification works with Cabinet-level defaults?

  1. In the Classifiers tab, select the Settings mceclip12.png icon.
  2. Turn on the Enable Document Classification toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to set document-level Classification toggle.
  4. Turn on the Allow Documents to be downgraded from Default(s) toggle, and select Apply.
  5. In the Policies tab, select the Settings mceclip12.png icon.
  6. Turn on the Use Direct Policy Assignment(s) toggle (other toggles are turned off), and select Apply.
  7. In the Navigation Pane, go to Cabinets > cabinet name.
  8. Set Default Data Classification, Default DLP Policy, and Data Protection Attribute.
  9. For documents not profiled to the specific attribute, Classification set in the Cabinet level appears as a link in the Details
  10. For documents profiled to the specific attribute, Classification set in the Attribute level also appears as a link in the Details pane.
  11. Select the link, and the Document Level Classification dialog box appears with a drop-down box to raise or lower the classification.

Note: Rules from both Cabinet-level defaults and Attribute settings are applied to the documents.

Back to Top

How setting a document-level policy and downgrading document-level classification works with Cabinet-level defaults?

  1. In the Policies tab, select the Settings mceclip12.png icon.
  2. Turn on the Use Direct Policy Assignment(s) toggle.
  3. Turn on the Allow Users with Admin (“A”) rights to a document to add document-level Policy toggle, and select Apply.
  4. In the Classifiers tab, select the Settings mceclip12.png icon.
  5. Turn on the Enable Document Classification toggle.
  6. Turn on the Allow Users with Admin (“A”) rights to set document-level Classification toggle.
  7. Turn on the Allow Documents to be downgraded from Default(s) toggle, and select Apply.
  8. In the Details pane, select the Set Document Level Policy link and choose policy from the drop-down list, then select OK. Now Policy appears as set on document level.
  9. Select the Classification-labeled link, and the Document Level Classification dialog box appears with a drop-down box to change the classification (you can downgrade classification as well).

Note: Rules from both Cabinet-level defaults and Attribute settings are applied to the documents.

Back to Top

How does DLP work when I enable all settings?

This workflow includes all Classifier and Policy settings enabled, see the screenshots below. The only setting not enabled does not affect the Details pane UI.

mceclip35.png

mceclip36.png

These settings enable Cabinet-level defaults for both Classifiers and Policies. They also apply to Data Protection Attribute with both a Classification (linked to a policy) and a Policy (enabled on Matter, Client, Practice Area etc.). The documents in the Cabinet inherit DLP rules from either the Cabinet-level defaults, or from the rules applied through Data Protection Attribute.

Users with administration rights can both set a document-level Classification (raise or downgrade) and directly assign a Policy.

Document, Profile Attribute, and Cabinet-level Policies are applied at the same time and their rules are combined.

The Details pane with all settings enabled looks as follows:

mceclip37.png

In this case, the document is not related to the Attribute. For users with “A” rights, Set Document Level Policy appears and the Classification label is a link.

mceclip38.png

In this case, Data Protection Attribute is set to Client. For users with “A” rights, Set Document Level Policy appears and the Classification label is a link. Both Cabinet and attribute-level policies appear in the Details pane.

mceclip39.png

In this case, the user with “A” rights set the document-level classification that overrides the Cabinet-level classification. Both Cabinet and document-level policies appear in the Details pane.

mceclip40.png

In this case, all Policies appear in the Details pane and their rules are applied to the document.

Back to Top

Was this article helpful?
0 out of 0 found this helpful
Powered by Zendesk