Enabling data loss prevention policies

Administrator Help | Forcepoint Email Security | Version 8.4.x

In addition to creating and enabling policies that protect your email system from email threats, you can enable DLP policies that can detect the presence of sensitive data in your organization's email and execute appropriate actions to prevent data loss. You can use DLP policies for inbound, outbound, and internal email.

Email DLP policies must be configured in the Forcepoint Security Manager Data Security module (Main > Policy Management > DLP Policies > Manage Policies). A new policy wizard provides the steps for creating a new email DLP policy. See Data Security Manager Help for detailed information.

You should create a DLP policy in the Data Security module if you want to use message encryption. Ensure the policy has an action plan of "encrypt." See Handling encrypted messages for information about email encryption options.

You can also create filter actions for use in a DLP action plan. See Creating and configuring a filter action for information about configuring a DLP filter action.

Data loss prevention policies are enabled by default in the Email Security module. However, the Email Security module must be registered with the Data Security module before the policies are applied to email. See Registering the DLP Module for instructions on how to register with the Data Security module.

If you need to enable DLP policies for some reason, click the DLP policy name on the Main > Policy Management > Policies page for inbound, outbound, or internal email, and set the following options in the Edit Policy page:

Status: Enabled or Disabled. Enable or disable the DLP policy. Data loss prevention policies are enabled by default.

Mode: Monitor or Enforce. Select Monitor if you want the data loss prevention function to simply monitor your email, and select Enforce if you want to apply DLP policies to your email.

Notification. Add a notification to a message when an email attachment to that message has been dropped as a result of a DLP policy.

Mark the Send notification when a message attachment is dropped check box to enable the sending of notifications.

Enter the notification message text.

Determine whether the notification text appears above or below the message body of the mail whose attachment was dropped.


	Note A message that triggers a DLP policy whose action is Quarantine is isolated in the Data Security module quarantine queue, not in an Email Security module queue. The message can be released for delivery by the Data Security module.