Data Loss Prevention Policy

You have successfully created a custom protected identifier.

Testing a protected identifier

Follow these instructions to test the custom identifier:

1. Log in to Zoho Mail Admin Console and select Security & Compliance on the left pane.
2. Choose Data Loss Prevention and select Protected Identifier.
3. On the Predefined protected identifiers or Custom protected identifiers tab,
   1. Hover over the protected identifier and click the Test icon.
   2. Enter the mail content in the pop-up window.
   3. Click Test. The test result summarizes the primary and secondary matches based on the confidence level set for that identifier.

Review the test result and modify the identifiers if required. Proceed to DLP policy creation.

Create a DLP policy

The Data Loss Prevention (DLP) policy protects sensitive information when shared by your organization's users via email. Zoho Mail has built-in DLP policy templates to ease the DLP policy creation process. Alternatively, you can create a custom policy from scratch, based on your organization's DLP needs. The five stages of DLP policy creation are as follows:

• Choose a policy template
• Provide policy details
• Associate the policy to users
• Configure conditions and actions
• Set policy mode (test, enable, and disable)

As an admin, you can, 

• Create a DLP policy from a default template
• Create a custom DLP policy

Create a DLP policy from default template

Zoho Mail simplifies the DLP policy creation process by providing default templates that cater to specific regions and the domain of operation. The default templates are as follows:

• Financial
• Medical health
• Privacy

Follow these instructions to create a DLP policy using a predefined template:

1. Log in to Zoho Mail Admin Console and select Security & Compliance on the left pane.
2. Choose Data Loss Prevention and select Policies.
3. Click Create from the top menu and select the preferred options for:
   1. Region - The region can be All or a specific country.
   2. Category - Select the industry of operation such as Financial, Medical health, or Privacy.
   3. Template - Choose the template from the available options.
4. Click Next.
5. Enter the Policy name and Policy description, and click Next.
6. Select the users to whom the policy should apply.
   1. All users - The policy will be processed for all users in your organization.
   2. Selected users - The policy will be processed only for selected users.
   3. All users except selected users - The policy will be processed for all users in your organization, except the selected users.
7. Click Add and select the desired users.
8. Review the selected users and click Add.
9. Click Next.
10. Choose the policy settings from the below options.
    1. Review and proceed - The conditions will be set automatically based on the selected template. Use this option to proceed with the existing conditions.
    2. Modify - Select Modify and change the conditions based on your preference.

11. Click Add actions and select one or more actions.

    Action type	Description	Input from admin
    Block all	Blocks the email.	None.
    Block outside organization	Blocks the email if the mail is sent to an outside organization.	None.
    Add Headers	Preferred headers can be added in addition to the default headers.	Enter the header name and value. Click the    add icon to add multiple headers.
    Remove Headers	Headers can be removed other than default headers.	Enter the header that needs to be removed. Click the    add icon to remove multiple headers.
    Add Recipients	Recipients can be added to that filtered mail.	Click Add and select the users. Review the Selected users and click Add.
    Move to Quarantine	Emails will be Quarantined, and admins can review them.	None.
    Add to activity explorer	Email will be audited and can be monitored by admin.	None.
    Prepend subject	Emails matching the specified conditions will have the text you mention added to the beginning of the email subject.	Enter the text to be prepended.
    Add HTML Disclaimer	HTML disclaimer can be added above or after the content.	Enter the HTML content. Select Append or Prepend based on your requirements.
    Modify the subject	The subject of the emails that matches the specified conditions will have the subject modified according to your requirements.	Enter a regular expression and click  . Enter the subject content.

12. Select the policy mode.
    • Enabled - Policy is ON, and actions will be taken if policy matches.
    • Testing - Policy will be applied for audit purposes, and matches will be recorded for admin review. Actions will not be performed.
    • Disabled - Policy is OFF.
13. Select Stop Evaluation if required. When selected, if an email matches this DLP policy, it will not processed for the subsequent policies.
14. Click Save. The DLP policy gets created.

Hover over a policy and select the edit or delete icon to modify the policy or delete it. Refer to the instructions in the modify policy mode section if you want to change the mode at a later stage.

Create a custom DLP policy

As an administrator, you can create policies from scratch using the combination of predefined protected identifiers and custom protected identifiers based on your organization's DLP requirements. The custom policy can be configured based on the type of content and type of protection that you want to provide.

Follow these steps to create a custom DLP policy:

1. Log in to Zoho Mail Admin Console and select Security & Compliance on the left pane.
2. Choose Data Loss Prevention and select Policies.
3. Click Create from the top menu and select the region from the drop-down.
4. Choose Custom under Select category and click Next.
5. Enter a Policy name and Policy description, and click Next.
6. Select the users to whom the policy should apply.
   1. All users - The policy will be processed for all users in your organization.
   2. Selected users - The policy will be processed only for selected users.
   3. All users except selected users - The policy will be processed for all users in your organization, except the selected users.
7. Click Add and select the desired users.
8. Review the selected users and click Add.
9. Click Next.
10. Select the Condition type from the available options.
    • AND - The policy will be applied only when all the conditions match in the email.
    • OR - The policy will be applied when any one condition matches.
    • AND/ OR - The policy will be applied based on the advanced conditions selected.

11. Select one or more Conditions from the available options.

    Condition type	Description	Supported Expressions	Admin Input Required
    Content	Scans email content for sensitive information using Protected Identifiers	contains, does not contain	Select Protected Identifiers, Confidence level and minimum instance.
    Header	Evaluates email header fields	contains, does not contain, is, is not
    Body	Checks the email body content	contains, does not contain
    Subject	Checks the email subject line
    Attachment	Applies conditions based on attachment
    Attachment Type	Applies conditions based on attachment type	is, is not	Compressed files, torrent, ebook, pdf, video, image, audio, spreadsheets, presentation, executable, text documents.
    From Address	Matches the sender’s email address	is, is not	Specify the required email address.
    To Address	Matches recipient email address
    Cc Address	Matches CC recipient address
    Bcc Address	Matches BCC recipient address
    Recipient Domain Name	Matches the recipient’s domain	is, is not	Specify the required domain.
    Sender Domain Name	Matches the sender’s domain
    Mail Size	Applies conditions based on the email size	greater than or equal, lesser than or equal	Specify the required size.
    Attachment Size	Applies conditions based on the attachment size
    Attachment Name	Applies conditions based on attachment file name	is, is not	Specify the required file names.
    Non-inspectable Attachment Type	Applies to attachments that cannot be scanned or inspected by DLP	is	Select the applicable attachment type: Protected attachment, No guarantee attachment, or Unscannable attachment.
    Classification Label	Applies conditions based on data classification labels associated with the email.	is, is not	Specify the required labels.

12. Select one or more Actions.

    Action type	Description	Input from admin
    Block all	Blocks the email.	None.
    Block outside organization	Blocks the email if the mail is sent to an outside organization.	None.
    Add Headers	Preferred headers can be added in addition to the default headers.	Enter the header name and value. Click the    add icon to add multiple headers.
    Remove Headers	Headers can be removed other than default headers.	Enter the header that needs to be removed. Click the    add icon to remove multiple headers.
    Add Recipients	Recipients can be added to that filtered mail.	Click Add and select the users. Review the Selected users and click Add.
    Move to Quarantine	Emails will be Quarantined, and admins can review them.	None.
    Add to activity explorer	Email will be audited and can be monitored by admin.	None.
    Prepend subject	Emails matching the specified conditions will have the text you mention added to the beginning of the email subject.	Enter the text to be prepended.
    Add HTML Disclaimer	HTML disclaimer can be added above or after the content.	Enter the HTML content. Select Append or Prepend based on your requirements.
    Modify the subject	The subject of the emails that matches the specified conditions will have the subject modified according to your requirements.	Enter a regular expression and click  . Enter the subject content.

13. Click Next.
14. Select the policy mode.
    1. Enabled - Policy is ON, and actions will be taken if the policy matches.
    2. Testing - Policy will be applied for audit purposes, and matches will be recorded for admin review. Actions will not be performed.
    3. Disabled - Policy is OFF.
15. Select Stop Evaluation if required. When selected, if an email matches this DLP policy, it will not processed for the subsequent policies.
16. Click Save. You have successfully created a custom DLP policy.

Hover over a policy and select the edit or delete icon to modify the policy or delete it. Refer to the instructions in the modify policy mode section if you want to change the mode at a later stage.

Modify policy mode

DLP in Zoho Mail allows an admin to create a policy and choose the policy mode as per their organization's requirements. Even after creating a policy, admins can change the policy mode based on their organization's requirements. All changes made to a DLP policy can be reviewed from the Logs section.

Follow these steps to change the policy mode:

1. Log in to Zoho Mail Admin Console and select Security & Compliance on the left pane.
2. Choose Data Loss Prevention and select Policies.
3. Click the drop-down from the Status section and choose the preferred policy mode.
   • Enabled - The policy is ON, and the actions will be taken if the policy matches.
   • Testing - The policy will be applied for audit purposes, and matches will be recorded for admin review. Actions will not be performed.
   • Disabled - The policy is OFF.

You have successfully modified the policy mode.

Logs

Based on the size and operational requirements of a business, organizations can have multiple email administrators managing DLP for their organization. In such cases, one or more admins can create custom protected identifiers, create or modify DLP policies. Most regulatory bodies require businesses to track and monitor the activities done by admins for compliance and audit purposes. The Logs section in the DLP console records the actions done by all the administrators of your organization. These logs are categorized as:

• Audit Logs - All the activities performed by administrators are recorded in the Audit Logs section. Admins can monitor the event category, event description, action performed by, and the event time of all the actions done by the administrators.
• Activity Explorer - Emails that match a DLP policy are stored and are available for the admin to view and understand the working of DLP policies and take action accordingly. These logs get stored for those DLP policies that are in the Enabled or Testing mode.

Annexure I

Below is a list of predefined Protected Identifiers supported in Zoho Mail:

Annexure II

Below is the list of predefined functions/validators supported by Zoho Mail: