Classification Labels

An organization's data is a critical asset and the sharing of the same is done within and outside the organization via email for various reasons based on the nature of the business and its requirements. This infers that the data is not anymore bound by the encryption standards of the email service provider but also by the secure and just sharing of the same by the users in the organization.

Classification labels in Zoho Mail help organization administrators have control over the data shared via email by the users in the organization. The administrators can create different classification labels, assign the labels to the policies, and associate the policies to the users in the organization. Based on the controls configured in the classification labels, the sender and recipients will have access to the data as intended by the policy associated by the administrators on your organization data.

Classification labels - Process

Create and assign classification labels

The administrators of the organization can create multiple classification labels based on the organization need such as general labels, labels pertaining to a team/ department, labels pertaining to different kind of documents shared via email, etc. Check this page to learn more about the creation of classification labels.

Descriptions can be given for a label to help the Users and Administrators know the purpose of the label when they send an email using the particular label.

While creating a label, option is provided to Content mark an email or Encrypt the email sent using that particular label.

1. Content mark email - A Header and Footer can be added by default to all the emails sent using the label.
2. Encrypt email
   1. When the email is encrypted, the recipient of the email will receive only a link to access the email content. An OTP will be sent to their inbox to access the content of the email.
   2. Assign users and permissions:
      1. While choosing to encrypt the email sent using this label, the administrators can assign the recipient email addresses, providing them with the access to view the emails sent by your organization members. Anyone else having access to this email link will not be able to view the email.
      2. The administrator can choose to provide an expiry date for the encrypted email after which the recipients can't access the email content. The expiry can be set using a set amount of days or using a custom date.
      3. The administrator can choose to assign all the recipient addresses or only a specific user addresses to access the email. Once users are assigned, the permission (Read, Respond or Full access) to access the email content can be chosen.
   3. Assign users later:
      1. The administrators can choose to only create the label now with encryption configured. They can choose to assign the users and permissions later based on the requirement.

The email label can also be colour coded to provide differentiation between same label of different sensitivity levels to let know the sender and recipients of the sensitivity level of the email.

Create classification policies

Once the labels are created, the administrators can configure different classification policies for different users, teams/ departments based on the business and administrative requirements. Check this page to learn more about the creation of classification policies.

While creating a policy, the administrator can choose to mandate the policy for the users in the organization associated with the policy.

For each policy, a set of labels can be assigned from the list of classification labels created.

Once the labels are assigned, the policy can be associated with specific users or All users based on the requirement. Only the users whom the policy is associated with will be able to send emails with the labels assigned to that particular policy.

A default label can also be chosen for that particular policy. This label will be chosen by default when the users associated to the policy composes an email. The users can choose a different label (if any assigned) from the drop-down if they intend to change the default label.

Multiple policies can be associated with a specific user or user group and the application of the policies will be based on the priority set for the policies.

Set priority for the policies

Once the policies are created, they can be assigned priority from low to high (Top to bottom). When multiple policies are associated to a user or user group, the policy with highest priority will take precedence in being applied. Hence the default label associated with the highest priority policy will be applied by default when they compose an email. The email sender can choose to apply the labels from the drop-down based on the sensitivity of the data shared via email.

Sending emails by adding the labels

Once the classification policies are created and assigned to users in the organization, their email composer will list the labels for them to add when they compose and send the new emails.

To compose and send a new email with a classification label:

1. Log in to Zoho Mail.
2. Navigate to the left pane and click on the New Mail button
3. Compose window will be opened with the Sensitivity labels listed to the top-right of your compose window.
4. If a default label has been associated to the highest priority assigned to you, it will be chosen by default.
   1. You can use the labels drop-down to choose the appropriate label based on the requirement.
5. Once the label is chosen, you can compose the email and send it to the recipients with the classification label appended to it.
   1. The email will also be appended with any content marking or protected by an encryption based on the label configuration.

If the Classification Policy with the highest priority assigned to the user has mandated the use of classification label by the sender, then the sender must assign a label to the email that they send. If they don't assign a label, they will not be able to send the email.

Accessing emails assigned with a classification label

The emails assigned with a classification label will have different levels of accesses and controls based on the label configuration.

An email with a classification label:

1. Can be only content marked
2. Can be only encrypted
   1. Encrypted with recipients assigned to the label
   2. Encrypted with recipients chosen by the email sender while sending an email with the particular label
3. Can be content marked and encrypted

If the email recipient is also a Zoho Mail user, the email will be listed with the Classification label icon for the users to easily identify a classified email. For an external email services user, the email will be listed as a normal email.

Accessing a content marked email

To access a content marked email:

1. Log in to your email account.
2. Navigate to the classified email received.
3. Click the email to open the email preview.
4. The content markers will be appended to the header and footer of the email 

Accessing an encrypted email

To access an encrypted email:

1. Log in to your email account.
2. Navigate to the classified email received.
3. Click the email to open the email preview.
4. Click on the View the email button on the email preview to access the content of the email.
5. The email will open in a new tab as the email content will be protected by a passcode of SecurePass email.
6. Based on the permissions provided to the label, the recipient will have the following accesses:
   1. Read access - Recipient can read the email content and either view the attachment if preview is available or download the attachment if preview is not available.
   2. Respond access - Recipient can read mail content, reply, reply all and download attachments.
   3. Full access - Recipient can read mail content, reply, reply all, forward, download attachments and copy or print the mail.