First DLP Policy

The policy defines which users or devices the data protection rules should apply to.

Creating a policy alone does not yet define what the system should detect or block. After defining the policy scope, you must create or assign the appropriate rules to it.

In this guide, you will create the first policy, define its scope, and prepare it for adding DLP rules.

If you are not yet familiar with the relationship between a policy, a rule, a trigger, and an action, first see the page How data protection works.

Creating a policy

1

Go to the policy view

Go to:

Data Loss Prevention -> Policies

The view contains previously created policies, along with information about their configuration and assignments.

Data protection policy view.

2

Add a new policy

Click + Add policy.

The configuration panel for the new policy will open on the right side of the screen.

3

Enter a name and description

Enter:

• Policy name - required field. Use a name that clearly identifies the policy’s purpose.

• Description - optional information that makes it easier to later identify the purpose of the policy.

Instead of a generic name, for example Policy 1, it is better to use a name that describes the scope or purpose, for example:

• DLP - Accounting,

• USB Control - employees,

• Data Protection - mobile computers.

Basic information about the policy being created.

4

Select the computers covered by the policy

In the section Target objects specify the devices for which the policy should apply.

By default, the policy can include all devices.

If you want to limit its scope, select Custom, and then specify the appropriate computers or computer groups.

Selecting the computers covered by the policy.

Before leaving the setting that includes all devices, make sure the policy being created should actually apply across the entire environment. This is especially important for blocking rules.

5

Select the users covered by the policy

In the section Target users specify the users to which the policy should apply.

You can:

• apply the policy to all users,

• select Custom and specify selected users,

• specify users who should not be covered by the policy.

Exclusions are useful if the policy should apply to a broad group of users except for specific individuals.

Example:

The policy applies to all users of the Accounting department computers, but the IT administrator should be excluded from it.

Defining the users covered by the policy.

6

Set the policy status

In the section Status decide whether the policy should be active.

• Active - the policy can be applied after the rules are configured and the current configuration is delivered to the eAgents.

• Inactive - the configuration remains saved, but the policy is not applied.

While preparing a new configuration, you can leave the policy inactive and enable it only after configuration is complete and the rules have been verified.

An active policy status does not mean that every change made in the console has already been delivered to the computers. After completing the configuration, use the Update policies.

7

Go to rule creation

After entering the required information, the Next step.

button will become active. Click it to proceed to the configuration of the first rule assigned to the policy.

After creating the policy, you can start configuring its first rule.

Policy and rules

After completing the steps above, the scope of the policy.

has been defined. The next stage is to determine what the system should monitor and how it should respond.

Rules are used for this.

For example, a policy:

DLP - Accounting

may contain several independent rules:

Rule	Purpose
USB storage control	Control of USB media usage
Sending documents	Response to sending specified files
Copying data	Control of copying operations
Unauthorized applications	Response to the launch of specified processes

This eliminates the need to create a separate policy for each type of control.

A policy can be treated as the protection scope, while rules define the specific policies that apply within that scope.

Before enabling the policy

After creating the rules, review the entire configuration before applying it to a larger number of computers.

1

Check assignments

Make sure the policy covers the correct computers and users.

2

Check rule status

Verify that the rules that are supposed to run are active.

3

Check triggers and actions

For blocking rules, make sure the conditions are not too broad and do not restrict users from working properly.

4

Update policies

Click Update policiesto make the latest configuration available to the eAgents.

Until the update is delivered, computers may operate according to the previous version of the policies.

5

Run a test

If this is a new policy, test its behavior on a limited number of computers.

Perform a controlled event that matches the configured rule, and then check the result in:

Data Loss Prevention -> DLP Logs

New blocking rules should initially be deployed on a test computer or test group. This makes it possible to verify the configuration before applying it across the entire organization.

FAQ

Is creating a policy enough to start data protection?

No. The policy primarily defines the scope of operation. For the system to respond to specific events, the policy must contain properly configured rules.

Does a policy have to include all computers and all users?

No. The policy scope can be limited to selected computers, computer groups, or users. It is also possible to specify users excluded from the policy.

Can I create a policy and leave it disabled?

Yes. A policy can be configured and left inactive, and then enabled after configuration and testing are complete.

Can one policy contain several different rules?

Yes. One policy can contain multiple rules responsible for different types of data protection.

Why has the change not yet taken effect on the computer?

After changing the configuration, use the Update policies.

Until the current configuration is downloaded by the eAgent, the computer may operate according to the previous version of the policies.