What DLP and Email Encryption Tools Are
Written by MSP Outpost.
In Short
Data loss prevention watches for sensitive information leaving a client, through email, uploads or removable media, and blocks or flags it. Email encryption makes sure a message and its attachments can only be read by the intended recipient. Both are about data going out, which is where they differ from email security that filters threats coming in.
What It Does
- Content detection. Messages and files checked for sensitive data such as account numbers, health records or client lists.
- Policy enforcement. Sensitive content blocked, quarantined, encrypted or flagged for review, depending on the rule.
- Message encryption. Email encrypted automatically by rule or on the sender's request, with a way for any recipient to read it.
- Endpoint controls. Uploads, printing and copies to removable media restricted on the device itself.
- Audit trail. A record of what was sent, blocked or opened, for the client's compliance evidence.
When You Need One
Most MSPs do not need a separate product. The encryption and basic data protection rules included in the client's email platform license cover most small clients.
Needed when you take on clients in regulated work, such as healthcare, legal or finance, whose insurers or auditors ask for it. Start with email encryption that is easy for recipients, then add DLP rules for those clients.
Worth a standard offering, because regulated clients will expect policies, audit trails and reporting to be consistent. Full endpoint DLP is a larger project and is usually sold to specific clients, not rolled out to all.
What to Look For
Must Have
- Policy-Based Encryption
- Recipient Reading Without an Account
- Predefined Data Patterns
- Multi-Tenant Management
- Audit Log
Worth Having
- Endpoint DLP
- Message Recall
- Cloud Storage Controls
- Custom Data Patterns
- User Justification Prompts
How It Is Priced
Pricing is usually per user per month, and several vendors quote only. Watch for minimum user counts, annual terms, endpoint DLP sold separately from email, and overlap with protection the client already pays for in their email platform license.
Switching
Encryption is the harder part to leave: recipients of past encrypted messages may lose access once the service ends, and archives must stay readable. Before you sign, settle how long past encrypted messages remain readable after you cancel, whether policies can be exported, and how DLP rules move to another product.
Questions to Ask a Vendor
- What does a recipient have to do to read an encrypted message, and do they need an account?
- Can past encrypted messages still be read after the contract ends, and for how long?
- What does this add over the protection in the client's email platform license?
- Is endpoint DLP included, or priced as a separate product?
- What is the minimum user count, and does it apply per client?
- How many false positives should I expect from the default rules, and who tunes them?
