Security·4,773 discussions

Reporting violators of DLP policies

Tags: Security

We use a DLP solution, Digital Guardian, at our healthcare organization. Based on set rules, emails that are detected to have PHI and PII are encrypted, even if the user does not initiate the encryption. Whenever someone does not encrypt a message with PII or PHI, we get alerted. Then, we send an email to the violator, adding people such as the CISO and chief compliance staff members to chime in. Is this necessary? I do not want to be a tattletale, but I also don’t want people violating security policy. Is there a better route to take, such as educating the user on the importance of email encryption and/or reporting violators to the compliance office without putting the user on blast.

Topic

Telling HR is not setting the user on blast.

In reply to Reporting violators of DLP policies

Let HR do it’s thing. It’s their job.

Reply To: Reporting violators of DLP policies

In reply to Reporting violators of DLP policies

Review and analyze DLP reports. Manage permissions for DLP reports. Identify and mitigate DLP policy violations. Mitigate DLP violations in Microsoft …

[Author]

Replies