Conditional Policy - Endpoint

Overview

The conditional policy Endpoint feature manages document security policies on a Local PC with Document Security 6 installed. This feature allows for the conversion of regular documents to MIP documents or DRM documents, as well as mutual conversion between MIP documents and DRM documents, and it can also decrypt DRM documents. Within a single policy, document conversion, security level designation, and upload blocking can be configured together.

Purpose

• Set the conditional policies for the Local PC with Document Security 6 installed through the admin page.
• Automate the state transitions and security management of documents through conditional policies.

Prerequisites

• The Local PC subject to conditional policies must have Document Security version 6 or higher installed.
• The local PC must be logged in to both Security365 and the SCI Server (Document Security server).

Policy Configuration Guide

• The policy name must be unique and cannot be duplicated.
• Required fields (*) must be filled in for the policy to be saved.
• You must select at least one extension when specifying the extension.
• Members added to the exclusion list will not be subject to the policy, even if they are included in the assignment list.
• If you navigate to another page without saving when there is a policy change, the changes will be lost.
• If there are multiple execution policy cards, you can change the order of the cards by dragging and dropping.

Json Code Editor

When clicking an item in the registered policy list, in the top menu,JSON 보기You can use the feature. It shows the conditional policy for the registered policy in JSON code format and supports editing and saving functions. If there are multiple enforcement policies (cards) configured, they will be displayed and saved in an array format in JSON as well. During manual work, if there are syntax errors, the policy may not function properly, so thorough review is recommended.

Policy Creation and Option Settings

After logging into the admin page, navigate to [Conditional Policy] → [Endpoint] → [Document Security] menu.정책 등록Click the button and configure the information of the policy.

Policy Basic Information

Settings Item	Explanation
Policy Name	Enter the unique name of the policy. (No duplicates allowed)
Policy Description	Enter description information about the policy.

Members

Settings Item	Explanation
allocation	Specify the user, group, or policy group to which the policy will be applied.
Exclusion	Specify the members to be excluded from policy application. Excluded members will not be subject to the policy even if they are added to the assignment.

Allocation Settings Options:모든 사용자(Applies to all users within the registered organization) /사용자 및 그룹 선택(Only applies to specified users and groups)

Target Document | General Document

Setting Options	Explanation
Not applied	General documents are excluded from the subject.
All general documents	All general documents will be targeted.
File Extension Specification	Only documents with the selected extension will be targeted. Please refer to the table below for supported extensions.

General document supported extensions (36 types)

division	extension
Text·Table	txt, rtf, csv
PDF	pdf
Microsoft Office	doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm
OpenDocument	odt, ods, odp
Other Document Formats	hwt, hwdt, hpt, cell, show, nxl, jtd, jayoopdf
image	bmp, dib, gif, img, jpeg, jpg, png, tif, tiff
Compression	zip

Target Document | DRM Document

Setting Options	Explanation
Not applied	DRM documents are excluded from the subject.
All DRM Documents	All DRM documents are subject to this.
Designated DRM Document	Only DRM documents that meet specific conditions will be targeted.

Additional settings when selecting the specified DRM document:

• Constructor Verification: After checking whether the document creator is the same as the currently logged-in user, apply the policy accordingly.
  • Constraints: The option is only exposed when the multi-server registration feature along the path [Integration Management] → [Document Security] is enabled.
  • Option: Enabled / Disabled (In the case of Enabled, specify "Policy applies when the document creator and the logged-in user match" / "Policy applies when they do not match")
• DRM Document Encryption Types: Select from DAC(ACL), MAC(category), GRADE(level). Depending on the selected type, you can enter the related ID.
• DRM Document Permissions: Check document permissions for logged-in users, creators, and added groups (read, edit, output, export, release, change permissions, print marking, validity period)
• File Extension Specification: Specify the extension of the target DRM document (doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm, pdf)

Target Document | MIP Document

Setting Options	Explanation
Not applied	MIP documents are excluded from the subject.
All MIP documents	All MIP documents are subject to this.
Designated MIP Document	Only MIP documents that meet specific conditions will be targeted.

Additional settings when selecting a designated MIP document:

• Labeling: Use MIP label information as a condition
• File Extension Specification: Specify the extension of the target MIP document (doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm, pdf)

Common Settings

Security Label Verification: This is an option used to determine whether a security label is applied to the document and its status, and to designate and change the security level.

Setting Options	Explanation
Not confirmed	Refers to all selected document types regardless of security label status.
Document with specified label as target	Refers to document types that have security labels applied
Targeting documents without labels	Refers to document types that do not have a security label applied

pdf, zip, pptmThe extension is a format that does not support security labels and is excluded from label verification targets.

Document Path Specification

Settings Item	Explanation
All Paths	Policies are applied to files in all paths.
designated path	Policies are applied to files at the specified path. (Manual input or default provided paths: %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA%, %USERS%, %TEMP%, %GOOGLEDRIVE%)

Document Events

• Mouse Right-Click Menu
  • Right-click the mouse and click on the [Encrypt Document] menu.
  • Right-click the mouse and click on the [Document Conversion] menu.
  • Right-click the mouse and click the [Document Rating Setting] menu.
  • Right-click the mouse and click the [Delete MIP Label] menu.
  • ※ Conversion types 3 ([General Document Encryption] / [Document Conversion] / [MIP Label Removal]) and [Document Classification Setting] cannot be selected simultaneously.
• Document Usage Method
  • Document Viewing/Editing and Exit (or Save)
  • Document Viewing
• Local Explorer
  • Moving/Copying Files in OneDrive
  • Moving/Copying Files to OneDrive
  • Moving/Copying Files in SharePoint
  • Moving/Copying Files in SharePoint
  • Moving/Copying Files in Google Drive
  • Moving/Copying Files to Google Drive
• Cloud
  • Downloading Files from the Cloud
  • Uploading files with Teams Copilot

Setting Conditions

Location (IP)

Setting Options	Explanation
No location restrictions	Policies are applied to all locations (IP).
Select from registered locations	Select a specific location to apply the policy.

time

Setting Options	Explanation
No time limit	The policy applies at all times.
Select from registered time	Select a specific time to apply the policy.

Document Execution Policy

The execution policy area isDocument Conversioncard andApplication of Document Security ClassificationIt consists of cards. If the upload-related document event is selected, thenUpload BlockedAdditional cards will be displayed.

Card Composition and Execution Order

• Document conversion cards and document security level application cards can be reordered by the administrator using drag and drop, and the card on top will be executed first.
• The top (first) card isRequiredIf treated as a failure, the entire execution will be halted. Subcards areOptionIt is treated as a failure, but the overall result is processed as a success (failure details are logged).
• If the selected document event does not require any cards, those cards will be automatically disabled and fixed with the non-executive options (conversion card: "Maintain Status" / grade card: "Maintain Grade").

Document Conversion Card

Setting Options	Explanation
Encryption with DRM	Encrypt the target document with DRM. (Forcefully encrypt all target documents or apply according to the DRM encryption type (DAC/MAC/GRADE))
Encryption with MIP	Select the MIP label to apply to the target document.
DRM Removal	Decrypts the target DRM document and converts it into a regular document.
Maintain State	The status of the target document is not changed. It is mainly used for exception handling.
Delete MIP Label	When the event specified in the target document occurs, it deletes the assigned status MIP label.

Document Security Level Application Card

Setting Options	Explanation
Grade Maintenance	The security level of the target document will not be changed.
Security Level Settings	Assigns or changes the security level of the target document. The detailed UI will switch responsively according to the selected document event configuration.

Responsive UI for Security Level Settings

• If the document event includes right-click [Set Document Rating](<Manually Specify Rating>): Query the rating information from the Security365 Management Center to expose the rating to the client.Multiple selectionYou need to separately specify the items to be displayed as the basic grade among the selected grades. The actual label selection is done on the client when the user right-clicks.
• If the document events consist only of implicit events such as end/save, viewing, etc.: destination1 grade + 1 labelIt switches to a UI that specifies, and is automatically applied with the designated grade and label.
• If you change the document event configuration, the above judgment will change, so the already entered rating settings may be reset after a warning.

Upload Block Card

• This is an ON/OFF toggle card that is displayed only when one of the events for moving/copying files to OneDrive/SharePoint or moving/copying files to Google Drive is selected.
• The block target grade is not a card but rather**[Target Document] > Check Security Label**specifies.
• Execution order of applying document conversion and document security grade card isindependentIt operates as. If the upload blocking is ON, the conversion and rating cards will not be executed in that upload event, but it does not affect the order setting itself between the conversion and rating cards.
• When uploading multiple files at once, each file is evaluated individually, and the blocking/allowing results are provided.
• It can be applied to regular documents regardless of encryption status.

Display Policy List

The execution policy is displayed as a single column in the list. If multiple cards are set, the value of each card is|Displays in a single cell separated by a comma. (e.g.:MIP로 암호화 | S등급 자동)

Policy Settings

Usage status

Setting Options	Explanation
ON	Activates the policy.
OFF	Disabling the policy.

Expiration Date

Setting Options	Explanation
No expiration date	No expiration date is set for the policy.
Expiration Date Setting	Set the start date and expiration date. (The expiration date can be set to indefinite)