Conditional Policy - Endpoint

Overview

The conditional policy Endpoint feature manages document security policies on a Local PC with Document Security 6 installed. This feature allows for the conversion of regular documents to MIP documents or DRM documents, as well as mutual conversion between MIP documents and DRM documents, and it can also decrypt DRM documents. Within a single policy, document conversion, security level designation, and upload blocking can be configured together.

If there is a connected external company, you can also configure policies on the same screen to convert (import) MIP documents protected by the external company into this company's documents or to convert (export) this company's MIP documents into the external company's label. For more details,External Company MIP Document Conversion SettingsPlease refer to it.

Purpose

• Set the conditional policies for the Local PC with Document Security 6 installed through the admin page.
• Automate the state transitions and security management of documents through conditional policies.

Prerequisites

• The Local PC subject to conditional policies must have Document Security 6 or higher installed.
• The local PC must be logged in to both Security365 and the SCI Server (Document Security server).
• To designate an external company MIP document as a policy target, go to [Integration Management] → [External Company Connection] and select the relevant company.**"Connected"**It must be in a state. Companies that are not connected do not appear in the target company list. The overall assumption isExternal Company MIP Document Conversion Settings > PreconditionsPlease refer to.

Policy Configuration Guide

• The policy name must be unique and cannot be duplicated.
• Mandatory fields (*) must be filled in for the policy to be saved.
• You must select at least one extension when specifying the extension.
• Members added to the exclusion list will not be subject to the policy, even if they are included in the assignment list.
• If you navigate to another page without saving when there is a policy change, the changes will be lost.
• If there are multiple execution policy cards, you can change the order of the cards using drag and drop.

Json Code Editor

When clicking an item in the registered policy list, in the top menu,JSON 보기You can use the feature. It shows the conditional policy for the registered policy in JSON code format and supports editing and saving functions. If there are multiple enforcement policies (cards) configured, they will be displayed and saved in an array format in JSON as well. During manual work, if there are any syntax errors, the policy may not function correctly, so thorough review is recommended.

Policy Creation and Option Settings

After logging into the admin page, navigate to [Conditional Policy] → [Endpoint] → [Document Security] menu.정책 등록Click the button and configure the information of the policy.

Policy Basic Information

Settings Item	Explanation
Policy Name	Enter the unique name of the policy. (No duplicates allowed)
Policy Description	Enter description information about the policy.

Members

Settings Item	Explanation
allocation	Specify the users, groups, or policy groups to which the policy will be applied.
Exclusion	Specify the members to be excluded from policy application. Excluded members will not be subject to the policy even if they are added to the assignment.

Allocation Settings Options:모든 사용자(Applies to all users within the registered organization) /사용자 및 그룹 선택(Only applies to specified users and groups)

Target Document | General Document

Setting Options	Explanation
Not applied	General documents are excluded from the target.
All General Documents	All general documents will be subject to this.
File Extension Specification	Only documents with the selected extension will be targeted. Please refer to the table below for supported extensions.

General document supported extensions (36 types)

division	extension
Text·Table	txt, rtf, csv
PDF	pdf
Microsoft Office	doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm
OpenDocument	odt, ods, odp
Other Document Formats	hwt, hwdt, hpt, cell, show, nxl, jtd, jayoopdf
image	bmp, dib, gif, img, jpeg, jpg, png, tif, tiff
compression	zip

Target Document | DRM Document

Setting Options	Explanation
Not applied	DRM documents are excluded from the subject.
All DRM Documents	All DRM documents are subject to this.
Designated DRM Document	Only DRM documents that meet specific conditions will be targeted.

Additional settings when selecting the specified DRM document:

• Constructor Verification: After checking whether the document creator is the same as the currently logged-in user, apply the policy accordingly.
  • Restrictions: The option is only exposed when the multi-server registration feature along the path [Integration Management] → [Document Security] is enabled.
  • Option: Enabled / Disabled (In the case of Enabled, specify "Policy applies when the document creator and the logged-in user match" / "Policy applies when they do not match")
• DRM Document Encryption Types: Select from DAC(ACL), MAC(category), GRADE(level). Depending on the selected type, you can enter the related ID.
• DRM Document Permissions: Check document permissions for logged-in users, creators, and added groups (read, edit, output, export, release, change permissions, print marking, validity period)
• File Extension Specification: Specify the extension of the target DRM document (doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm, pdf)

Target Document | MIP Document

Setting Options	Explanation
Not applied	MIP documents are excluded from the subject.
All MIP documents	All MIP documents protected by the target company are subject to this.
Designated MIP Document	Only documents that meet specific conditions among the MIP documents protected by the target company are eligible.

Target Company: Selecting "All MIP Documents" or "Specified MIP Documents" will display the target company dropdown at the top of the options area.

• The dropdown only shows the companies of this console and the companies that are in the "Connected" status in [External Company Connections]. The default selection is the company of this console.
• If you select an external company, the label list in "MIP Labeling" below will beLabel of the selected companybecomes.
• If you change the target company after already selecting a label, a confirmation window will appear, and confirming will reset the selected label.
• If there are no connected external companies, only the companies from this console will appear in the dropdown.

Additional settings when selecting the specified MIP document:

• Labeling: Use MIP label information as a condition (if the target company is an external company, select from that company's labels)
• File Extension Specification: Specify the extension of the target MIP document (doc, docx, xls, xlsx, xlsb, xlsm, ppt, pptx, pps, ppsx, pptm, pdf)

Common Settings

Security Label Check: This is an option used to determine whether to apply a security label to the document and its status, and to designate and change the security level.

Setting Options	Explanation
Not confirmed	Refers to all selected document types regardless of security label status.
Document with the specified label as the target	Refers to document types that have security labels applied
Targeting documents without labels	Refers to document types that do not have a security label applied.

pdf, zip, pptmThe extension is a format that does not support security labels and is excluded from label verification targets.

Document Path Specification

Settings Item	Explanation
All Paths	Policies are applied to files in all paths.
designated path	Policies are applied to files in the specified path. (Manual input or default paths: %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA%, %USERS%, %TEMP%, %GOOGLEDRIVE%)

Document Events

• Mouse Right-Click Menu
  • Right-click the mouse and click the [Encrypt Document] menu.
  • Right-click the mouse and click the [Document Conversion] menu.
  • Right-click the mouse and click the [Document Grade Setting] menu.
  • Right-click the mouse and click the [Delete MIP Label] menu.
  • Right-click the mouse and click on the document conversion menu with an external company — On the user's PC, depending on the document, it will display the menu as "Convert to Internal Document" (external company document) or "Convert to Document of Another Organization" (this company's document).
  • ※ Conversion types 4 ([General Document Encryption] / [Document Conversion] / [MIP Label Removal] / Document Conversion with External Companies) and [Document Classification Setting] cannot be selected simultaneously.
• Document Usage Method
  • Document Viewing/Editing and Exit (or Save)
  • Document Viewing
• Local Explorer
  • Moving/Copying Files in OneDrive
  • Moving/Copying Files to OneDrive
  • Moving/Copying Files in SharePoint
  • Moving/Copying Files with SharePoint
  • Moving/Copying Files in Google Drive
  • Moving/Copying Files to Google Drive
• Cloud
  • Downloading Files from the Cloud
  • Uploading files with Teams Copilot

Setting Conditions

Location (IP)

Setting Options	Explanation
No location restrictions	Policies are applied to all locations (IP).
Select from registered locations	Select a specific location to apply the policy.

time

Setting Options	Explanation
No time limit	Policies apply at all times.
Select from registered time	Select a specific time to apply the policy.

Document Execution Policy

The execution policy area isDocument Conversioncard andApplication of Document Security LevelsIt consists of cards. If the upload-related document event is selected, thenUpload BlockedAdditional cards will be displayed.

Card composition and execution order

• Document conversion cards and document security level application cards can be reordered by the administrator using drag and drop, with the card at the top being executed first.
• The top (first) card ismandatoryis treated as a failure, and the entire execution will be halted. Subcards areOptionIt is treated as a failure, but the overall result is processed as a success (failure details are logged).
• If the selected document event does not require any cards, those cards will be automatically deactivated and fixed with the non-executive options (conversion card: "Maintain Status" / grade card: "Maintain Grade").

Document Conversion Card

Setting Options	Explanation
Encryption with DRM	Encrypts the target document with DRM. (Encrypt all target documents forcibly, or apply according to the DRM encryption type (DAC/MAC/GRADE))
Encryption with MIP	Target CompanySelect the MIP label to apply. The default for the target company is the company in this console, and if you select a connected external company, it will be converted to that company's label.
DRM Removal	Decrypt the target DRM document and convert it to a regular document.
Maintain State	Does not change the status of the target document. Mainly used for exception handling.
Delete MIP Label	When the event specified in the target document occurs, it deletes the assigned state MIP label.

In "Encrypt with MIP", only one label can be specified. If you change the target company while the label is selected, the label will be reset after confirmation. Policies that select external companies will not be enforced once the connection with that company is severed.

Document Security Level Application Card

Setting Options	Explanation
Grade Maintenance	The security level of the target document will not be changed.
Security Level Settings	Assigns or changes the security level of the target document. The detailed UI will switch responsively based on the selected document event configuration.

Responsive UI for Security Level Settings

• If the document event includes a right-click [Set Document Rating](<Manually Specify Rating>): Query the rating information from the Security365 Management Center to expose the rating to the client.Multiple selectionYou need to separately specify the items to be displayed as the basic grade among the selected grades. The actual label selection is done on the client when the user right-clicks.
• If the document events consist only of implicit events such as end/save, viewing, etc.: destination1 grade + 1 labelSwitches to a UI that specifies, and is automatically applied with the designated grade and label.
• Changing the document event configuration will change the above judgment, so the already entered grade setting values may be reset after a warning.

Upload Block Card

• This is an ON/OFF toggle card that is only displayed when at least one of the events for moving/copying files to OneDrive/Sharepoint or moving/copying files to Google Drive is selected.
• The block target grade is not a card.[Target Document] > Check Security Labelspecifies.
• Execution order of applying document conversion and document security grade card isindependentIt operates as. If upload blocking is ON, the conversion and rating cards will not be executed in that upload event, but it does not affect the order setting itself between the conversion and rating cards.
• When uploading multiple files at once, each file is assessed individually, and the blocking or allowing results are provided.
• It can be applied to regular documents regardless of encryption status.

Display Policy List

The execution policy is displayed as a single column in the list. If multiple cards are set, the value of each card is|Displays in a single cell separated by a comma. (e.g.:MIP로 암호화 | S등급 자동)

If the target company of the target document is an external company, at the end of the target document summary|It is separated by __PH_0__ and the company name is displayed. The company of this console is not displayed.

External Company MIP Document Conversion Settings

This is the policy configuration used when exchanging MIP documents with connected external companies. Users do not select labels directly during conversion; they are converted to the company and label specified in the policy.

Usage Premise

**External company MIP document conversion only works when both companies are connected in the management console.**If there is no connection, you cannot select that company in the policy, and existing policies will not perform the conversion.

The conditions below areallIt must be met for the conversion to be successful.

division	Success Conditions
Yangsa Environment	Both companies must meet the five "Common Requirements for Both Parties" below. If only one side meets them, they will not be connected.
Company Connection	Management Console [Integration Management] → [External Company Connection] where the connection between two companies is**"Connected"**It must be in a state. One side requests a connection to the opponent's Extra ID, and it is established when the opponent's administrator approves it in "Received Requests." It does not convert in "Pending Approval," "Rejected," or "Released" states.
Conditional Policy	After the connection is established, you need to register the import or export policy on this screen and set it to use (ON). Selecting an external company and viewing that company's labels can only be done after the connection is established.
User PC	Document Security 6 must be installed and you must be logged in with Security365 mode.
Target Document	docx, xlsx, pptxIt must be a MIP document of the format.

Common Requirements for Two Companies

1. Using Microsoft 365
2. Azure App Registration Complete
3. Completion of SHIELD ID registration and app registration
4. SHIELD DRM Cloud Availability Status
5. Document Security 6 Usage

• A connection is a 1:1 relationship between two companies. Even if Company A is connected to Company B and Company C, documents between Company B and Company C cannot be converted.
• If one side disconnects, it will be disconnected on both sides, and even if the policies referencing that company remain, no conversion will be performed. To reuse, you must request and obtain approval for reconnection.
• If the connection is established but the other company's Azure app registration is not completed, the label retrieval and conversion for that company will not be valid.

Import — External Company Documents to This Company Document

Settings Area	Setting Value
Target Document	MIP document → "All MIP documents" or "Specified MIP documents",Target Company = External Company(To target only specific labels, label the company in the "Designated MIP Document")
Document Events	Right-click the mouse and click on the document conversion menu with an external company.
Document Conversion	"MIP Encryption"Target company = The company of this console, select this company's label) or "Encrypt with DRM"

The user right-clicks on the external company document and selects "Convert to Internal Document."

Export — This company's document to an external company's document

Settings Area	Setting Value
Target Document	MIP Document →Target company = The company of this console
Document Events	Right-click the mouse and click on the document conversion menu with an external company.
Document Conversion	"MIP Encryption"Target Company = External Company, the company's label selection

The user right-clicks on this company's MIP document and selects "Convert to another organization's document." The converted document is protected with the counterpart company's label, so the user who converted it cannot open it.

Precautions

• Conditional policies are evaluated in order of priority, and only the first matching policy is applied.When the destination company creates multiple export policies with the same target document conditions, only the policy with the highest priority will be applied.Document PathorMembersDistinguish the policies by __PH_0__.
• Policies for MIP documents saved before the target company item is added do not distinguish between companies. Editing these policies will select the target company as the company in this console, and saving it as is will limit the target to this company's MIP document.

Policy Settings

Usage Status

Setting Options	Explanation
ON	Activating the policy.
OFF	Disabling the policy.

Expiration Date

Setting Options	Explanation
No expiration date	No expiration date is set for the policy.
Expiration Date Setting	Set the start date and expiration date. (The expiration date can be set to indefinite)