CSO grade

Feature Details

warning

Please be informed that there are some restrictions on data access.
Detailed information about the CSO rating feature isnextYou can check it at.

Right-click to assign grade

1. Overview

Users can assign a rating to the document through the right-click menu.

2. Feature Settings (Required and Optional)

The required items among the below must be set for the functionality to work.

1. Add management center domain to DS_MIP_INIT policy (required)

You need to add the Security365 management center domain of the custom policy DS_MIP_INIT's json data below. (This is to retrieve security ratings and label information.)

\{
    ...
    "s365_portal_url":"https://devspsvr.softcamp.co.kr"     // 주의) 해당 주소값은 예시이며, 사이트에 적용시 알맞은 public 도메인으로 변경 필요함.
    ...
\}

2. Add Right-Click Menu (required)

Add a rating designation menu to the custom policy DS_MIP_SHELL_MENU**(link)**

\{
    ...
    \{
        "titleRes": "SHELL_MODIFY_SECULABEL",           // Menu name
        "titleDesc": "UI_DRM_TO_AIP_DESC",
        "targetCmd": 254,                               // This value is fixed, so it must be 254
        "targetIcon": "ApplySecuLabel.bmp",             // Menu icon resource
        "targetExt": "doc|xls|docx|pptx|xlsx|xlsb",
        "targetType": "*"
    \}
    ...
\}

Related Resources
- C:\Windows\Softcamp\SDK\Res\DS\ResUIKOR.rcmySHELL_MODIFY_SECULABEL = LabelingAdd definition

3. Basic Selection Grade Settings (option)

To set the default selected grade in the grade designation UI, you must set the default grade selection in the execution policy in the ztcap console.

The execution policy backdata includes the following basic grade designation data.

{
    //...
    "category": "availableSecurityLevelList",
    "info": {
      //...
      "defaultSelectLevelId": "iqCCmC4N-ADUvGusn-4Gkhlyi6-vPJQvg6r"     // 기본지정 등급 아이디
      //...
    }
}

If there is no applicable policy, the label of the first grade level is selected.

warning

For the rating assignment feature to work, the security grade & label information must be registered in the management center (spsvr) service, and also, the policies regarding which grades can be assigned and changed must be registered in the conditional policies for it to function.

A. Management Center - Security Level & Label Registration

B. Conditional Policy (ztcap): Policy for Convertible Security Labels

- ztcap policy must establish a policy regarding what security level (label) the current document can be changed to. ( [Development Background Data Related](https://wiki.SOFTCAMP.co.kr/pages/viewpage.action?pageId=162349616) )
    - [Conditional Policy - Endpoint Menu Guide](https://idocs.SOFTCAMP.co.kr/shieldrm/Guide/Webconsoleguide/Policy_Management/Endpoint)

Applying Overlay Icon

1. Overview

Provides overlay icon identification feature for documents designated with document grade (C/S/O) in DS 6.0 ENT.
Applicable colors:Red 🔴, Green 🟢, Yellow 🟡

2. Constraints

If there are multiple (more than 12) overlay icons installed on Windows, existing overlay icons may not be displayed.
In a client environment where the module is applied before feature development, the identification information is deleted when a document with a document grade icon is edited/saved. The information that is deleted is the metadata stored in the pre header, and the grade information data is stored within the document, so the grade icon is reapplied when the file is opened/saved.
Documents with document grade icons may have their icon identification information removed according to site policies when uploaded to or downloaded from Teams and SharePoint document libraries.

Document Properties Window Security Level Display

1. Overview

Right-click on the file in Windows Explorer and**[Attribute]When you open __PH_0__, next to the existing tabs"Security Level" tabThis will appear new. In this tab, users can apply to the document.C/S/O Security Level(C/S/O = Document Security's document security classification system that categorizes documents as confidential, sensitive, public, etc.)Check directly in read-only modecan do. General documents · Company DRM (Digital Rights Management, Company Document Encryption) documents · MIP (Microsoft Information Protection, Microsoft Information Protection) documentsany type**It works the same way.

Reason for Needing This Feature

The C/S/O security levels applied to the document so far areSmall overlay icon displayed on top of the explorer iconIt could only be confirmed by __PH_0__. The overlay icon has a limit on the number of items displayed simultaneously and is small, making it difficult to reliably verify the grade of a specific document. Additionally, the existing "Security Document Information" tab (for MIP documents) only shows MIP label and permission information, and does not address C/S/O security grades.

This feature allows users to**Check the rating directly in the properties window without relying on the overlay icon.**To enable this, a security grade display tab that applies to all document types is provided.

Operation Method

document inRead hidden stored security level informationThe attribute tab shows 4 items (Grade ID · Grade Name · Label ID · Label Name). Since protected documents require internal decryption to read the grade, ensure that the property window does not freeze.**Query in the background and update the results after the "Loading" progress indicator.**does.

Also document security inIn the logged-out state (not logged in), the "Security Level" tab does not appear, and(Displayed only when logged in online),Document without a ratingis query failure andDistinct separate guidance textIt is marked as ("Document without security classification").

info

Summary: Right-click on the file in Explorer → [Properties] →"Security Level" tabWhen you open it, the C/S/O security level of that document (level ID, level name, label ID, label name) is displayed as read-only. It works with all document types: General, DRM, and MIP.

Scope / Entry Point

#	Entry Point	User Action
1	Explorer File Properties Window	Right-click on the file in Windows Explorer → [Properties] → Select the "Security Level" tab

warning

This feature isDocuments supported by Document Security extensionsThe "Security Level" tab appears only in (Office, PDF, etc.). The tab is not displayed for unsupported files (e.g., images, text).

2. Displayed Security Level Information

When you open the "Security Level" tab, it displays the security level information applied to the document in the following 4 items.

item	meaning
Security Level ID	Identification number of the security level applied to the document
Security Level Name	Security Level Name
Label ID	Identification number of the label applied to the document
Label Name	Label Name

The displayed grade name and label name are**Save the name as it is stored in the document.**Shows (no separate normalization or substitution). The protected document may take time to read the grade information, so it first displays "Loading" on the tab and then updates with the results (the property window does not stop).

Select Display Item (Admin Option)

Basically, the "Security Level" tab isSecurity Level Name · Label NameDisplays only (2 items of names). Administrators can customize policies.DS6_UI_OPTIONYou can register __PH_0__ to select the items to display in this tab. (e.g., hide the ID item, which is a management and diagnostic identifier, or display it along with the ID)

If no policy is registered (default): Only the security grade name and label name are displayed.
If a policy has been registered: Only the listed items will be displayed. The display order is always fixed (Security Level ID → Level Name → Label ID → Label Name), and items not listed will not be displayed.

The items that can be displayed are the following four:

Item Name	Explanation
levelId	Security Level ID
levelName	Security Level Name
labelId	Label ID
labelName	Label Name

Custom PolicyDS6_UI_OPTIONJSON datacsoPropSheetSpecify the "list of item names to display" as an item.

// 4개 항목 모두 표시
{
  "csoPropSheet": ["levelId", "levelName", "labelId", "labelName"]
}

// 이름 2개 항목만 표시 (기본과 동일)
{
  "csoPropSheet": ["levelName", "labelName"]
}

info

Item names are case-sensitive. If the name is misspelled, the format is incorrect, or if there are no valid items, it will safely display the default value (two item names).

Related Modules:SCRA_DS365Prop (SCRA_DS365Prop64.dll, 6.0.0.7)

3. User Screen

The screen layout of the "Security Level" tab is as follows (top logo + progress indicator + 4 rows of information).

┌─ File Properties ──────────────────────────────────┐
│ [General] [Document Security Information] [Security Level]            │
│ ┌──────────────────────────────────────────┐ │
│ │  (Document Security logo)                 │ │
│ ├─ Security Level Information ─────────────────────────┤ │
│ │  Security Level ID    : 2                      │ │
│ │  Security Level Name      : Internal Only                 │ │
│ │  Label ID         : 10                     │ │
│ │  Label Name          : General                │ │
│ └──────────────────────────────────────────┘ │
└──────────────────────────────────────────────┘

Before the query is complete, the phrase "Querying" andProgress Baris displayed, and when the query is finished, 4 rows of information will be filled in that place (entry into the property window does not stop).
Documents without a specified grade are**"Document without a security classification"If the message is displayed and the other grades cannot be read (no decryption permission, agent not started, etc.), then"Unable to retrieve"**The phrase will be displayed.
This tab isRead-onlyThere is no route to change or designate the grade.

4. Multilingual Support

Tab title · Item label · "Loading" · "Unable to load" and other screen texts are6 languagesis provided.


division	content
Supported Languages	Korean / English / Japanese / Chinese / German / Russian
Resource	`ResUIKOR/ENG/JPN/CHN/DEU/RUS.rc`of`[DS365Prop]`Section C/S/O Phrase Key 9 Types (Including Unrated Phrases)
Determine Display Language	The resource phrase corresponding to the system locale is displayed.
Default value (fallback) = English	If the phrase resource has not been deployed or the corresponding language key cannot be found, the English phrase will be displayed (the same behavior as the current product resource operation that passes the English default phrase along with the call).

warning

For multilingual phrases to display correctly,ResUI*.rc6 types (6.0.0.36) must be distributed together with the SDK installation package. In non-distributed environments, it will be displayed in English.

5. Operation Scenario Summary Table

#	situation	Operation Result
1	The support extension document (General·DRM·MIP) is subject to classification.	"Security Level" tab display → "Loading" → Display 4 rows (Level ID · Level Name · Label ID · Label Name)
2	Support extension document but no grade assigned	"Security Level" tab display → "Documents without a specified security level"
3	Protected document, but no decryption permission.	"Security Level" tab display → "Not Available"
4	Security365 agent is not running	"Security Level" tab display → "Not Available" (No freeze in property window)
5	Unsupported file types (images, text, etc.)	"Security Level" tabUnmarked
6	Document Security Logout or Offline Login Status	"Security Level" tabUnmarked(Displayed only when logged in online)

The attribute window does not stop while the grade is being queried, and the results will be updated in place once the query is complete.

6. Support Scope (Extension / Document Type)

Tab Exposure Target: Document Security supports file types (Office, PDF, etc.). The determination is based on the product registered**Supported Extension List (Read-Only Shared Memory)**It is performed with.
Document Type: General (Plain Text) · Company DRM · MIP documents all. Only the decryption status varies by type, and the tab operation is the same.
Login Status: Document SecurityOnline Login StatusThe "Security Level" tab is only displayed in __PH_0__. The tab does not appear when logged out or in offline login status.
Not supported: Tabs do not appear for files that are not in the supported extension list.

7. Constraints

item	content
Reason for inability to retrieve information section separation	Documents without a specified grade are marked separately with the phrase "Document without security grade designation." Other reasons such as no decryption permission and agent not running are displayed with a single "Not available for inquiry" phrase without distinguishing the reasons.
Agent Dependency	Security level inquiry is done through the Security365 agent (`DS365.Core`It depends on the pipe server. When the agent is not running, it is displayed as "Not Available" (safely handled without freezing the property window).
Color and Normalization Names Not Applied by Grade	This feature displays the grade name as it is stored in the document, along with overlay icons and similarColor display by grade·Management Center Grade System CriteriaNormalization Name (Confidential/Sensitive/Public)Conversion is not included.
Exclusion of visibility by permission and role, and policy conflict handling	The audit log for grade inquiries defined in the planning, visibility by role and department scope, and notification of display policy conflicts (5 types of statuses) are outside the scope of this work and are areas for future development.
Logout · Tab not displayed when offline	Document security displays the tab only when logged in online. The "Security Level" tab does not appear when logged out or in offline login status.

Automatic Assignment of C/S/O Grades at Document Closure

1. Overview

At the time of saving or closing (exiting) the document, the system must apply the single C/S/O security classification (Confidential, Sensitive, Public) specified by the company's security policy.Automatically without user interventionIt is a feature that assigns to documents. If the administrator has pre-defined the "applicable grade·label" in the conditional policy, that grade will be applied as is when save·exit events occur on the target document.

This automatic designation is for assigning C/S/O grades.Basic (Existing) Pathand "User manual C/S/O grade designation at document termination" is an extended path that allows the user to choose the grade directly at the same time. The two methods branch with the server policy card and cannot be applied simultaneously in one document.

Reason for Needing This Feature

In environments where the grading system is simple or grades are fixed at the department level, it is more efficient for users to be assigned grades collectively according to organizational policy without having to choose a grade each time.
Right-clicking the [Document Rating Settings] menu only works when the user intentionally executes it, so in the typical flow of creating a new document and simply closing it, the rating may be omitted. The automatic designation at the time of saving and exiting fills this gap, ensuring that the target document always has the rating defined by the policy.

Operation Method

Document save and exit will result in that document beingAuto-assigned card(setSecuLevel) matchingIf applicable, apply the single grade/label specified in the policy to the document without a separate confirmation window.

Summary: When the policy instructs "automatic assignment" upon saving and exiting, a single grade determined by the policy is assigned to the document without asking the user anything. The automatic/manual division is determined by the server policy card, and the assignment history is recorded in the integrated log with a distinction between automatic and manual.

User Experience (No separate selection screen)

Automatic designation operates silently — no grade selection or guidance window appears when saving or exiting. The results with applied grades can be checked in the explorer overlay icon and the "Security Grade" tab of the file properties window.

Scope / Entry Point


#	Entry Point (Document Event)	Action Timing
1	Document Viewing/Editing and Exit (or Save)	When saving or closing a document in the editing program (primary support scope)

Same automatic designation (setSecuLevelIt can be configured to operate according to conditional policy settings for document viewing and file unit events (local explorer movement/copy, Cloud download/upload).
It targets both regular documents and security (DRM/MIP) documents.

2. Policy / Settings

Save and Exit Event Grade Execution Card (Management Console "Security Grade Settings") Designated MethodAutomatic designationIf selected, a single grade/label designated by the administrator will be automatically assigned.


Specification Method	Input items	Execution Keyword
Automatic designation	Applicable grade + label (1 each)	`setSecuLevel`
Manual Assignment	Grades to be displayed to users (plural)	`availableSecurityLevelList`

For manual designation, please refer to the "User Manual C/S/O Grade Designation at Document End" section.

Conditional Execution Policy(`enforcementAttributes`) Schema

The enforcement policy of the conditional policy (ZTCAP) is the enforcement card array(enforcementAttributes) and the grade card is one item in that array (it is included in the array along with conversion cards, etc., if necessary). Each card has a processing order (order)·Type(category)·Details(info) is composed of, and automatic assignment iscategoryasetSecuLevelIt is represented in a card.

{
  "enforcementAttributes": [
    {
      "order": 0,
      "category": "setSecuLevel",
      "info": {
        "detail": "Level ID; Label ID"
      }
    }
  ]
}

automatic card'sinfo.detailis레벨ID;레이블ID single pair(It is separated by semicolons) — Specifies 1 grade to apply and 1 sub-label for it.
Manual Card(availableSecurityLevelListUnlike exposing an array of candidate grade IDs to the user, the automatic card has the destination grade and label confirmed by the administrator as a single entity.

Current Grade Evaluation (N2SF Upgrade)

The automatic designation follows the N2SF grade movement rules (only upward movement allowed, downward movement not permitted). However, unlike manual designation, it does not filter and display candidate grades in a selection window, but rather,**Evaluate the current rating of the document at the policy condition stage.**Determines whether to target. That is, it is filtered at the policy matching point to prevent downward movement, and only the destination grade is specified on the execution card.

3. Operation Scenario Summary Table


#	situation	Operation Result
1	Auto-assigned card(`setSecuLevel`) Matching + Save·Exit	Automatically apply the single grade/label specified in the policy without a confirmation window + integrated log (automatic distinction, grade before/after change)
2	Manual Assignment Card(`availableSecurityLevelList`) Matching	Display selection window with manually specified path without intervention in this path (refer to the corresponding section)
3	Not a target document / Grade card not issued	No grade change
4	Non-operational issues with the resident agent	Grade not applied + Integrated log error (ERROR). Save and exit proceed normally.
5	Configuration with transformation card (e.g., DRM encryption + automatic grading)	Sequential execution of cards in a policy (e.g., Transformation → Rating)

4. Support Scope (Extension / Document Type)

Target: Office Document —pps · ppsx · ppt · pptx · doc · docx · xls · xlsx · xlsb · xlsm(Right-click manual specification · When ending, the same range as manual specification).
Document type: Supports both regular documents and secure (DRM/MIP) documents.
The grade and label follow the security classification labels of the Security365 Management Center (1st task-based grade–label 1:1 mapping).

5. Main Flow

Administrator — Policy Registration

Management Console → Conditional Policies → Endpoint → Specify Target Documents, Members, and Conditions.
Select "Document View/Edit and Exit (or Save)" in the document event.
Execution Policy → Tier Card 「Security Level Settings」 → Designation MethodAutomatic designationSelect.
Specify one grade (C/S/O) to apply and one of its sub-labels → Save.

Client — Automatically apply on save and exit

The user saves or exits the document.
Check the automatic assignment policy that matches the save and exit event.
Apply the single grade/label specified in the policy to the document (no user confirmation).
Send the grant details to the integrated log (automatic classification, before/after grade, etc.).

6. Constraints


#	Constraints	content
1	Single Grade Fixed	Automatic designation only assigns a single grade/label specified by the policy. It does not include a method of determining and assigning grades based on the content of the document (future expansion review area).
2	Automatic/manual mixed use not allowed	Automatic in the same document (`setSecuLevel`)·Manual(`availableSecurityLevelList`) Cases where grade cards are issued simultaneously are excluded from the server policy.
3	Agent Dependency	The application of grades depends on the resident agent (policy processing core). Grades are not applied when not operational (intended inactivity).
4	Policy Priorities	If multiple policies match under the same conditions, one higher-priority policy will be applied. Within a policy, transformation and grading cards will be executed in the order set by the administrator.

User manual C/S/O grade designation at document termination

1. Overview

At the time of closing (terminating) the document, if the company security policy specifies "to allow the user to choose"Security Level Selection Windowis a feature that allows users to directly select and apply the security level of the document (C/S/O — Confidential/Sensitive/Public). Previously, at the end point, the system would apply a single level defined by the policy.automaticallyOnly the method of scoring worked, but hereUser Manual Selection PathIn addition, it supports both automatic assignment and user direct selection according to the policy. (Response to National Multi-Security System N2SF (National Network Security Framework))

Reason for Needing This Feature

N2SF is a document grade classification ofSubject and responsibility to the userIt is difficult to meet the requirement of "classified by the author" simply by having the system automatically assign ratings.

The window where users can directly select a grade in the existing product isRight-click on the mouse → [Document Level Setting] menucould only be opened in. In the typical flow where a user creates a new document and just closes it, grades may be missing or rely on system default values. Also, even if the policy is sent down as "user direct selection" at the end point, the client may not handle it and just skip it.not applicable等级There were limitations.

This feature isInducing classification at a natural endpoint of the workflowThis fills the gap.

Operation Method (Single Line Mechanism)

At the end of the document, that document isMatching Manual Assignment PolicyIf it works, right-click [Document Grade Setting] andSame Grade Selection Windowto display — When the user selects a grade, it applies that grade to the document, and if canceled, it does not apply the grade (no-op).

info

Summary: When closing a document, if the policy instructs "User Direct Selection," a security level selection window will be displayed for each closing document, and the level chosen by the user will be applied to the document. Automatic assignment and manual selection are branched by the server policy card, and the history of level changes is recorded in the integrated log with automatic/manual distinction.

Scope / Entry Point


#	Entry Point	Action Timing
1	Editor process termination	When closing each document in editing programs like Office
2	Single Document End	When closing individual documents in the editor

Application Login Environment:s365 · sso(DS6 Standard Certification Path). The legacy appAuth path is excluded from the scope (see the constraints section).
It targets both regular documents and security (DRM/MIP) documents.

2. User Interface (UX)

If it matches the manually specified policy at the end,**Right-click [Document Grade Settings] to open the same security grade settings window.**This is displayed. It is a two-pane window consisting of a left menu and a right grade list, showing information about the document being closed and the selectable grades and labels.

top: Icon, file name, path of the closing document, and product logo.
Left: Menu Area (Security Level Settings).
Right: Grade List — Each grade has a color display, grade name, and description, and below that, the labels for that grade are listed as radio items. Selecting one label classifies you into that grade (only one can be selected from the whole).
bottom: [Cancel] · [Confirm] button.

┌──────────────────────────────────────────────────────────────┐
│  [Document] Quarterly Report.docx           [ Document Security 로고 ]  ×  │
│         C:\Users\...\Quarterly Report.docx                            │
├───────────────┬────────────────────────────────────────────────┤
│               │  Security Level Settings                                  │
│ ▍Security Level    │  Please select the security level to apply to the document being closed.    │
│    Settings       │                                                 │
│               │  ● C Level (Confidential)     Organizational Confidential Information               │
│               │      ○ C-Top Secret   ● C-Restricted   ○ C-Internal            │
│               │  ──────────────────────────────────            │
│               │  ● S Level (Sensitive)     Sensitive Information                    │
│               │      ○ S-Restricted   ○ S-Internal                       │
│               │  ──────────────────────────────────            │
│               │  ● O Level (Public)     Publicly Available                    │
│               │      ○ O-General                                   │
│               │                                                 │
│               │                         [ Cancel ]   [ Confirm ]     │
└───────────────┴────────────────────────────────────────────────┘


User Selection	result
After selecting the label, click [Confirm]	Apply the selected grade/label to the document. Record the manual specification/change before/after in the integrated log.
[Cancel] / Close (×) / Unselected	No grade applied (no-op). The integrated log remains as not applied (INFO).

The default selection of the screen follows the basic level of the policy.
If you close multiple documents at once**The selection window is sequential for each document.**It will be displayed.

3. Policy / Settings

End Event Grade Enforcement Card (Management Console "Security Grade Settings")Automatic/Manual Designation MethodDepending on the selection, the type of card that is saved will vary.


Specification Method	Input items	Execution Keyword
Automatic designation	Applicable grade + label (1 each)	`setSecuLevel`
Manual Assignment	Grades to be displayed to users (plural)	`availableSecurityLevelList`

Conditional Execution Policy (enforcementAttributes) Schema

The enforcement policy of the conditional policy (ZTCAP) isExecution Card Array(enforcementAttributes) and the grade card is one item in that array (it is included in the array along with conversion cards, etc., if necessary). Each card has a processing order (order)·Type(category)·Details(info) consists of, and the grading method (automatic/manual) iscategoryis determined.

{
  "enforcementAttributes": [
    {
      "order": 0,
      "category": "availableSecurityLevelList",
      "info": {
        "detail": "[{\"levelId\":\"NI9V0lbL-...\"},{\"levelId\":\"iqCCmC4N-...\"},{\"levelId\":\"dliTWZzt-...\"}]",
        "defaultSelectLevelId": "iqCCmC4N-ADUvGusn-4Gkhlyi6-vPJQvg6r"
      }
    }
  ]
}

info.detailisencoded as a JSON string(This is a double encoding) It is an array of grade IDs. It is the same format as the candidate grade format of the manually specified path by right-clicking.

Automatic Card vs Manual Card

Both methods are at the same grade card position.categoryWowinfo.detailIt is divided into formats.

// 자동 지정 — 종료 시 단일 등급/레이블 자동 부여 (기존)
{
  "order": 0,
  "category": "setSecuLevel",
  "info": {
    "detail": "레벨ID;레이블ID"
  }
}

// 수동 지정 — 종료 시 노출할 등급 복수 (사용자 선택, 본 기능)
{
  "order": 0,
  "category": "availableSecurityLevelList",
  "info": {
    "detail": "[{\"levelId\":\"...\"},{\"levelId\":\"...\"}]",
    "defaultSelectLevelId": "..."
  }
}

automatic card'sdetailis레벨ID;레이블ID single pair(it is separated by semicolons.)
Manual Card'sdetailSilver CandidateGrade ID arrayand the user selects one of them (+detailed label) from the selection window.

Client Usage Field (Manual Card)


field	use
`category` = `availableSecurityLevelList`	Manual Dispatch Key
`info.detail`(grade ID array, double encoding)	List of candidate grade IDs selected by the user
`info.defaultSelectLevelId`	Basic Selection Level of the Selection Window

4. Multilingual / Resources

The text for the grade selection window is6 languagesis provided.


item	content
Supported Languages	Korean · English · Chinese · Japanese · German · Russian
Resource	`DSResKor/Eng/Chn/Jpn/Deu/Rus.ini`of`[GRADE_UI]`Section (Selection Window Phrase 8 Key)
Determine Display Language	Display resource phrases corresponding to the client UI cultural zone (system locale)
default value (fallback)	If the language resource/key cannot be foundEnglishDisplay text

warning

Languages other than the above 6 types, such as French, Czech, and Traditional Chinese, are not supported and will be displayed in English. Multilingual phrases should be distributed together with the SDK installation package to be displayed correctly.

5. Operation Scenario Summary Table


#	situation	Operation Result
1	Manual Designated Card Matching Document End + User Selects Grade · [Confirm]	Display selection window → Apply selection grade + Integrated log (manual, before/after change, identifier)
2	Manual Designated Card Matching Document End + [Cancel]/X/Not Selected	Display selection window → Grade not applied (no-op), Integrated log not applied (INFO)
3	Auto-assigned card(`setSecuLevel`) Matching document end	Granting a single grade with the existing automatic assignment without intervention in this path
4	Agent (Daemon) Not Running / Display Failure	Grade not applied (no-op) + Integrated log failure (ERROR). Editor termination proceeds normally.
5	Batch close multiple documents (manual matching)	Sequential display of selection windows for each document

6. Support Scope (Extension / Document Type)

Target: Office Document —pps · ppsx · ppt · pptx · doc · docx · xls · xlsx · xlsb · xlsm(Right-click manual specification · Automatic specification when terminated is the same range).
Document type: Supports both regular documents and secure (DRM/MIP) documents.
The grade and label follow the security classification labels of the Security365 Management Center (1st task-based grade–label 1:1 mapping).

7. Main Flow

Administrator — Policy Registration

Grade card for the termination (or save) event in the management console.Manual AssignmentSet to __PH_0__, select multiple grades to be displayed, and save.

User — Manual Specification on Exit

The user opens/edits the document and then exits (or saves).
Check the manual assignment policy that matches the end event.
Determine the exposure level using the N2SF rules (unspecified → all allowed levels / specified → same and higher).
Display the grade selection window and the user selects the grade and label.
Apply the selected grade to the document and send the integrated log (manual separator·specifier).
When multiple documents are closed, the above flow is repeated for each document.

8. Constraints


#	Constraints	Content / User Impact
1	Motivation Occupancy	While the selection dialog is open, the corresponding exit handling path is occupied (for the duration of the user selection time). The editor's exit response itself is not affected, but other concurrent security actions may be delayed. To prevent infinite waiting, an automatic closing timeout is applied.
2	N Document Sequential Processing	When multiple documents are closed in bulk, the selection window for each document appears sequentially, and the time for each selection accumulates. (Batch single list UI is outside the scope of this work)
3	Multilingual Support Scope	Only 6 languages (Korean, English, Chinese, Japanese, German, Russian) are supported, and other languages will be displayed in English.
4	Resource Reflection Timing	The selection window text is stored by the resident daemon after loading it once, so resource (INI) updates are reflected after restarting the daemon or rebooting (not applicable during installation package distribution).
5	Automatic/manual mixed use not allowed	It is assumed that when automatic and manual grading policies are issued simultaneously in the same document, they are excluded from the server policy (mixed use is not allowed).
6	Application Environment	s365 · applied to the sso authentication path, and the legacy appAuth path is not included.
7	Agent Dependency	If the resident agent is inactive, the rating will not be applied (intended inactivity).

CSO Grade Print Marking

1. Overview

When printing security documents, the upper and lower text and central marking are displayed differently according to the document's CSO grade (C/S/O). The grade is determined by the SFI overlay icon index in the document header, and custom policies by grade (DS_PRINTMK_CSO_C/O/SReplaces the value of ) with the marking row created by the default print marking policy (item-override).


Grade	SFI overlay icon index	Custom Policy Name
C	1	`DS_PRINTMK_CSO_C`
O	2	`DS_PRINTMK_CSO_O`
S	3	`DS_PRINTMK_CSO_S`

2. Substitution Tag Specification


tag	Target Row	nType / LOCATION	Note
`TEXT_OPTION`	Center Diagonal Watermark	MARKING_SETTING	marking text`$oText`Replaced with a variable
`TEXT`	Upper and lower text lines	nType=0 / LOC=0(upper), 2(lower)	same`<case=MARKING_DATA>`Specify the location with LOCATION
`CENTER_TEXT`	Center text line	nType=0 / LOC=1	Exclusive Tag. `TEXT`Not reusable (ExtractTagValue first match captures the top row)
`IMAGE_FILE_NAME`	Center Image Row	nType=1 / LOC=1	BMP format (regardless of extension).`windows\Softcamp\SDS\`in placement

Quarterly exclusivity: Image row (nType=1) / Central text row (nType=0·LOC=1) / Upper and lower text row (nType=0·LOC=0,2) — the three do not overlap.nType==0The central text replacement of the guard does not invade the image row.

3. Policy Settings

Basic Print Marking Policy (Admin Console → Print Marking → Script)

Center = Image Row(dscgru.dll) + textRow("Security Document"). CSO override will grade this central textRow("Security Document") by level.CENTER_TEXTReplace with.

<Begin>
  <case=MARKING_VERSION>
    <VERSION="2">
  </case>
   <case=MARKING_SETTING>
    <NORMAL_DOC="0">
    <ENABLE="1">
    <BMP_FILE_USE="0">
    <DENSITY_CENTER="40">
    <INTERCHARACTER="0">
    <INTERLINE="100">
    <SLOPE="300">
    <TEXT_OPTION="이문서는보안문서입니다. ">
    <DATE_FORMAT1="yyyy-MM-dd ">
    <DATE_FORMAT2="yyyy, MM, dd ddd">
    <DATE_FORMAT3="yyyy MM dd">
    <TIME_FORMAT1="HH:mm">
    <TIME_FORMAT2="hh mm ss">
    <TIME_FORMAT3="hh mm ">
    <WIDTH="600">
    <HEIGHT="600">
    <HP_PRINT_DENSITY="10">
    <DOT_PRINTER="ALL">
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <TYPE="1">
    <LOCATION="1">
    <ALIGN="0">
    <FONT_SIZE="200">
    <IMAGE_FILE_NAME="dscgru.dll">
    <MARGINX="0"> 
    <MARGINY="0"> 
    <RESERVED="0">
    </case>
    <case=MARKING_DATA>
    <LOCATION="0">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="보안/ $uID / $uName / $uOrg / $HostName">
    <MARGINX="0"> 
    <MARGINY="0"> 
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="2">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="보안/ $pDate1 / $pTime1 / $oText">
    <MARGINX="0">
    <MARGINY="0">
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="1">
    <FONT_SIZE="150">
    <FONT_NAME="HY견고딕">
    <FONT_COLOR="0">
    <FONT_WEIGHT="300">
    <TEXT="보안문서">
    <ALIGN="1">
  </case>
<End>

DS_PRINTMK_CSO_C Custom Policy

CENTER_TEXT="C등급"→ Replace the central text of the basic policy ("Security Document") with "C grade". Replace the upper and lower TEXT with C grade wording.

<Begin>
  <case=MARKING_VERSION>
    <VERSION="2">
  </case>
   <case=MARKING_SETTING>
    <NORMAL_DOC="0">
    <ENABLE="1">
    <BMP_FILE_USE="0">
    <DENSITY_CENTER="40">
    <INTERCHARACTER="0">
    <INTERLINE="100">
    <SLOPE="300">
    <CENTER_TEXT="C등급">
    <DATE_FORMAT1="yyyy-MM-dd ">
    <DATE_FORMAT2="yyyy, MM, dd ddd">
    <DATE_FORMAT3="yyyy MM dd">
    <TIME_FORMAT1="HH:mm">
    <TIME_FORMAT2="hh mm ss">
    <TIME_FORMAT3="hh mm ">
    <WIDTH="600">
    <HEIGHT="600">
    <HP_PRINT_DENSITY="10">
    <DOT_PRINTER="ALL">
  </case>
    <case=MARKING_DATA>
    <LOCATION="0">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="C등급 문서/ $uID / $uName / $uOrg / $HostName">
    <MARGINX="0"> 
    <MARGINY="0"> 
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="2">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="C등급 문서/ $pDate1 / $pTime1 / $oText">
    <MARGINX="0">
    <MARGINY="0">
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="1">
    <FONT_SIZE="150">
    <FONT_NAME="HY견고딕">
    <FONT_COLOR="0">
    <FONT_WEIGHT="300">
    <ALIGN="1">
  </case>
<End>

DS_PRINTMK_CSO_S Custom Policy

<Begin>
  <case=MARKING_VERSION>
    <VERSION="2">
  </case>
   <case=MARKING_SETTING>
    <NORMAL_DOC="0">
    <ENABLE="1">
    <BMP_FILE_USE="0">
    <DENSITY_CENTER="40">
    <INTERCHARACTER="0">
    <INTERLINE="100">
    <SLOPE="300">
    <CENTER_TEXT="S등급">
    <DATE_FORMAT1="yyyy-MM-dd ">
    <DATE_FORMAT2="yyyy, MM, dd ddd">
    <DATE_FORMAT3="yyyy MM dd">
    <TIME_FORMAT1="HH:mm">
    <TIME_FORMAT2="hh mm ss">
    <TIME_FORMAT3="hh mm ">
    <WIDTH="600">
    <HEIGHT="600">
    <HP_PRINT_DENSITY="10">
    <DOT_PRINTER="ALL">
  </case>
    <case=MARKING_DATA>
    <LOCATION="0">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="S등급 문서/ $uID / $uName / $uOrg / $HostName">
    <MARGINX="0"> 
    <MARGINY="0"> 
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="2">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="S등급 문서/ $pDate1 / $pTime1 / $oText">
    <MARGINX="0">
    <MARGINY="0">
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="1">
    <FONT_SIZE="150">
    <FONT_NAME="HY견고딕">
    <FONT_COLOR="0">
    <FONT_WEIGHT="300">
    <ALIGN="1">
  </case>
<End>

DS_PRINTMK_CSO_O Custom Policy

<Begin>
  <case=MARKING_VERSION>
    <VERSION="2">
  </case>
   <case=MARKING_SETTING>
    <NORMAL_DOC="0">
    <ENABLE="1">
    <BMP_FILE_USE="0">
    <DENSITY_CENTER="40">
    <INTERCHARACTER="0">
    <INTERLINE="100">
    <SLOPE="300">
    <CENTER_TEXT="O등급">
    <DATE_FORMAT1="yyyy-MM-dd ">
    <DATE_FORMAT2="yyyy, MM, dd ddd">
    <DATE_FORMAT3="yyyy MM dd">
    <TIME_FORMAT1="HH:mm">
    <TIME_FORMAT2="hh mm ss">
    <TIME_FORMAT3="hh mm ">
    <WIDTH="600">
    <HEIGHT="600">
    <HP_PRINT_DENSITY="10">
    <DOT_PRINTER="ALL">
  </case>
    <case=MARKING_DATA>
    <LOCATION="0">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="O등급 문서/ $uID / $uName / $uOrg / $HostName">
    <MARGINX="0"> 
    <MARGINY="0"> 
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="2">
    <ALIGN="1">
    <FONT_SIZE="20">
    <FONT_NAME="굴림">
    <FONT_COLOR="0">
    <FONT_WEIGHT="0">
    <TEXT="O등급 문서/ $pDate1 / $pTime1 / $oText">
    <MARGINX="0">
    <MARGINY="0">
  </case>
  <case=MARKING_DATA>
    <NORMAL_DOC="0">
    <LOCATION="1">
    <FONT_SIZE="150">
    <FONT_NAME="HY견고딕">
    <FONT_COLOR="0">
    <FONT_WEIGHT="300">
    <ALIGN="1">
  </case>
<End>

Policy Writing Caution

this configuration ofCentral Marking by Grade = CENTER_TEXT**(Text Replacement)**It is a method. Replace the central text line of the basic policy ("Security Document") with "C grade"/"S grade"/"O grade".
CSO policy includesper-grade IMAGE_FILE_NAME does not exist.Center Image(dscgru.dll) is a basic policy fixed — all grades are the same. Different by gradeimageif needed, in the CSO policy<IMAGE_FILE_NAME="...">Add + Place the BMP in the SDS folder (current configuration not in use — extension option).
CSO_C/S/O policy end<case=MARKING_DATA><LOCATION="1">(empty center row without TEXT/IMAGE) isInvalid StructureAll (override is ignored). It is harmless to do so, but does not affect the operation.

Feature Details​

Right-click to assign grade​

1. Overview​

2. Feature Settings (Required and Optional)​

3. Related Security365 Services**(required)**​

A. Management Center - Security Level & Label Registration​

B. Conditional Policy (ztcap): Policy for Convertible Security Labels​

Applying Overlay Icon​

1. Overview​

2. Constraints​

Document Properties Window Security Level Display​

1. Overview​

Reason for Needing This Feature​

Operation Method​

Scope / Entry Point​

2. Displayed Security Level Information​

Select Display Item (Admin Option)​

3. User Screen​

4. Multilingual Support​

5. Operation Scenario Summary Table​

6. Support Scope (Extension / Document Type)​

7. Constraints​

Automatic Assignment of C/S/O Grades at Document Closure​

1. Overview​

Reason for Needing This Feature​

Operation Method​

User Experience (No separate selection screen)​

Scope / Entry Point​

2. Policy / Settings​

Conditional Execution Policy(enforcementAttributes) Schema​

Current Grade Evaluation (N2SF Upgrade)​

3. Operation Scenario Summary Table​

4. Support Scope (Extension / Document Type)​

5. Main Flow​

Administrator — Policy Registration​

Client — Automatically apply on save and exit​

6. Constraints​

User manual C/S/O grade designation at document termination​

1. Overview​

Reason for Needing This Feature​

Operation Method (Single Line Mechanism)​

Scope / Entry Point​

2. User Interface (UX)​

3. Policy / Settings​

Conditional Execution Policy (enforcementAttributes) Schema​

Automatic Card vs Manual Card​

Client Usage Field (Manual Card)​

4. Multilingual / Resources​

5. Operation Scenario Summary Table​

6. Support Scope (Extension / Document Type)​

7. Main Flow​

Administrator — Policy Registration​

User — Manual Specification on Exit​

8. Constraints​

CSO Grade Print Marking​

1. Overview​

2. Substitution Tag Specification​

3. Policy Settings​

Basic Print Marking Policy (Admin Console → Print Marking → Script)​

DS_PRINTMK_CSO_C Custom Policy​

DS_PRINTMK_CSO_S Custom Policy​

DS_PRINTMK_CSO_O Custom Policy​

Policy Writing Caution​

Feature Details

Right-click to assign grade

1. Overview

2. Feature Settings (Required and Optional)

3. Related Security365 Services(required)

A. Management Center - Security Level & Label Registration

B. Conditional Policy (ztcap): Policy for Convertible Security Labels

Applying Overlay Icon

1. Overview

2. Constraints

Document Properties Window Security Level Display

1. Overview

Reason for Needing This Feature

Operation Method

Scope / Entry Point

2. Displayed Security Level Information

Select Display Item (Admin Option)

3. User Screen

4. Multilingual Support

5. Operation Scenario Summary Table

6. Support Scope (Extension / Document Type)

7. Constraints

Automatic Assignment of C/S/O Grades at Document Closure

1. Overview

Reason for Needing This Feature

Operation Method

User Experience (No separate selection screen)

Scope / Entry Point

2. Policy / Settings

Conditional Execution Policy(`enforcementAttributes`) Schema

Current Grade Evaluation (N2SF Upgrade)

3. Operation Scenario Summary Table

4. Support Scope (Extension / Document Type)

5. Main Flow

Administrator — Policy Registration

Client — Automatically apply on save and exit

6. Constraints

User manual C/S/O grade designation at document termination

1. Overview

Reason for Needing This Feature

Operation Method (Single Line Mechanism)

Scope / Entry Point

2. User Interface (UX)

3. Policy / Settings

Conditional Execution Policy (enforcementAttributes) Schema

Automatic Card vs Manual Card

Client Usage Field (Manual Card)

4. Multilingual / Resources

5. Operation Scenario Summary Table

6. Support Scope (Extension / Document Type)

7. Main Flow

Administrator — Policy Registration

User — Manual Specification on Exit

8. Constraints

CSO Grade Print Marking

1. Overview

2. Substitution Tag Specification

3. Policy Settings

Basic Print Marking Policy (Admin Console → Print Marking → Script)

DS_PRINTMK_CSO_C Custom Policy

DS_PRINTMK_CSO_S Custom Policy

DS_PRINTMK_CSO_O Custom Policy

Policy Writing Caution