The data loss prevention features can help you identify and monitor many categories of sensitive information that you have defined within the conditions of your policies, such as private identification numbers or credit card numbers. You have the option of defining your own custom policies and transport rules or using the pre-defined DLP policy templates provided by Microsoft in order to get started quickly. For more information about the policy templates that are included, see DLP Policy Templates Supplied in Exchange. A policy template includes a range of conditions, rules, and actions that you can choose from in order to create and save an actual DLP policy that will help you inspect messages. The policy templates are models from which you can select or build your own specific rules to create a policy that meets your needs for data loss prevention.

Three different methods exist for you to begin using DLP:

1. Apply an out-of-the-box template supplied by Microsoft.   The quickest way to start using DLP policies is to create and implement a new policy using a template. This saves you the effort of building a new set of rules from nothing. You will need to know what type of data you want to check for or which compliance regulation you are attempting to address. You will also need to know your organizations expectations for processing such data. More information at DLP Policy Templates Supplied in Exchange and Create a DLP Policy From a Template.
   
   
2. Import a pre-built policy file from outside your organization.   You can import policies that have already been created outside of your messaging environment by independent software vendors. In this way you can extend the DLP solutions to suit your business requirements. More information at Policy Templates from Microsoft Partners, Define Your Own DLP Templates and Information Types, and Import a DLP Policy From a File.
   
   
3. Create a custom policy without any pre-existing conditions.   Your enterprise may have its own requirements for monitoring certain types of data known to exist within a messaging system. You can create a custom policy entirely on your own in order to start checking and acting upon your own unique message data. You will need to know the requirements and constraints of the environment in which the DLP policy will be enforced in order to create such a custom policy. More information at Create a Custom DLP Policy.
   
   

After you have added a policy, you can review and change its rules, make the policy inactive, or remove it completely. The procedures for these actions are provided in the Manage DLP Policies topic.

When you create or change DLP policies, you can include rules that include checks for sensitive information. The sensitive information types listed in the Sensitive Information Types Inventory topic are available to be used in your policies. The conditions that you establish within a policy, such as how many times something has to be found before an action is taken or exactly what that action is can be customized within your new custom policies in order to meet your specific policy requirements. For more information about creating DLP policies see, Create a Custom DLP Policy. For more information about the full suite transport rules, see Transport Rules.

To make it easy for you to make use of the sensitive information-related rules, Microsoft has supplied policy templates that already include some of the sensitive information types. You cannot add conditions for all of the sensitive information types listed here to policy templates however, because the templates are designed to help you focus on the most-common types of compliance-related data within your organization. For more information about the pre-built templates, see DLP Policy Templates Supplied in Exchange. You can create numerous DLP policies for your organization and have them all enabled so that many disparate types of information are examined. You can also create a DLP policy that is not based on an existing template. To begin creating such a policy, see Create a Custom DLP Policy. For more information about sensitive information types, see Sensitive Information Types Inventory.

Exchange 2013 and Exchange Online present a new method of helping you manage message data when compared with traditional message classification. A key factor in the strength of a DLP solution is the ability to correctly identify confidential or sensitive content that may be unique to the organization, regulatory needs, geography, or other business needs. Exchange 2013 can achieve this by using a new architecture for deep content analysis coupled with detection criteria that you establish through rules in your DLP policies. Helping prevent data loss in Exchange 2013 relies on configuring the correct set of sensitive information rules so that they provide a high degree of protection while minimizing inappropriate mail flow disruption with false positives and negatives. These types of rules, referred to throughout the DLP information as sensitive information detection, function within the framework offered by transport rules in order to enable DLP capabilities. To learn more about these new features, see Integrating Sensitive Information Rules with Transport Rules. The traditional message classification fields can still be applied to messages in Exchange and these can be combined withthe new sensitive information detection either together within a single DLP policy or running concurrently so they are evaluated independently within Exchange. To learn more about the legacy Exchange 2010 message classifications, see Understanding Message Classifications in the TechNet Library.

You can use Policy Tip notification messages to inform email senders about possible compliance issues while they are composing an email message. When you configure a Policy Tip in a DLP policy, the notification message will only show up if something in the sender’s email message meets the conditions described in your policy. Policy Tips are similar to MailTips that were introduced in Microsoft Exchange 2010. For more information, see Policy Tips.

To obtain information about messages and DLP policy detections in your environment, see DLP Policy Detection Management. Data related to DLP detections, is highly integrated into the delivery reports message tracking tool of Exchange 2013.

In order to make use of DLP features, you must have Exchange 2013 or Exchange Online configured with at least one sender mailbox. Data Loss Prevention is a premium feature that requires an Enterprise Client Access License (CAL). For more information about getting started with Exchange 2013, see Planning and Deployment. For more information about getting started with Exchange Online, see Exchange Online.

Messaging Policy and Compliance

DLP Procedures

Messaging Policy and Compliance Cmdlets