Email DLP evaluation questionnaire

1. RFIWhat detection methods does the platform use to identify sensitive outbound content — keyword/regex matching, exact-data-match against a known dataset (e.g., a customer database of SSNs), or contextual/ML-based classification — and what is the measured false-positive rate for each method on real production mail volume?
   Answer key — what a strong answer shows

   Contextual/ML classification generally outperforms pure keyword matching but needs a stated false-positive rate; a vendor unable to give even an approximate production FP rate likely hasn't measured real-world accuracy.

2. RFPDescribe misdirected-email detection specifically — can the platform flag or block an email about to be sent to the wrong recipient (e.g., autocomplete error, similarly-named external domain) before it leaves, and quantify prevented incidents with a customer reference.
   Answer key — what a strong answer shows

   Misdirected email is one of the most common real-world data-loss incidents and a distinct capability from content-based DLP; ask for a concrete prevented-incident count from a named customer, not a generic feature claim.

3. RFIHow does the platform handle attachments specifically — does content inspection extend inside compressed archives, embedded documents, and images (OCR for sensitive data in screenshots), or only to the visible email body and top-level attachment text?
   Answer key — what a strong answer shows

   Attackers and careless users alike commonly exfiltrate data via nested/compressed attachments or screenshots; a platform that only inspects plain visible text has a real, exploitable coverage gap.

4. RFIWhat is the enforcement action model — silent block, user-facing warning with override-and-justify, encryption-on-send, or a mix depending on policy severity — and can policy differ by sensitivity tier rather than one blunt action for every violation?
   Answer key — what a strong answer shows

   Tiered enforcement (e.g., warn-and-justify for lower-risk violations, hard block for high-risk) balances security with business workflow disruption better than one uniform action for every match.

5. RFPDetail integration with the broader data-protection stack — does policy and incident data flow into a unified DLP/data-classification platform covering endpoint and cloud storage too, or does email DLP operate as a standalone silo with separate policy authoring?
   Answer key — what a strong answer shows

   Unified policy authoring across email, endpoint, and cloud DLP is stronger than a standalone email-only silo requiring separate, potentially inconsistent policy definitions.

6. RFIHow does the platform handle encrypted or password-protected outbound attachments intentionally used to evade content inspection, and what visibility exists into what's actually being sent when content can't be inspected?
   Answer key — what a strong answer shows

   Encrypted attachments are a known DLP evasion technique; a credible vendor acknowledges this blind spot and describes any mitigating control (e.g., flagging encrypted attachments to unusual recipients) rather than ignoring the gap.

7. RFPExplain incident-response workflow when a violation is caught — automated case creation with full context (sender, recipient, matched content, policy triggered), and whether security/compliance teams can query historical DLP incidents for pattern analysis.
   Answer key — what a strong answer shows

   Rich incident context and historical queryability matters for both individual incident response and identifying systemic policy gaps or repeat offenders over time.

8. RFIWhat is the deployment model relative to the customer's email platform (native API integration with Microsoft 365/Google Workspace versus mail-flow/gateway interception), and what latency does content inspection add to outbound mail delivery under production load?
   Answer key — what a strong answer shows

   API-based integration is generally lower-friction than gateway interception but can have different latency and coverage characteristics; ask for a measured latency figure under real production volume, not a lab benchmark.

9. RFPDetail reporting for compliance-driven use cases (e.g., demonstrating PCI DSS or HIPAA email-handling controls to an auditor) — are pre-built compliance reports available, or does the customer need to build custom reports from raw incident logs?
   Answer key — what a strong answer shows

   Pre-built, regulation-specific reports save real audit effort; ask for a specific example report rather than accepting a general 'compliance-ready' claim.

10. RFIWhat is the pricing model — per mailbox per month, tiered by detection-method sophistication — and does cost differ meaningfully between basic keyword matching and full ML-based contextual classification?
    Answer key — what a strong answer shows

    Look for transparent, tier-differentiated pricing that's explicit about which detection capabilities are gated behind a premium tier rather than included in the base product.

11. RFPFor a confirmed data-exfiltration event that evaded email DLP (a real incident, not a theoretical gap), what forensic capability exists to reconstruct exactly what was sent and to determine why the policy failed to catch it, with a customer-referenced example?
    Answer key — what a strong answer shows

    Strong answers describe a real forensic and root-cause-analysis capability for a confirmed miss, not just confirmation that detection generally works — understanding why a real evasion succeeded is essential to closing the gap.

12. RFIDetail historical trend reporting on DLP-blocked-event volume and violation-category trends over time, suitable for demonstrating program effectiveness to leadership.
    Answer key — what a strong answer shows

    Trend-over-time reporting is a distinct capability from individual incident logs — confirm this exists as a maintained, exportable report.

13. RFPWho within the organization gets access to DLP incident data, given that a DLP incident record often contains the actual sensitive content that was almost leaked — is there a strict, documented access model given how sensitive this data is?
    Answer key — what a strong answer shows

    A DLP incident log frequently contains the literal sensitive data that triggered it — ask for a specific, strict access-control model, not just generic RBAC, given the sensitivity of the incident data itself.

14. RFIHow does the platform integrate with the customer's existing CASB/SSPM tooling so DLP policy is consistently enforced across email and cloud/SaaS channels, rather than email DLP operating as an isolated policy silo with separately-authored rules?
    Answer key — what a strong answer shows

    Look for genuine cross-channel policy consistency; separately-authored email-only DLP rules that don't reconcile with cloud/SaaS DLP policy creates real gaps and management overhead.

15. RFIHow consistent is detection accuracy for non-English business communication — is contextual/ML-based classification genuinely multilingual, or does accuracy meaningfully degrade for languages other than English?
    Answer key — what a strong answer shows

    A genuinely global organization needs real multilingual detection accuracy, not just an English-tuned model with translated interface menus — ask for a specific answer on language coverage depth.

16. RFPWhat is the mobile email client's DLP enforcement parity with desktop — do the same content-inspection and blocking policies apply equally when sending from a mobile device, or is mobile a materially weaker enforcement environment?
    Answer key — what a strong answer shows

    Ask for an honest mobile-versus-desktop enforcement-parity comparison; a degraded mobile DLP posture is a common real gap that should be disclosed rather than assumed away.

17. RFIWhat migration support exists for moving from an incumbent email DLP solution — can existing policy rules, exception lists, and historical incident data be imported rather than manually rebuilt from scratch, and what is a customer-referenced migration timeline?
    Answer key — what a strong answer shows

    Strong answers describe real migration tooling and a concrete, customer-validated timeline; a vendor with no migration story is asking the customer to manually rebuild potentially years of accumulated policy tuning from scratch.

Verified buyers can suggest criteria (anonymized before pooling).