Data Posture 360 policies help you identify data that might present security, privacy, compliance, governance, or data management risks. A policy defines conditions that are evaluated against the data in analyzed resources. Data that meets the policy conditions is identified as a policy violation.
Data Posture 360 provides built-in policies for common data risks. You can also create custom policies to identify risks based on conditions that are specific to your organization.
Built-in policies
Built-in policies contain predefined conditions for identifying common data risks. After Data Posture 360 analyzes a resource, the policies are evaluated against the analyzed data to identify policy violations.
| Policy name | Description | Category | Severity |
|---|---|---|---|
| GDPR Passwords | Detects passwords associated with EU personal data, indicating a potential violation of GDPR security requirements. | Security | Low |
| GDPR Personal | Detects personal data associated with EU individuals, helping identify resources that fall under GDPR data. | Privacy & Compliance | Low |
| GDPR PHI | Detects health-related personal data associated with EU individuals, which is classified as special category data under GDPR. | Privacy & Compliance | Low |
| GDPR Financial | Detects financial data associated with EU individuals, which may be subject to GDPR requirements when stored or processed within EU jurisdictions. | Privacy & Compliance | Moderate |
| HIPAA ePHI Detection | Detects high-risk electronic Protected Health Information (ePHI) as defined by HIPAA, including regulated health identifiers. | Privacy & Compliance | High |
| Publicly Accessible Sensitive Data | Detects sensitive or restricted data that is publicly accessible, indicating security and compliance risk. | Privacy & Compliance | Critical |
| Publicly Accessible Non-Sensitive Data | Detects non-sensitive data that is publicly accessible without authentication, helping identify unintended data exposure and misconfigurations. | Privacy & Compliance | Critical |
| Inactive Data (5+ Years) | Detects data items that have not been accessed for more than five years, indicating potentially obsolete or unused data. | Optimization | Low |
| Inactive Sensitive Data (5+ Years) | Detects sensitive data items that have not been accessed for more than five years, indicating potential risk from unnecessary retention of sensitive information. | Optimization | Moderate |
| Non-Sensitive inactive data policy | Detects data items that have not been accessed for an extended period and do not contain sensitive data, indicating potentially obsolete or low-value content. | Optimization | Low |
| Public Exposed SECRETS | Detects credentials, API keys, tokens, and other development secrets that are publicly accessible, highlighting the risk of unauthorized access. | Security | Critical |
| Financial PII | Detects sensitive U.S. financial personal data, such as bank account numbers and financial identifiers, that is subject to financial and privacy regulations. This policy requires data classification to be enabled. Enable classifiers to start detecting financial data. |
Privacy & Compliance | Low |
| Orphan Data Items | Detects data items that do not have an identifiable owner or valid security identifier (SID), indicating potential governance and access control gaps. | Governance | Moderate |
| Duplicate Data Items | Detects duplicate data items across one or more resources, indicating redundant data that can increase storage costs and contribute to data sprawl. | Optimization | Low |
To review the data that violates a policy, see Review policies and policy violations in Data Posture 360.
Custom policies
Custom policies identify data based on conditions that are specific to your organization's requirements.
When you create a custom policy, you define information such as the policy category, severity, and the rules used to identify violations. Policy rules can use attributes of the analyzed data, such as access time, content ID, or creation time.
The policy category describes the purpose of the policy. The category does not restrict the rules that you can add to the policy.
To create a custom policy, see Create a custom Data Posture 360 policy.