Grace Periods

Grace Periods are used with Email Redaction to determine how much time passes before sensitive messages are redacted and protected behind a verification prompt, both initially and after an unlock.

About Grace Periods

Grace Periods include two settings: the Locking Grace Period and Retrieval Grace Period.

The Locking Grace Period determines the length of time that will pass before sensitive messages are first redacted. This grace period may be the same length of time for all messages or customized to have different wait times for Inbox, Unread and Sent messages.

The Retrieval Grace Period determines how long a locked message remains unlocked after it is unlocked due to a user verified retrieval.

You can customize these settings at the global, tenant or group level.

Best Practices

While you are deploying Email Redaction to reduce the risk of sensitive data loss, some users may see an additional verification step as an inconvenience.

Taking this into account, we recommend starting with a Locking Grace Period of six months across all messages and a Retrieval Grace Period of one day.

In our experience, companies have found higher user adoption and less resistance when starting with stricter grace periods and reducing based on feedback versus companies who increase strictness over time. We recommend reviewing your grace period policy periodically to ensure it correctly reflects your organization’s risk tolerance.

Considerations

The ideal grace periods for your company may differ. Below is a list of questions we recommend our customers consider when making a decision:

• Do you have a homogenous and convenient user verification mechanism deployed across the organization? If yes, this will make it easier to deploy Email Redaction with stricter grace periods.
• Do some business groups have unique retrieval needs related to sensitive content such as processing email on set schedules (e.g. sales quarterly review, accounts payable, etc.)? If yes, you may want to configure separate, more relaxed grace periods for these teams. This is recommended over reducing security protection for all users.

Configuration

To set grace periods, from the left navigation expand Email Redaction, expand Settings, then click Grace Periods.

Grace Period settings can also be configured at the group level as needed for different business units. These adjusted settings will override the global and tenant settings for all members of the group(s).

Retrieval Grace Period

To set the Retrieval Grace Period, select a time interval from the drop down options. The minimum Retrieval Grace Period allowed is 1 hour.

Locking Grace Period

The Locking Grace Period may be the same length of time for all messages or different depending on whether the message is in the Inbox, Unread, or recently Sent.

To set a single wait period for all messages, select Enabled and select a time interval from the drop down options.

If you wish to set different wait periods for Inbox messages, Unread messages and Sent messages, select Advanced. Messages will lock after they are older than the time specified in the All Messages grace period. This time can be extended for Inbox, Unread or Sent messages.

Note: The extension of grace periods will only apply if the respective grace period is set to be longer than what is set for All Messages. For a detailed explanation, review Advanced Grace Periods Examples below.

If the Locking Grace Period is Disabled, new sensitive messages will be redacted immediately in a user's mailbox.

Advanced Grace Periods Examples

Example: All Messages Grace Period = 5 months

Grace Period	Setting	Result	Explanation
Inbox Messages	6 months	Inbox messages will lock after 6 months.	The Inbox grace period applies because the Inbox grace period (6 months) is greater than the All Messages grace period (5 months).
Unread messages	3 months	Unread messages lock after 5 months.	The All Messages grace period applies because the Unread grace period (3 months) is less than the All Messages grace period (5 months).
Sent messages	9 months	Sent messages will lock after 9 months.	The Sent grace period applies because the Sent grace period 9 months) is greater than the All Messages grace period (5 months).
All other messages	5 months	All other messages will lock after 5 months.	The All Messages grace period (5 months) applies.

Example: All Messages Grace Period = 1 year

Grace Period	Setting	Result	Explanation
Inbox messages	6 months	Inbox messages lock after 1 year.	The All Messages grace period applies because the Inbox grace period (6 months) is less than the All Messages grace period (1 year).
Unread messages	3 months	Unread messages lock after 1 year.	The All Messages grace period applies because the Unread grace period (3 months) is less than the All Messages grace period (1 year).
Sent messages	9 months	Sent messages will lock after 1 year.	The All Messages grace period applies because the Sent grace period (9 months) is less than the All Messages grace period (1 year).
All other messages	1 year	All other messages will lock after 1 year.	The All Messages grace period (1 year) applies.