View Built-In DSPM Policies - Netskope Technical Documentation

Netskope DSPM ships with several built-in policies to get you started. Some are enabled, while some are disabled by default. You can modify or archive any policies you don’t need. Each policy is listed below, grouped by type.

Classification Type

Policy Name	Description	Conditions	Default Status
High Sensitive Data Classified	Generates an Alert when new High Sensitive Data is classified	Sensitivity Level is High AND Reviewed is False	Enabled

Data Modified Type

Policy Name	Description	Conditions	Default Status
SOX Data Modified	Alerts when Data was Inserted, Updated or Deleted from a Field tagged with “SOX”	Data Tag is SOX AND Operation is Insert, Update, or Delete	Enabled

Data Store Discovered Type

Policy Name	Description	Conditions	Default Status
Data Stores Discovered	Alerts when new Data Stores are discovered in Account with Auto-Discovery enabled	Infrastructure Connection is AWS	Enabled

Exfiltration Type

Policy Name	Description	Conditions	Default Status
Large Volume of Sensitive Data Accessed	Alerts when a query returns > 99,999 rows of a high sensitive field	Rows Produced > 99,999 AND Sensitivity Level is High	Enabled
Regulated Data Accessed (Exfiltration Risk)	Alerts when any sensitive field tagged with PCI, CCPA, GDPR or HIPAA is at risk of Exfiltration	Data Tag is GDPR, CCPA, PCI, HIPAA-HI, HIPAA-PI, or SOX	Disabled

Privacy Type

Policy Name	Description	Conditions	Default Status
Privacy Violation on PII	Alerts when any sensitive field tagged with PCI, CCPA, GDPR or HIPAA is at risk of Exfiltration	Data Tag is PII	Enabled

Data Access Type

Policy Name	Description	Conditions	Default Status
Ghost Users With Access to Sensitive Data	Alerts when new Usernames not associated with any Employee or Service Account are detected to have access to Data	DB User Directory Mapping is False AND Sensitivity is True	Disabled

Even though some of the Policies are enabled, they might not trigger because their Conditions require your policy administrator to perform certain prerequisite actions, including scanning of Data Stores and enabling certain regulations on the Company Profile screen.