Files labeled Confidential in a cloud document repository lose that marking when users download or export them, so downstream systems treat the copies as unclassified. What is the best way to fix this?
Select an answer to reveal the explanation.
Short Explanation
If the label lives only on the shelf, it falls off the moment someone takes the file home. You want the label stitched into the file itself, in its metadata and its visible markings. File names are too easy to change, and blocking every download just breaks the business.
Full Explanation
Classification is only effective if it persists wherever the data goes. When a repository stores the label only in its own database, the label exists solely as an attribute of the repository record, and exported copies carry nothing that downstream tools or recipients can read. Persistent labeling embeds classification in the file itself, typically as metadata properties that DLP, CASB, IRM and email tools can read, plus visible markings such as headers, footers or watermarks for human recipients. Labels embedded this way survive download, copying and forwarding, so downstream systems can enforce the right controls. Keeping the label only in the repository's database is the cause of the problem, not a fix. Renaming files with the classification provides a visual hint, but names are trivially changed, are not reliably read by enforcement tools and are lost when content is copied into new files. Blocking all downloads would prevent the loss of labels by preventing legitimate use, which is disproportionate and usually unworkable for business processes. Exam caveat: embedded labels identify sensitivity but do not themselves restrict access; IRM or encryption adds enforcement. Operational check: export a labeled file and confirm DLP on the endpoint and email gateway recognizes its classification.