Importing Policies from On-Premises Forcepoint DLP to Cloud DLP

Use this topic to understand how to migrate your existing on-premises Forcepoint DLP policies to Cloud DLP using the Policy Import feature.

Overview

The Policy Import feature enables DLP administrators to migrate DLP policies from on-premises Forcepoint DLP to Cloud DLP with minimal manual rework.

Before importing, ensure the following:

  • Your Cloud DLP license includes the same functionality as your on-premises Forcepoint DLP license. Policy attributes related to any unlicensed capabilities will be imported but will not be active in Cloud DLP until the required license is added.
  • Resources synced from external systems — such as Active Directory, CSV Imports, URL Categories, and Cloud Applications — must be synced with Cloud DLP before importing policies that use them.

When preparing a policy file for import, the limitations below should be considered.

Limitations

Before importing policies, be aware of the following:

File and Version Requirements

  • The import file must be a compressed ZIP archive exported from the on-premises Forcepoint DLP system.
  • For guidance on exporting policies from on-premises Forcepoint DLP, refer to the on-premises Forcepoint DLP export documentation (see Exporting Policies from on-premises Forcepoint DLP).
  • Policy import is supported only for on-premises Forcepoint DLP versions 10.3.3 or later (within the 10.3.x branch) and 10.4.2 or later. Ensure you are running a supported version before importing.

Unsupported Policies and Classifiers

  • Discovery policies are not supported in Cloud DLP and will not be imported.
  • The following classifier types are not supported by Cloud DLP and must not be included in the import. Rules that contain these classifier types will be skipped:
    • File Labeling (Boldon James, MIP)
    • Machine Learning
  • Fingerprinting classifiers are synced from on-premises Forcepoint DLP separately and must not be included in the import. Rules that contain these classifier types will be skipped.
  • Classifiers introduced via policy package updates are not imported. Import such classifiers manually.

Unsupported Resources

  • Import of resources received from external sources is not supported. These resources include Active Directory (Users, Groups, Organizational Units, and Computers), CSV Imports, URL Categories, and Cloud Applications. Sync these resources before importing policies that use them.
  • The following resource types are not supported by Cloud DLP and must not be included in the import. Rules that contain these resource types will be skipped:
    • User directory entries
    • Custom user directory groups
    • Remediation scripts
  • Resource types that are not yet exported by on-premises Forcepoint DLP — such as Endpoint Applications — must not be included in the import. Rules that contain these resource types will be skipped.
  • Business Units must include only resource types that are supported by Cloud DLP. Business Units that contain unsupported resource types will not be imported, and rules that use them will not be imported.

Other Limitations

  • Policy import does not support Risk Adaptive Protection. Upload policies that use Risk Adaptive Protection manually.
Note: If the Cloud DLP license does not support all capabilities available in on-premises Forcepoint DLP, policy attributes related to unsupported channels will be imported but will not be active in Cloud DLP. These attributes will become usable when the required license is added.