Configure ESA and CES to Trigger DLP ITIN Policy Matches
Available Languages
Introduction
This document describes how to trigger emails with DLP Policy Individual Taxpayer Identification Number (ITIN) matches on the ESA/CES.
Q. How to trigger emails with DLP Policy ITIN on the ESA and CES?
Prerequisites and scope: Ensure the DLP ITIN policy is enabled and applied to the relevant mail flow on ESA or CES.
Matching logic (based on the examples): A 9-digit ITIN-like pattern by itself does not match. A match occurs when the 9-digit pattern appears with an ITIN-related keyword (for example, "itin", "taxpayer", or "tax id"). The 9 digits can be contiguous or hyphenated (###-##-####).
Test procedure:
- Compose a test email and include one of the matching test strings from the list in the message body.
- Send the message through the ESA or CES mail flow where the DLP policy is enforced.
- Verify the DLP hit in the message tracking/logs for the message and confirm the configured DLP action was applied.
Test strings and expected match behavior:
| Sample Text | Expected Result |
|---|---|
921-72-3456 |
No match |
921723456 |
No match |
taxpayer 921723456 |
Match |
taxpayer 921-72-3456 |
Match |
tax id 921-72-3456 |
Match |
tax id 921723456 |
Match |
itin 921723456 |
Match |
itin 921-72-3456 |
Match |
tax payer 921723456 |
Match |
tax payer 921-72-3456 |
Match |
taxid 921-72-3456 |
Match |
taxid 921723456 |
Match |
tax identification 921-72-3456 |
Match |
tax identification 921723456 |
Match |
All identifiers and sample values in this document are fictitious test data.
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
24-Sep-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)