Configure ESA and CES to Trigger DLP ITIN Policy Matches
Author: Cisco Systems, Inc.
Date: 2026-09-24T05:00:00+00:00

Contents

Introduction

Q. How to trigger emails with DLP Policy ITIN on the ESA and CES?

Introduction

This document describes how to trigger emails with DLP Policy Individual Taxpayer Identification Number (ITIN) matches on the ESA/CES.

Q. How to trigger emails with DLP Policy ITIN on the ESA and CES?

Prerequisites and scope: Ensure the DLP ITIN policy is enabled and applied to the relevant mail flow on ESA or CES.

Matching logic (based on the examples): A 9-digit ITIN-like pattern by itself does not match. A match occurs when the 9-digit pattern appears with an ITIN-related keyword (for example, "itin", "taxpayer", or "tax id"). The 9 digits can be contiguous or hyphenated (###-##-####).

Test procedure:

1. Compose a test email and include one of the matching test strings from the list in the message body.

2. Send the message through the ESA or CES mail flow where the DLP policy is enforced.

3. Verify the DLP hit in the message tracking/logs for the message and confirm the configured DLP action was applied.

Test strings and expected match behavior:

Sample Text | Expected Result

921-72-3456

No match

921723456

No match

taxpayer 921723456

Match

taxpayer 921-72-3456

Match

tax id 921-72-3456

Match

tax id 921723456

Match

itin 921723456

Match

itin 921-72-3456

Match

tax payer 921723456

Match

tax payer 921-72-3456

Match

taxid 921-72-3456

Match

taxid 921723456

Match

tax identification 921-72-3456

Match

tax identification 921723456

Match

All identifiers and sample values in this document are fictitious test data.