When are changes to documents edited in offline mode scanned for Cisco Cloudlock policy violations?

 

Microsoft and Google have apps or settings that allow users to work on and edit documents while offline. When a user comes back online, these apps allow the edited files to sync up and can appear as "downloads" because they must be re-scanned.

Cisco Cloudlock will only scan content that is saved to Google Drive and accessible via the Google Drive APIs. The Google application that allows for the syncing of files is called "Google File Stream."

For Microsoft Office, the corresponding application is called "One Drive Files On Demand" and is also a configurable setting.

Offline edits that are not synced to Google Drive will not be picked up by the Cloudlock scans since the new revisions do not yet exist within the Google Drive environment. After the content is synced (via File Stream) to Google Drive, Cloudlock becomes aware of the change to the document and will scan the version of the document that was last synced for policy violations.

If a document is edited to include content that is in violation of a policy in offline mode (or while syncing is paused within Google File Stream), and the user removes that violation before syncing the content back to Google Drive, Cloudlock will not raise an incident because the final content that made its way into Google Drive does not contain the violation.