Email Encryption evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 24 vendors in this category.

• baselineRFIWhat encryption standards are supported — S/MIME, PGP, TLS-based transport encryption, and portal-based (web pickup) delivery — and which is the default for recipients with no compatible client?weight 3
  Answer key — what a strong answer shows

  Look for a clear fallback story for recipients without S/MIME/PGP set up (most external recipients) — a product that only works cleanly between two configured clients has limited real-world reach.

• baselineRFPDescribe policy-based automatic encryption — can rules trigger encryption based on content detection (SSNs, PHI, financial data) or recipient domain, without the sender manually choosing to encrypt each time, with a customer-referenced accuracy figure?weight 3
  Answer key — what a strong answer shows

  Manual per-email encryption decisions get skipped under time pressure; look for reliable automatic policy triggers with a real accuracy figure on content detection.

• baselineRFIHow does key management work — is it centrally managed (IT controls keys, can recover/audit) or fully end-to-end with no organizational recovery capability, and which model fits regulated-industry audit requirements?weight 3
  Answer key — what a strong answer shows

  Fully end-to-end (no recovery) conflicts with many compliance regimes requiring organizational access to business records — look for the vendor being explicit about this tradeoff, not glossing over it.

• baselineRFIWhat is the recipient experience for external parties without the product installed — a portal login, a one-time passcode, or a downloaded encrypted attachment — and what friction does this add to a typical external business exchange?weight 3
  Answer key — what a strong answer shows

  Recipient friction is the biggest real-world adoption barrier for email encryption; look for a low-friction default (e.g., one-click portal access) rather than assuming recipients will install software.

• baselineRFPDetail integration with existing email infrastructure — native Outlook/Gmail plugin versus gateway-level transparent encryption, and whether encrypted emails remain searchable/discoverable for e-discovery and compliance archiving.weight 3
  Answer key — what a strong answer shows

  Encrypted email that becomes unsearchable breaks e-discovery/compliance archiving — look for an explicit answer on how archived encrypted mail stays discoverable under legal hold.

• baselineRFIHow does the platform handle encrypted email on mobile devices — native mobile app support, and does encryption/decryption work seamlessly within the standard mobile mail client or require a separate app?weight 3
  Answer key — what a strong answer shows

  A solution that only works well on desktop Outlook misses a large share of real email usage — look for genuine mobile parity.

• baselineRFPExplain DLP integration — can the encryption product coordinate with a separate DLP tool (or include DLP natively) so a message can be blocked, encrypted, or redacted based on the same content-detection engine?weight 3
  Answer key — what a strong answer shows

  Look for either native DLP or a real integration handoff — encryption alone doesn't prevent sending sensitive data to the wrong recipient, only concealing it in transit.

• baselineRFIWhat audit and compliance reporting is available — who sent/received what encrypted messages, delivery/read confirmation, and exportable logs mapped to relevant regulations (HIPAA, GLBA, GDPR)?weight 3
  Answer key — what a strong answer shows

  Look for exportable, regulation-mapped audit logs, not just a raw send log requiring manual interpretation for a compliance review.

• baselineRFIWhat is the pricing model — per user/mailbox per month, tiered by feature set — and does cost differ meaningfully between basic policy-based encryption and full DLP-integrated, e-discovery-searchable capability?weight 3
  Answer key — what a strong answer shows

  Look for transparent, tier-differentiated pricing that's explicit about which capabilities are gated behind a premium tier rather than included in the base product.

• baselineRFPWhat is the incident-response process if the encryption system's own key material or portal infrastructure is suspected compromised, given it holds the means to decrypt the organization's most sensitive email traffic?weight 3
  Answer key — what a strong answer shows

  A compromise of the encryption system itself would be a severe incident given its role protecting sensitive communications — ask for a specific, tested incident-response process, not a generic reassurance.

• baselineRFIWhat compliance certifications does the vendor itself hold (SOC 2 Type II, ISO 27001), given it processes and potentially holds keys for the organization's most sensitive regulated communications, and can the customer request the actual audit report?weight 3
  Answer key — what a strong answer shows

  Insist on the real audit report — a compliance-badge claim without the underlying report is insufficient evidence for a product handling this level of sensitive communication.

• baselineRFIHow does the platform integrate with the customer's existing email security/anti-phishing stack — is encryption a genuinely complementary layer, or does it duplicate content-inspection capability the customer's email security gateway already performs?weight 3
  Answer key — what a strong answer shows

  Look for a clear answer on this integration boundary; redundant, disconnected content-inspection between the encryption product and the existing email security stack creates real policy-management complexity.

• baselineRFPWhat export-control or regulatory considerations apply to using strong encryption across international jurisdictions, and does the platform handle jurisdiction-specific encryption-strength or key-escrow requirements automatically for a global workforce?weight 3
  Answer key — what a strong answer shows

  Cross-border strong-encryption regulation genuinely varies by country — a vendor operating internationally should have a specific answer on how jurisdiction-specific requirements are handled, not assume one global policy suffices.

• baselineRFIHow does the platform handle large attachments or bulk file transfers within an encrypted email — is there a practical size limit that forces a fallback to a separate, possibly less-secure transfer method?weight 3
  Answer key — what a strong answer shows

  Ask for a specific size-limit figure and what happens when it's exceeded — a low limit that forces users to a separate insecure transfer channel undermines the whole point of the encryption product.

• baselineRFPDetail historical trend reporting on encrypted-message volume and policy-trigger accuracy over time, suitable for demonstrating both program effectiveness and the accuracy of automated content-based encryption triggers to leadership.weight 3
  Answer key — what a strong answer shows

  Trend-over-time reporting is a distinct capability from real-time delivery logs — confirm this exists as a maintained, exportable report.

• baselineRFIWhat is the business-continuity plan if the vendor's own infrastructure has an outage — can users still send and receive encrypted email during a vendor-side outage, or does an outage fully block encrypted communication?weight 3
  Answer key — what a strong answer shows

  An encryption-vendor outage that fully blocks sending/receiving encrypted mail is a severe availability failure mode for organizations that rely on it for regulated communication — ask for a specific continuity mechanism, not just an uptime SLA number.

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.