CAD drawings, contracts, and source code rarely live in one place. They sit on engineers’ workstations, on the laptops of bid managers, on developer machines that travel between offices, and on shared drives that everyone touches at some point. Asking employees to remember a ZIP password every time they save a sensitive file solves nothing in the long run. Ping64 transparent encryption pushes the protection logic into the operating system layer so authorized applications can read and write protected files seamlessly, while any unauthorized process sees only ciphertext. Combined with classification levels and security domains, the platform also defines who is allowed to read, edit, or send those files outside. This article walks through one practical question: how to bring drawings, Office documents, and source code under Ping64 transparent encryption in a single coherent setup, while preserving the room employees need to do daily editing, collaboration, and approved external sharing.
Ad-hoc password protection cannot keep up with how core assets actually move
Most enterprises start with archive passwords, Office document passwords, and shared link codes. The trouble is that all of these can be copied, screenshotted, or simply spoken across the desk. The moment a designer saves a drawing to the desktop or a USB stick, the thin shell of password protection falls away. Specialized tools such as CAD, PLM, and modern IDEs were never designed around password gates, so administrators end up protecting the wrapper instead of the file itself. Plaintext copies remain on local disks, and once they leave the corporate network, no one has any control over what happens to them.
Ping64 transparent encryption replaces this pattern. Once an endpoint falls under a Ping64 document transparent encryption policy, any process that belongs to the authorized software list and reads or writes a target file extension is encrypted and decrypted at the kernel layer automatically. Any process that is not on the authorized list sees only unreadable ciphertext for the same file. From the user’s perspective, working with AutoCAD, SolidWorks, Word, or Visual Studio feels exactly like before. From the data’s perspective, the moment a file leaves the authorized environment, whether it is copied to a thumb drive, uploaded to a personal cloud, or stolen by malware, it loses readability. That kind of always-on, process-aware protection mirrors how core assets really flow inside an enterprise far better than any one-off password ever could.
Turning transparent encryption into something operational takes more than one switch. Ping64 splits the document transparent encryption capability into several pieces that reinforce one another. The authorized software list is the entry point, declaring which processes are allowed to read and write ciphertext. CAD tools, Office suites, and source code IDEs typically belong on this list and are organized by business line. Classification levels and security domains then answer the next question, which is who can open a given piece of ciphertext. A drawing tagged as confidential and assigned to the engineering domain can only be opened on engineering endpoints whose own classification level is at least confidential. Finance contracts live in a separate domain and stay isolated from engineering by default.
Three extension scenarios show up in real engagements. The first is genuine outbound sharing with suppliers or customers. Ping64 routes these through outbound approval, where the requester, target file, recipient, and validity period are tied together, and only after approval does the platform produce a decryptable outbound package. The second is temporary classification adjustment, for example lowering a drawing from top secret to confidential so that it can travel through a cross-departmental review. Ping64 captures these adjustments in the same approval flow and keeps the before-and-after values in the audit trail. The third is controlled offline access. During business trips, on-site work, or temporary network outages, Ping64 still allows authorized applications to read and write ciphertext within a permitted offline window, then withdraws access automatically once that window expires. Every one of these actions ultimately lands in the audit center, where security teams can see who encrypted which files with which process, when, and which decryption requests they raised, all in a queryable form.
Implementing transparent encryption in the Ping64 console
The next stretch translates the model above into concrete administrator actions. Each step states where to go in the Ping64 console, what to configure, who it applies to, and how to verify the result.
Step 1: Define classification levels and security domains under security attributes
From the left navigation in the Ping64 console, open the Document Encryption group and go to the Security Attributes page. Maintain the classification levels your organization actually uses, such as Public, Internal, Confidential, and Top Secret, filling in both the level name and the level identifier in the classification list. On the same page, define security domains that match your business, for example Engineering, Sales, Manufacturing, and Administration. The scope of effect is every transparent encryption policy and every outbound approval that comes after, so this layer should be stable once it is set. To verify, return to the top of the Security Attributes page and confirm the banner reads that there are several classification levels available, rather than the empty-state message indicating that no classification levels exist yet.
Step 2: Build the authorized software list of processes allowed to handle ciphertext
Switch to the Authorized Software page in Ping64 and curate one list for drawing tools, including the AutoCAD, SolidWorks, and CATIA executables, and additional lists for Office, Visual Studio, and JetBrains IDEs. The bulk import flow is convenient here. When the file finishes parsing, the console displays a confirmation that the file has been parsed and asks you to choose which authorized software entries to add, followed by a success message indicating how many entries were imported. Each authorized software entry can be further configured for screen capture and printing, allowing or blocking those actions. The scope of effect is the endpoint groups that you will later attach to a document encryption policy. To verify, open the Authorized Software Usage page in Ping64 and confirm that representative endpoints appear in the recent activity list with real coverage, activity, and usage figures.
Step 3: Enable transparent encryption mode in the document encryption policy and bind the authorized software
Go to the Policy Center in Ping64 and either create or edit a document encryption policy. The page title appears as Ping64 – Create Document Encryption Policy or Ping64 – Document Encryption Policy Detail. Inside the policy, turn on Transparent Encryption Mode, choose the authorized software lists you maintained in the previous step as the processes allowed to encrypt and decrypt, and pick the file extensions that should be protected, such as dwg, dxf, prt, sldprt, docx, xlsx, cpp, and cs. Then enable Classification Level Verification with the option that allows endpoints to view only encrypted files at or below their own classification level, so that classification participates in runtime decisions rather than living only on paper. The scope of effect is every endpoint group covered by this policy. To verify, go to the Transparent Encryption and Decryption audit view, have an engineering endpoint create and save a dwg file in AutoCAD, and confirm that an encryption event is recorded with the executing principal, source process, and target file. Then try to open the same dwg with an unauthorized viewer; the file should display as unreadable content, which confirms that transparent encryption is in effect.
Step 4: Turn on security attribute approval and outbound approval under advanced settings
Open Advanced Settings in the same policy and go to Security Attribute Approval Settings. Enable the option that allows endpoints to adjust the security attributes of a file by submitting an approval request, then bind an existing approval workflow under Choose Approval Workflow for Security Attribute Adjustment. In parallel, attach an approval workflow to outbound sharing of encrypted files so that employees cannot bypass Ping64 and carry ciphertext out on their own. If saving the policy returns a message about needing to choose an approval workflow when security attribute approval is enabled, or about advanced settings being incomplete, return to the relevant section and finish the configuration. The scope of effect is every employee in this policy’s coverage who needs to change classification levels, change ownership, or send ciphertext outside. To verify, simulate one outbound request and one classification downgrade request from a regular endpoint, confirm that the corresponding tickets appear in the Approval Center, trace the action records in the Audit Center, and check the Encrypted File Outbound view to see the package title, description, operation time, and file detail.
Step 5: Confirm coverage and run continuous patrols in endpoint management and the audit center
Go to Endpoint Management in Ping64, filter the endpoints attached to the document transparent encryption policy by department or group, and confirm that the policy has been delivered and is showing as active. Then enter the Audit Center in Ping64 and use the Transparent Encryption and Decryption view together with the Behavior Audit view to reconcile the volume and distribution of encryption, decryption, decryption request, and outbound events over time. If a particular group shows no encryption events at all over a meaningful window, work backward to verify that the authorized software list and policy coverage are not missing anyone. The scope of effect is the compliance patrol across the entire workforce. To verify, look at the Document Transparent Encryption Overview dashboard in Ping64 and check that the coverage rate, the number of active endpoints, and the recent event trend are consistent with the underlying audit detail.
Exception path: the legitimate read-only and short-term exemption cases
Not every role needs full transparent encryption. For administrative staff or sales assistants who rarely touch drawings or source code, Ping64 supports a configuration that delivers only Classification Level Verification without enabling Transparent Encryption Mode, which lets them open the documents they truly need without producing new ciphertext on their machines. For engineers temporarily working with an external partner on integration, Ping64 can issue a one-time outbound package through Advanced Settings, with a defined recipient and validity window. The package expires automatically once the window closes, so the authorized software list does not need to be permanently relaxed. This pattern preserves the continuity of transparent encryption for the core population while avoiding a grey zone where entire teams sit outside the protection envelope for long stretches of time.
Transparent encryption is the start, not the finish line, of long-term protection
Bringing drawings, Office documents, and source code under transparent encryption is only the upstream segment of what Ping64 document encryption can do. Whether an organization actually keeps its core assets safe over time depends on more downstream factors: whether the classification taxonomy stays clear, whether the authorized software list keeps pace with how the business changes, whether outbound approval truly carries the weight of risk judgement, and whether the audit center is reviewed on a steady cadence. Ping64 puts all of these moving parts into a single console, where classification levels, security domains, authorized software, document encryption policies, approval workflows, audits, and dashboards reinforce one another. That is what shifts an administrator from flipping a feature on once to governing a class of assets continuously. Once the Ping64 transparent encryption policy, security attribute approval, and outbound auditing are all running together, files can still be copied, captured, or unintentionally moved, yet the daily experience of employees stays natural and the enterprise’s grip on drawings and code remains both explainable and auditable.
Contact
11 min 
