Masking policy reference

Edit online

Use the masking policy reference topics to understand the behavior, configuration options, and known limitations for the standard and predefined masking policies available in IBM® Optim.

IBM Optim provides two categories of masking policy:
  • Standard masking policies
  • Predefined masking policies
Both categories can be used to mask sensitive data in a column, but they differ in how they are configured, what data types they target, and what level of control they give you over the masking behavior.

Use the following descriptions to determine which category of policy to use for a given column.

Standard masking policies

Standard masking policies are configured in the IBM Optim UI or by using the API to provide a format name and a processor type. The format name identifies the specific data format being masked (for example, a name-based email address or a US street address), and the processor type determines the masking method, whether the output is random or deterministic, and whether it is stable across job runs.

Standard policies are organized into data categories, each grouping related formats. Every format within a category supports the same four processor types, giving you consistent control over masking behavior regardless of the specific format you choose.

Use standard masking policies when your source data conforms to a recognized format with known structure, such as a person name, email address, or street address, and when you want to apply a format-aware masking strategy that preserves the structural characteristics of the original value.

Predefined masking policies

Predefined masking policies are configured directly in the IBM Optim UI or through the policy_metadata and processor blocks in the API. Each predefined policy targets a specific sensitive data type and exposes its own set of configuration options tailored to that type, such as controlling dash formatting in a generated Social Security Number or specifying the card provider for a generated credit card number.

Use predefined masking policies when your source data is a well-known identifier type with specific structural requirements, or when you need direct control over masking parameters such as date offsets, redaction characters, hash algorithms, or output format.

Choosing between standard and predefined policies

Both categories can produce random or deterministic output, and both handle NULL input by returning NULL without raising an error. The key differences are in scope and configuration.

Table 1. Standard versus predefined masking policies
Characteristic Standard masking policies Predefined masking policies
Configuration Format name and processor type in the IBM Optim API policy_metadata and processor blocks in the API, or directly in the UI
Data categories Address, email, financial information, healthcare information, person name, personal information Individual policy types: Redact, SSN, Credit Card Number, National ID, Format Preserving, Date, Email, Hash
Processor selection Up to 4 standard processor types apply to every format within a category Each policy defines its own algorithm options (typically Repeatable or Random)
Output format control Determined by the format name and processor type Policy-specific parameters (for example, dash formatting, card provider, date offset units)
Best suited for Recognized natural-language or demographic formats with known structural patterns Well-known identifier types with specific formatting or transformation requirements