In short: Cisco Secure Email Encryption Service, formerly Cisco Registered Envelope Service (CRES), is Cisco's hosted email encryption. Mail is encrypted by gateway policy, DLP rules or the Outlook add-in, and delivered as a secure envelope that recipients open on any device after registering. Senders can recall messages, set expiry and get read receipts. It is included in Secure Email Advantage.
What is the Secure Email Encryption Service?
The Secure Email Encryption Service is a Cisco-hosted service that encrypts individual messages. It started life as the Cisco Registered Envelope Service (CRES), which is why you will still see "CRES" in admin portals and documentation.
When a message is encrypted, the service creates a key, wraps the message in an encrypted HTML envelope and sends it to the recipient. The recipient opens the envelope and authenticates; the service then releases the key so the message can be read. Because Cisco handles the keys, neither senders nor recipients have to manage certificates, which is what makes per-message encryption practical for everyday use.
How encryption is triggered
- By policy on the gateway: Secure Email Gateway content filters encrypt mail that matches rules you set, for example everything to a particular partner domain
- By data loss prevention: gateway DLP policies encrypt messages that contain sensitive data, such as personal or payment card data, before they leave
- By the user: a keyword in the subject line that a gateway policy acts on, or one click in the Outlook add-in
Policy and DLP-based encryption is the most reliable approach because it does not depend on people remembering. The user options are useful for one-off sensitive messages that a policy would not catch.
A sensible starting set of policies for a UK organisation is: always encrypt mail to named partner domains that handle your personal data, encrypt any message that DLP finds carrying payment card numbers or National Insurance numbers, and give staff the add-in for everything else. We tune the DLP dictionaries so routine mail is not encrypted unnecessarily, because over-encryption annoys recipients and trains people to ignore the envelope.
The recipient experience
Recipients do not need special software or an app. They receive an envelope, open it from any device, and authenticate. The first time, that means creating an account with the service, or signing in with supported credentials such as a Google account or, where configured, a SAML 2.0 identity provider; two-step verification is available. Cisco's Easy Open feature temporarily holds the envelope with the service so it opens consistently on desktop and mobile.
From the envelope the recipient can read the message and, if your policy allows, reply or forward securely. Some recipients will be wary of an unfamiliar envelope, so we suggest telling regular correspondents what to expect, and making sure your SPF, DKIM and DMARC are in order so the notification is not treated as suspicious.
Sender controls
| Control | What it does |
|---|---|
| Recall | Expires the key so the message can no longer be opened, even after delivery |
| Expiry | Sets a date after which the message becomes inaccessible |
| Read receipts | Tells the sender when the recipient has authenticated and opened the message |
| Reply and forward controls | Allows or prevents reply, reply-all and forward, if company policy permits |
| Branding | Shows your organisation's branding on envelopes and notifications, so recipients recognise who sent them |
The Outlook add-in and Outlook 2019
The Secure Email Encryption Service add-in lets users encrypt from within Outlook. Cisco ended support for Outlook 2019 with the encryption add-in (and the related Secure Email Submission add-in) on 14 October 2025, and advises moving to Microsoft 365 to keep using it, with a new add-in manifest that administrators download from the encryption service admin portal.
If you still have Outlook 2019 users, plan the move to Microsoft 365 apps, then deploy the current add-in centrally through the Microsoft 365 admin centre. We can help with both; see Microsoft 365 at Forever Group.
Licensing, UK GDPR and how we help
The Encryption Service is included in the Secure Email Advantage gateway bundle and is an add-on to Secure Email Essentials; see the bundle table on our Cisco Secure Email page. Pricing depends on users and term, so ask us for a quote.
UK GDPR requires appropriate technical measures to protect personal data, and names encryption as an example of one. Encrypting email that carries personal or special category data, by policy rather than by choice, is a practical way to show you have taken that seriously, and the recall and expiry controls help when mail goes to the wrong person. Encryption is one control, not the whole answer: pair it with DLP policies and GDPR training for staff.
We design the encryption and DLP policies, brand the envelope and notifications, roll out the Outlook add-in and brief your regular recipients. Contact us to get started.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco Registered Envelope Service the same as Secure Email Encryption Service?
Yes. Cisco Registered Envelope Service (CRES) was renamed Cisco Secure Email Encryption Service. You will still see the CRES name in some admin portals and documentation.
How do I open a Cisco secure email message?
Open the envelope attachment or link in the notification. The first time, create an account with the service or sign in with a supported account, then authenticate; the message decrypts once you are verified. No special software is needed, and it works on any device.
Does the Cisco encryption add-in work with Outlook 2019?
No. Cisco ended Outlook 2019 support for the Secure Email Encryption Service add-in (and the Secure Email Submission add-in) on 14 October 2025. Cisco advises moving to Microsoft 365 and installing the new add-in manifest from the admin portal.
Can I recall a Cisco encrypted email?
Yes. Recall expires the message key, so the recipient can no longer open it, even if it has already been delivered. You can also set an expiry date when sending.
Is the Secure Email Encryption Service included with Cisco Secure Email?
It is included in the Secure Email Advantage bundle and is an add-on to Secure Email Essentials.