Classifying Government Information

Once information is classified and marked, access control to sensitive information can be efficiently and effectively managed, minimising the potential impact of government data breach.

It follows that any contractors to these agencies must comply with the same set of rules and regulations applied by the agency they are contracted to.

As well as being reliable, information security and compliance solutions available to government agencies and their contractors must also be cost-effective.

Identifying and classifying sensitive information allows you to focus control measures on the information that needs protecting – making it easier and more affordable to enforce information security policy.

Reducing Risk, Minimising Costs

By providing a quick and easy mechanism for distinguishing between public information and sensitive material, information classification can reduce overall costs by allowing security efforts to target only the most sensitive material. Sensitive information can be manually classifed by the author or automatically classified using e-discovery tools.

Information classification can be a valuable tool across all areas of government data handling, including:

• IP protection

• National security requirements

• Government information security compliance

The Australian Commonwealth Government abides by the Protective Security Policy Framework (PSPF), which incorporates a Protective Marking Scheme according to Business Impact Levels (BILs). BILs describe the potential harm or damage to government operations, organisations or individuals if there were a compromise to the confidentiality, integrity or availability of public sector information. 

The Australian Government uses four security classifications: OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET.

All other information from business operations and services requires a routine level of protection and is treated as OFFICIAL. Information that does not form part of official duty is treated as UNOFFICIAL.

OFFICIAL and UNOFFICIAL are not security classifications and are not mandatory markings.

There are three main components of a protective marking: security classification, Information Management Markers (IMMs) and security caveats. 

Specific definitions of each protective marking with their BILs are set out in the table below.

Information management markers (IMMs) are an optional way for entities to identify information that is subject to non-security related restrictions on access and use. Information management markers are not protective markers or security classifications. The three commonly recognised IMMs are:

• Legislative Secrecy

• Personal Privacy, and

• Legal Privilege

Caveats are a warning that the information has special protections in addition to those indicated by the security classification. The Australian Government Security Caveats Guidelines establishes four categories of caveats:

• codewords (sensitive compartment information)

• foreign government markings

• special handling instructions

• releasability caveats

Using classification to support compliance

When you need to ensure contractors are complying with information security regulations, information classification provides an effective, straightforward and affordable solution.

By allowing all people engaged in information handling to categorise sensitive information in emails, documents, and other files, solutions such as Janusseal help to improve information security, while making it simple to enable contractor compliance and to minimise supply chain risk.

If government contractors use the same classification schema as the contracting agency, they can ensure material is controlled and marked to the same degree of diligence that the government would apply to its own processes.

Janusnet has a long history in the electronic marking of government information. Janusseal classification solutions support a whole range of government classifications and classification schemas that comply with the numerous government compliance standards now in operation worldwide. Our solutions provide seamless integration with existing IT security systems for fast deployment and implementation.

If you would like to learn more about the identification, classification and management of government information, please contact us and one of our highly experienced team will quickly respond.