Information security

INF017

Applying protective markings to official information

Protective markings help to keep official information secure. They’re a visual reminder of the security measures that apply to information or equipment.

Who should mark information and when

The person who creates the information is the ‘originator’.

The originator is responsible for assigning a protective marking when the information is created.

Check the marking is right throughout the development lifecycle

If the level of protection changes during the drafting process, the originator should adjust the protective marking.

When the draft is final, the originator must confirm that the protective marking is at the right level to keep the information secure.  

Where to put protective markings

Protective markings go at the top and bottom of each page of a document. A document means any form of recorded information, such as reports, letters, books, email, minutes, memoranda, films, charts, tapes, images, and digital media.

When printed documents are filed, their protective markings should be clearly visible. The same rule applies to removable electronic and optical media, such as USBs, CD-ROMs, microfilms, photographs, and removable hard drives.  

Related information: Managing and marking physical files

Marking books, pamphlets, and reports

Documents with covers, such as books, pamphlets and reports, must show the protective marking on:

  • each page
  • the front and rear covers
  • the title page
  • the binding (if possible).

Any binding or fastening of pages must not obscure the protective markings.

Dealing with oral information

If information that carries a protective marking is delivered orally (for example, through classified discussions), the recipient(s) must be told that the information needs protection before the information is conveyed.

Marking paragraphs

Sometimes paragraphs may need to be marked because they have different or higher security needs. For example, a paragraph in a document might contain secret information. Paragraph markings are called ‘paragraph grading indicators’.

Your agency should consider developing a policy on protectively-marking paragraphs within documents that require security classifications.

Applying paragraph grading indicators

Put paragraph grading indicators in brackets at the beginning of each paragraph. Write them in full or abbreviate them using the first letters of the security classification. For example, (S) for SECRET or (IC) for IN CONFIDENCE. Table 1 shows the standard abbreviations you can use.

Paragraph grading indicators should be the same colour as the text in the document.

If you use paragraph grading indicators, you must also mark all the paragraphs in the document, so that no one is confused about which markings apply to what text.

Use UNCLASSIFIED for paragraphs that don’t carry a protective marking. Example 1shows you how to do that.

Table 1: Abbreviated security classifications

UNCLASSIFIED (U)
IN CONFIDENCE (IC)
SENSITIVE (Sen)
RESTRICTED (R)
CONFIDENTIAL (C)
SECRET (S)
TOP SECRET (TS)

Example 1: Applying paragraph grading indicators



Applying an overall protective marking

Once you’ve applied paragraph grading indicators, you need to establish the overall protective marking for the document. The overall marking must be at least equal to the highest classification level of any one paragraph within the document.

Markings for security classifications

Security classifications must be marked in bold and in capitals. They should be at the same size as the body text or at least 3mm high (whichever is larger).

Colour-coding security classifications

Colour coding makes security classifications easier to identify and ensures higher classifications stand out.

Colour-code security classifications as follows:

·       TOP SECRET — red

·       SECRET — blue

·       CONFIDENTIAL — green

·       RESTRICTED,SENSITIVE and IN CONFIDENCE — black
 
The highest security classification should be clearly marked at the centre top and bottom of each page in a single line as shown in Example 2.
If necessary, the security classification can be stacked in the centre of the page to fit around a letterhead.

Example 2: Applying a security classification marking

Documents with covers, or in folders, must show the security classification on:

  • the front and rear covers
  • the title page
  • all other pages in the document.

 Any bindings or fastenings must not obscure the protective marking.

Example 3: Applying protective markings to documents with more than one page

 
Applying endorsement markings

You must not use endorsement markings without a security classification.

When a document needs an endorsement marking:

  • put the security classification at the top and bottom of the page
  • put the endorsement marking below the top security classification and above the bottom security classification.

An endorsement marking should always be in the same size, format, and colour as the security classification, as shown in Example 4.

Example 4:  Applying an endorsement marking


 
Applying compartmented markings

Compartmented markings must follow a security classification. Don’t apply them to information that doesn’t have a security classification.

Compartmented markings must be in the same size, format, and colour as the security classification.

Place comparted markings on each page, and straight after the marking for the security classification. Use a double slash to separate the markings.

When you have multiple compartmented markers, use a single slash to separate them.  

Example 5:  Applying compartmented markings

Compartmented markings plus endorsement marking

If your document also needs an endorsement marking, place it on each page straight after the compartmented marking.

Use a double slash to separate the markings as shown in Example 6.

Example 6: Applying compartmented markings with endorsement markings

Marking titles

Whenever possible, don’t put protective markings on titles of things like files, documents, books, and reports. They could be seen in management systems that aren’t protectively marked, and this could put the information at risk.

If marking the title is essential, the originator should use a separate UNCLASSIFIED reference. This mark can appear behind the title in brackets.

Marking printed graphics

For graphics such as maps and drawings:

  • print or stamp the protective markings near the map scale or drawing numbers
  • print the protective markings at the top and bottom centre of the graphic.

If the graphic will be folded, make sure the marking remains visible after folding.

Marking annexes, appendices, attachments, and covering documents

In some cases, the annexes or appendices to a document need protective markings even if the rest of the document is UNCLASSIFIED.

Occasionally, an annex or appendix may also need a different protective marking from the principal document it is attached to.

If the annex, appendix, or attachment has a higher protective marking than the principal document, the document’s front cover should indicate that the document as a whole has a higher security classification. Example 7shows you how to mark correctly in this scenario.

If the annex, appendix, or attachment is at the same protective marking level as the principal document or lower, you don’t need to show that on the cover.

Example 7: Applying protective markings to annexes and appendices


Marking imagery

Photographs and film, and their storage envelopes or containers must all carry clear protective markings when applicable.

Protective markings must be:

  • on both sides of containers and spools
  • projected for at least five seconds in the title and end sequences of roll imagery, cine-film, and video tape.

You must also mark photographic negatives, so that the protective marking is reproduced on all copies made from that negative. 

Marking presentations

Official presentations and presentations with security classifications presentations need appropriate protective markings.

Treat each slide or screen as an individual page, as you would for a paper-based document. The protective marking should be verbally stated to the audience. 

Marking audio

For audio recordings, the level of protective marking must be clearly stated at the beginning and end of each recording. The tape or other media and its container must be conspicuously labelled with the appropriate protective marking.

Marking emails

Emails should be marked with an appropriate protective marking in line with the classification system. Marking emails ensures that:

  • appropriate security measures are applied to the information
  • helps to prevent information being accidentally released into the public domain.

For the policy and controls to apply to emails, go to the New Zealand Information Security Manual (NZSIM) – Email Security.

Marking microforms

Some agencies may still hold microforms such as aperture cards, microfiche, and microfilm that contains protectively-marked information. If so, this material must show the appropriate protective marking at the top and bottom centre of each frame.

Containers and envelopes must bear the appropriate protective marking of the highest protectively-marked microform.

The protective marking must be visible without projection on cards and microfiche. Microfilm should be prominently marked at the beginning and end of each roll.

Marking electronic storage media

For the policy on marking electronic storage media, go to the following sections of the NZSIM:

Marking equipment

Your agency must develop specific procedures for marking equipment.

Protective markings should be clearly visible and not easily removed.

For more details, go to NZSIM – 12.3 Product Classifying and Labelling.


 

Page last modified: 5/08/2019