Data Classification for Australian Government

Every protective security obligation in Australian government – the PSPF, Victoria’s VPDSF, Queensland’s IS18 – ultimately rests on one thing: knowing the value of the information you hold. That is what data classification provides. Get it right and your controls are proportionate and your information sharing flows. Get it wrong and you either under-protect sensitive material or strangle the business with needless handling rules.

This guide explains the Australian Government security classification system, how to classify and mark information correctly, and the mistakes that most often trip organisations up.

The classification system at a glance

The Australian Government uses a tiered system that ranks information by the harm that would result if its confidentiality were compromised. From lowest to highest sensitivity:

• OFFICIAL – the baseline for the majority of government information. Routine business with low business impact if compromised.
• OFFICIAL: Sensitive – official information that needs limited dissemination because its compromise would cause limited damage to an individual, organisation or government.
• PROTECTED – information whose compromise would cause damage to the national interest, organisations or individuals.
• SECRET – information whose compromise would cause serious damage.
• TOP SECRET – information whose compromise would cause exceptionally grave damage.

A point that frequently confuses people: OFFICIAL: Sensitive is not a security classification in the same sense as PROTECTED, SECRET and TOP SECRET. It is a dissemination-limiting marker within the OFFICIAL tier. The three security classifications begin at PROTECTED. This distinction matters because it determines the systems, clearances and physical environments required to handle the information.

The practical consequence is significant. Information classified PROTECTED and above must be handled on systems accredited to that level and accessed by people holding the appropriate security clearance, with corresponding physical and personnel controls. OFFICIAL and OFFICIAL: Sensitive information, by contrast, can generally be handled in standard accredited government environments. Misjudging which side of the PROTECTED line information falls on therefore has real cost and access implications, which is exactly why accurate classification at the point of creation is so important.

Classify by business impact, not by caution

The originator – whoever creates the information – is responsible for classifying it. The correct method is a business impact assessment: ask what harm would genuinely result if the confidentiality of this information were compromised, and classify to that level.

The instinct to “play it safe” by classifying upward is one of the most damaging habits in government. Over-classification is not a free safety margin. It drives up handling and storage costs, locks information away from people who legitimately need it, slows decision-making, and breeds cynicism when staff routinely see PROTECTED markings on material that is plainly routine. Conversely, under-classification leaves genuinely sensitive information exposed. The goal is accuracy, not caution.

Aggregation: the trap that changes the answer

A single record may be OFFICIAL, but a database of a million such records can warrant a higher classification because the aggregate could cause far greater harm if compromised. Aggregation is one of the most commonly missed considerations in classification.

Whenever you combine, link or build large collections of information, reassess the classification of the whole rather than assuming it inherits the level of its individual parts. This is especially important for data warehouses, analytics platforms and shared datasets, where the cumulative value is easy to underestimate.

Declassification and review – classifications are not permanent

A classification reflects the sensitivity of information at a point in time, and that sensitivity often falls. A draft policy that is highly sensitive before announcement may be entirely public the day after release. Yet in many organisations information accumulates high classifications indefinitely because no one revisits them, which is one of the largest hidden drivers of over-classification across government.

Good practice is to consider, at the point of classification, whether the information has a natural review or declassification trigger – a date, an event such as a public release, or a defined period after which the sensitivity lapses. Building review into the lifecycle keeps classifications honest and prevents the slow ratchet upward that buries genuinely sensitive material under a mountain of needlessly restricted routine information.

Information management markers

Alongside the classification, you can apply information management markers (IMMs). These are optional markers that flag specific handling requirements – for example, information subject to legal professional privilege, personal privacy considerations, or particular legislative secrecy provisions.

IMMs are not security classifications and do not replace them. They are an additional signal to recipients about how the information must be handled. An OFFICIAL: Sensitive document might also carry a marker indicating it contains personal information, telling recipients to apply privacy-related handling on top of the dissemination limit.

Marking information correctly

Classification only works if it travels with the information. Apply clear, consistent markings so that anyone receiving the information knows immediately how to handle it. In practice this means:

1. Mark the document clearly – the classification should be prominent, conventionally in the header and footer of documents.
2. Mark emails – apply the classification to the subject line and, where tooling allows, as protective markings that downstream systems can read.
3. Carry markings through – extracts, copies and derived material inherit at least the classification of their source, reassessed for aggregation.
4. Mark physical media and assets – removable media and printed material need clear markings too.
5. Review on change – reclassify when the sensitivity of information changes or when it is declassified after a defined period.

Many organisations enforce this through email and document classification tools that prompt or require users to apply a marking before sending or saving. Used well, these tools reduce human error and feed protective markings into data loss prevention and access controls.

Caveats and releasability markings can sit alongside the classification to control dissemination further – for example, limiting distribution to particular audiences or signalling that material is intended for a specific recipient group. These should be applied deliberately and sparingly; like classification itself, over-use of caveats restricts legitimate sharing and erodes the credibility of the markings when staff encounter them on routine material.

How classification drives your controls

Classification is not paperwork for its own sake – it is the input that makes every downstream control proportionate. The level determines:

• Access – who can see the information, and what clearance or need-to-know they require.
• Storage and transmission – the systems, encryption and networks approved to hold and move it.
• Physical security – the environments and containers in which it can be held.
• Disposal – how it must be destroyed at end of life.

This is why classification underpins frameworks across jurisdictions. The PSPF, Victoria’s VPDSF and Queensland’s IS18 all rely on accurate information valuation to set proportionate protection. Technical baselines such as the Essential Eight then apply across the systems that hold this information, with higher-classified environments warranting stronger configurations.

It is worth being clear about what classification protects and what it does not. The security classification system is primarily about confidentiality – the harm from unauthorised disclosure. Information can also carry significant integrity and availability requirements that classification alone does not capture. A public register may be unclassified yet demand strong integrity controls because its accuracy is critical, and an OFFICIAL system underpinning essential services may need robust availability protections regardless of its classification. Treat classification as one input into your control decisions, alongside integrity and availability impact, rather than the single answer.

Building a workable classification culture

The hardest part of classification is not the policy – it is consistent, accurate application by thousands of staff every day. The organisations that do it well invest in three things: clear, practical guidance with worked examples relevant to the agency’s actual work; classification tooling that makes the right choice the easy choice; and ongoing awareness so staff understand that accurate classification is everyone’s job, not just security’s.

If your agency is grappling with inconsistent marking, over-classification or uncertainty about how the system maps to your obligations, an independent review can reset the program. CISO Advisory helps government and council organisations build practical classification schemes and embed them through governance, training and tooling. An ongoing Virtual CISO engagement can keep the program healthy as your information holdings grow – or call 07 2112 8502 for a confidential discussion.