Australian Marking - OFFICIAL

Detects the Australian Government OFFICIAL protective marking (PSPF / QGISCF) in both email forms ([SEC=OFFICIAL] subject markings, X-Protective-Marking headers) and visible document banners. Excludes UNOFFICIAL and OFFICIAL: Sensitive (handled by au-marking-sensitive). Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively so the lowercase English word "official" does not trigger.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence: case-sensitive uppercase OFFICIAL plus the structured SEC= form make this a reliable marking detector. The English word "official" (lowercase) is excluded by case.

Detection quality

Mixed

Jurisdictions

au

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

PSPF, QGISCF

Data categories

government, security-classification

Scope

narrow

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

\bOFFICIAL\b(?!(?:[ ]|:[ ]?|[ ]?//[ ]?)Sensitive)

Corroborative evidence keywords

PSPF, protective marking, Australian Government

Proximity: 300 characters

Should match

• Document footer candidate OFFICIAL — Low-tier probe - uppercase candidate without a formal marking field
• Classification: OFFICIAL — Medium-tier probe - formal classification field without a complete header
• Subject [SEC=OFFICIAL] — Operational email subject marking reaches the balanced tier
• Queensland Government QGISCF briefing OFFICIAL — Medium-tier probe - standalone banner corroborated by explicit government marking context
• X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=OFFICIAL — High-tier probe - complete Australian protective-marking header

Should not match

• visit our official website for more information — lowercase English word (case-sensitive exclusion)
• Report [SEC=OFFICIAL:Sensitive] — OFFICIAL Sensitive belongs to au-marking-sensitive
• This email is UNOFFICIAL — UNOFFICIAL must not match OFFICIAL
• Doc marked OFFICIAL // Sensitive — the // form of OFFICIAL Sensitive belongs to au-marking-sensitive
• OFFICIAL WEBSITE - PUBLIC INFORMATION — Incidental uppercase prose must not enforce
• Public marking guide: Classification: OFFICIAL — Public guidance quotes a formal marking field
• Template example: X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=OFFICIAL — Template contains a complete formal header

Known false positives

• Uppercase use of OFFICIAL in non-marking contexts (e.g. "OFFICIAL OPENING"). Mitigation: Explicit PSPF/QGISCF government context or a structured marking field is required above discovery; the complete header remains the strict 85 path.
• ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare OFFICIAL banner relies on — any all-caps rendering of the word can fire with no protective-marking intent. Mitigation: Treat discovery-only banner hits as inventory; the structured field and government-corroborated paths at 75 are the balanced enforcement signals.

Collections

• Government Protective Markings