Australian Marking - PROTECTED

Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: case-sensitive uppercase PROTECTED plus the structured SEC= form make this a reliable marking detector. The English word "protected" (lowercase) is excluded by case.
Detection quality: Mixed
Jurisdictions: au
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: PSPF, QGISCF
Data categories: government, security-classification
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\bPROTECTED\b

Corroborative evidence keywords

PSPF, protective marking, Australian Government

Proximity: 300 characters

Should match

Document footer candidate PROTECTED — Low-tier probe - uppercase candidate without a formal marking field
Classification: PROTECTED — Medium-tier probe - formal classification field without a complete header
Subject [SEC=PROTECTED] — Operational email subject marking reaches the balanced tier
Australian Government PSPF briefing PROTECTED — Medium-tier probe - standalone banner corroborated by explicit government marking context
X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET — High-tier probe - complete Australian protective-marking header with caveat
Security Classification: SECRET — Formal SECRET marking rolls up into PROTECTED handling at the medium tier

Should not match

wetlands are a protected area under the act — lowercase English word (case-sensitive exclusion)
the configuration file is UNPROTECTED — UNPROTECTED must not match PROTECTED
Memo [SEC=OFFICIAL] — OFFICIAL belongs to au-marking-official
ROTATE THE API SECRET KEY QUARTERLY — SECRET-collocation excluded from the SECRET roll-up tier by the secret-collocation NOT group
PROTECTED SPECIES - PUBLIC CONSERVATION NOTICE — Incidental uppercase prose must not enforce
Public marking guide: Classification: PROTECTED — Public guidance quotes a formal marking field
Template example: X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET — Template contains a complete formal header

Known false positives

Uppercase PROTECTED in non-marking contexts (e.g. "PROTECTED SPECIES"). Mitigation: Explicit PSPF/QGISCF government context or a structured marking field is required above discovery; the complete header remains the strict 85 path.
ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare PROTECTED/SECRET banners rely on — any all-caps rendering of the word can fire with no protective-marking intent. Mitigation: Treat uncorroborated banner hits as discovery inventory; structured or explicitly government-corroborated markings enforce at 75.

Collections

Government Protective Markings