Australian Marking - PROTECTED

Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: case-sensitive uppercase PROTECTED plus the structured SEC= form make this a reliable marking detector. The English word "protected" (lowercase) is excluded by case.
Jurisdictions: au
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: PSPF, QGISCF
Data categories: government, security-classification
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\bPROTECTED\b

Corroborative evidence keywords

PSPF, protective marking, Australian Government

Proximity: 300 characters

Should match

Briefing [SEC=PROTECTED] — Email subject marking
X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET — x-header with CABINET caveat (swept into PROTECTED)
This file is classified PROTECTED — Document banner
Annex marked SECRET by the agency — SECRET rolls up into the PROTECTED label

Should not match

wetlands are a protected area under the act — lowercase English word (case-sensitive exclusion)
the configuration file is UNPROTECTED — UNPROTECTED must not match PROTECTED
Memo [SEC=OFFICIAL] — OFFICIAL belongs to au-marking-official

Known false positives

Uppercase PROTECTED in non-marking contexts (e.g. "PROTECTED SPECIES"). Mitigation: Structured SEC= tier at 95; corroborative PSPF/government evidence raises banner confidence.