Australian Marking - SECRET / TOP SECRET

Detects the Australian Government SECRET and TOP SECRET security classifications in both email and document forms. Intended to surface content that should not be stored on the platform (these classifications roll up to the PROTECTED label in au-marking-protected for handling, while this SIT flags them for remediation). Matched case-sensitively.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence: case-sensitive uppercase SECRET / TOP SECRET plus the structured SEC= form. The lowercase English word "secret" is excluded by case.

Detection quality

Mixed

Jurisdictions

au

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

PSPF

Data categories

government, security-classification

Scope

narrow

Risk rating

10

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:TOP[\s-]+)?SECRET\b

Corroborative evidence keywords

PSPF, protective marking, Australian Government

Proximity: 300 characters

Should match

• Document footer candidate TOP SECRET — Low-tier probe - uppercase candidate without a formal marking field
• Security Classification: SECRET — Medium-tier probe - formal security-classification field without a complete header
• Subject [SEC=TOP-SECRET] — Operational email subject marking reaches the balanced tier
• Australian Government PSPF briefing TOP SECRET — Medium-tier probe - standalone banner corroborated by explicit government marking context
• X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=TOP-SECRET — High-tier probe - complete Australian protective-marking header

Should not match

• the secret ingredient is a pinch of salt — lowercase English word (case-sensitive exclusion)
• this is top secret information, allegedly — lowercase phrase (case-sensitive exclusion)
• Briefing [SEC=PROTECTED] — PROTECTED belongs to au-marking-protected
• ROTATE THE API SECRET KEY QUARTERLY — API-secret collocation is not a government marking
• TOP SECRET RECIPE - PUBLIC COOKING EVENT — Incidental uppercase title must not enforce
• Public marking guide: Security Classification: SECRET — Public guidance quotes a formal secret marking
• Template example: X-Protective-Marking: VER=2024.1, NS=gov.au, SEC=TOP-SECRET — Template contains a complete formal header

Known false positives

• Uppercase SECRET / TOP SECRET in titles or marketing (e.g. a film title). Mitigation: Explicit PSPF/QGISCF government context or a structured marking field is required above discovery; the complete header remains the strict 85 path.
• ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare SECRET / TOP SECRET banner relies on — any all-caps rendering of the word can fire with no protective-marking intent. Mitigation: Treat uncorroborated banner hits as discovery inventory; structured or explicitly government-corroborated markings enforce at 75.

Collections

• Government Protective Markings