Australian Marking - SECRET / TOP SECRET

Detects the Australian Government SECRET and TOP SECRET security classifications in both email and document forms. Intended to surface content that should not be stored on the platform (these classifications roll up to the PROTECTED label in au-marking-protected for handling, while this SIT flags them for remediation). Matched case-sensitively.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: case-sensitive uppercase SECRET / TOP SECRET plus the structured SEC= form. The lowercase English word "secret" is excluded by case.
Jurisdictions: au
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: PSPF
Data categories: government, security-classification
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:TOP[ -])?SECRET\b

Corroborative evidence keywords

PSPF, protective marking, Australian Government

Proximity: 300 characters

Should match

Cover sheet [SEC=TOP-SECRET] — Email subject marking (TOP-SECRET)
Annex [SEC=SECRET] — Email subject marking (SECRET)
Document banner reads TOP SECRET — TOP SECRET banner
This page is marked SECRET — SECRET banner

Should not match

the secret ingredient is a pinch of salt — lowercase English word (case-sensitive exclusion)
this is top secret information, allegedly — lowercase phrase (case-sensitive exclusion)
Briefing [SEC=PROTECTED] — PROTECTED belongs to au-marking-protected

Known false positives

Uppercase SECRET / TOP SECRET in titles or marketing (e.g. a film title). Mitigation: Structured SEC= tier at 95; corroborative PSPF/government evidence raises banner confidence.