Data classification matrices

Identifies Australian government data-classification matrices that map information categories to classification levels and handling controls. Matrix topics are retained for discovery at 65; Australian PSPF or QGISCF context plus multiple schema fields raises confidence to 75, while a populated category-to-Australian-marking row raises it to 85.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence requires both Australian framework context and several matrix-schema fields rather than generic classification language. High confidence adds a populated category-to-marking relationship using Australian government classification values.

Detection quality

Topic false positive

Jurisdictions

au

Regulations

AML/CTF Act (Cth), HRIPA (Cth), IPA 2009 (Qld), My Health Records Act 2012 (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth), TIA Act 1979 (Cth)

Frameworks

ISO 27001, ISO 27701

Data categories

security

Scope

wide

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:data\s+classification|information\s+classification|data\s+sensitivity|sensitivity\s+classification|classification\s+and\s+handling|protective\s+marking|information\s+security\s+classification)\s+matri(?:x|ces)\b

Corroborative evidence keywords

PSPF, QGISCF, data category, classification level, handling requirement, access restriction, protective marking, OFFICIAL, OFFICIAL:Sensitive, PROTECTED, SECRET, TOP SECRET, CABINET-IN-CONFIDENCE, NOFORN, REL TO, ORCON, National Cabinet, AUSTEO, [object Object], Sensitive: Legal (+13 more)

Proximity: 500 characters

Should match

• The Queensland Government data classification matrix is scheduled for review. — Low-tier probe - Australian matrix topic without schema fields or populated mappings
• Queensland Government data classification matrix: Information type | Classification level | Handling requirement | Access restriction — Medium-tier probe - Australian context and substantive schema without a populated mapping
• QGISCF data classification matrix: Information type | Classification level | Handling requirement | Access restriction; Information type: Cabinet submissions | Classification level: OFFICIAL: Sensitive — High-tier probe - Australian framework, substantive schema, and populated category-to-marking mapping

Should not match

• unrelated generic text without domain phrases — No relevant topic phrases present
• placeholder value 12345 — Random text should not match topic-specific regex
• Enterprise data inventory: information asset | data owner | data steward | system of record | data lineage — Data inventories belong to the adjacent inventory domain
• Data retention and deletion schedule: information type | retention period | disposal method | legal hold — Retention schedules are not classification matrices
• Role-based access control matrix: role | system | permission | approval status — Entitlement matrices do not map information categories to classifications
• The machine-learning report shows a confusion matrix for data classification accuracy. — Statistical model evaluation must not collide with governance matrices
• Corporate data classification matrix: Data category | Classification level | Handling requirement | Access restriction; Data category: Customer records | Classification level: Confidential — Corporate matrix without Australian government context must not enforce
• US Government data classification matrix: Data category | Classification level | Handling requirement | Access restriction; Data category: Source code | Classification level: CUI — United States classification matrix must not enforce as Australian
• New Zealand Government information classification matrix: Information type | Classification level | Handling requirement | Access restriction; Information type: Cabinet papers | Classification level: IN-CONFIDENCE — New Zealand classification matrix must not enforce as Australian
• Public guidance for the Queensland Government data classification matrix: Information type | Classification level | Handling requirement | Access restriction; Information type: Cabinet submissions | Classification level: PROTECTED — Australian public guidance containing a realistic populated row must not enforce
• Training example: QGISCF data classification matrix; Information type | Classification level | Handling requirement; Information type: Cabinet submissions | Classification level: PROTECTED — Structurally complete Australian training content must not enforce

Known false positives

• Australian classification policies, glossaries, public guidance, and awareness material discuss PSPF or QGISCF levels and controls without containing a live matrix. Mitigation: Keep matrix topics discovery-only and require several independent schema fields; reject explicit guidance and training framing from enforcing tiers.
• Data inventories, retention schedules, access-control matrices, and machine-learning confusion matrices use overlapping data, classification, owner, and control terms. Mitigation: Restrict the primary to an explicit classification matrix and reserve high confidence for a populated information-category to classification-level relationship.
• Corporate and overseas government matrices can use the same schema fields and similar classification labels. Mitigation: Require explicit Australian government or framework context and reject named foreign regimes from enforcing tiers.

References

• https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines
• https://www.protectivesecurity.gov.au/