Canada Marking - Protected A/B/C + Classified

Detects Government of Canada protective markings under the Treasury Board Standard on Security Categorization (Appendix J of the Directive on Security Management): the Canada-distinctive "Protected" designations Protected A / Protected B / Protected C (information whose compromise could injure interests outside the national interest), and the classified levels Confidential / Secret / Top Secret (injury to the national interest). "Protected A/B/C" is unique to Canada and matched at high confidence in both title-case and ALL-CAPS renderings; the classified words are shared vocabulary with other nations and are matched only at lower, Canada-government-context-gated tiers. Rendering verified directly against the Treasury Board Standard on Security Categorization; matched case-sensitively.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence on the "Protected A/B/C" designation: the word Protected (leading capital) immediately followed by a single bare A, B or C is a structurally distinctive, Canada-unique marking with negligible natural-language collision, verified against the Treasury Board Standard on Security Categorization; matched case-sensitively so lowercase "protected b" cannot fire, and constrained by a trailing word boundary so "Protected Areas"/"Protected Building" cannot fire. The classified words CONFIDENTIAL, SECRET and TOP SECRET are shared Five-Eyes vocabulary and extremely collision-prone, so — following this SIT's Canada-specific role — they are placed at lower tiers gated by Canada-government corroborative evidence within 300 characters (TOP SECRET at 75 as a distinctive two-word phrase; bare CONFIDENTIAL/SECRET at 65) plus, for the bare words, a dedicated collocation NOT-group.

Jurisdictions

ca

Regulations

Directive on Security Management (Canada)

Frameworks

Policy on Government Security

Data categories

government, security-classification

Scope

narrow

Risk rating

9

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:PROTECTED|Protected)[\s-]+[ABC]\b

Corroborative evidence keywords

Government of Canada, Treasury Board, Policy on Government Security, RCMP, national security

Proximity: 300 characters

Should match

• This record is designated Protected B under the Treasury Board Standard on Security Categorization. — Canada-distinctive Protected B designation in policy title-case
• Cover sheet stamped PROTECTED C — extremely sensitive personal information, handle accordingly. — Protected C in ALL-CAPS banner rendering
• The briefing note is classified TOP SECRET and was prepared for the Government of Canada Privy Council Office. — Gated bare TOP SECRET — Canada-government corroborative context (Government of Canada, Privy Council Office) present within 300 characters
• This SECRET memorandum must be handled per the Government of Canada Directive on Security Management. — Gated bare SECRET — Canada-government corroborative context (Government of Canada, Directive on Security Management) present within 300 characters
• Marking: Protected-A applied to the salary schedule in the personnel file. — Protected-A with a hyphen separator (the [\s-]+ separator tolerates a hyphen before the level letter)

Should not match

• please keep these files protected and do not disclose anything secret without approval — lowercase prose (case-sensitive exclusion — neither "protected" nor "secret" is capitalised as a marking)
• PROTECTED AREAS OF THE NATIONAL PARK REQUIRE A PERMIT FROM PARKS CANADA — ALL-CAPS prose — "PROTECTED A" is followed by the rest of "AREAS" (no word boundary after the A), so it fails at the regex level
• THE COMPANY'S TRADE SECRET FORMULA IS CONFIDENTIAL AND STORED UNDER AN NDA — ALL-CAPS non-government collocation — excluded from the top-level Protected pattern (no PROTECTED A/B/C) and from the gated bare tier by the TRADE SECRET NOT-group

Known false positives

• ALL-CAPS prose (headings, legal boilerplate, or fully-capitalised documents) defeats the case-sensitivity signal the bare TOP SECRET / SECRET / CONFIDENTIAL tiers rely on — any all-caps rendering with no marking intent can fire those gated tiers if Canada-government context also happens to be present. Mitigation: Treat gated-tier (65/75) hits as lower confidence when the surrounding text is itself all-caps. The Protected A/B/C tier (85) is structurally distinctive and does not depend on the context gate.
• The classified words CONFIDENTIAL, SECRET and TOP SECRET are shared Five-Eyes vocabulary already covered by the US/UK/NZ/AU marking families; a genuine Canadian classified document is expected to co-fire those SITs. This SIT deliberately gates its classified-word tiers on Canada-government context so its distinctive contribution is the Canada-unique Protected A/B/C designation rather than redundant broad firing on generic classification words. Mitigation: Deploy policies should treat cross-jurisdiction co-fire on the shared classified words as corroborating, not conflicting; do not remove the Canada-context gate, which is what keeps this SIT's classified tiers precise.
• The title-case "Protected A/B/C" form has a small residual: rare constructions such as "Protected A-list" or a standalone "Protected A" heading followed by a boundary can match without marking intent. "Protected Area(s)", "Protected Building", and similar are NOT affected — the trailing word boundary requires the A/B/C to stand alone. Mitigation: Residual is rare and low-impact; the template/noise NOT-exclusion suppresses sample/training content, and the ALL-CAPS banner rendering (the dominant real-world marking form) is unambiguous.
• Coverage gap (false negative, not false positive): the bare classified tiers (CONFIDENTIAL / SECRET / TOP SECRET) match ALL-CAPS only. Treasury Board policy text and many banners also render these in Title Case (Top Secret, Secret, Confidential); Title-Case classified banners are therefore NOT detected. Deliberate precision tradeoff — a bare title-case "Secret"/"Confidential" is un-gateable everyday English. The Protected A/B/C tier (85) matches both title-case and ALL-CAPS, so only the shared classified words carry this recall gap. Mitigation: Accepted recall tradeoff; ALL-CAPS banners are the dominant high-assurance rendering, and Canadian classified content is independently covered by the US/UK/NZ/AU marking SITs.
• French-language Government of Canada markings (Protégé A/B/C, Confidentiel, Secret, Très secret) are applied per-document-language, NOT co-rendered bilingually the way EUCI markings are. They are not implemented here: the Treasury Board Standard's English text defines the English terms, and verifying the exact French banner rendering from a French primary source was out of scope for this release. Mitigation: Documented as a known coverage gap for French-language Canadian documents rather than authored from assumption; the English designations and classified words are the verified, shipped forms.

References

• Directive on Security Management, Appendix J: Standard on Security Categorization — Treasury Board of Canada Secretariat