NATO Marking - RESTRICTED / CONFIDENTIAL / SECRET / COSMIC TOP SECRET

Detects NATO security classification markings under the NATO security policy (C-M(2002)49): the spelled-out national-security levels NATO RESTRICTED (NR), NATO CONFIDENTIAL (NC) and NATO SECRET (NS), and the highest level COSMIC TOP SECRET (CTS) — where the codeword COSMIC attaches only to TOP SECRET. ATOMAL caveat markings (NATO CONFIDENTIAL ATOMAL, NATO SECRET ATOMAL, COSMIC TOP SECRET ATOMAL) are covered as suffixes of their parent level marking. Marking syntax verified directly against the International Programs Security Handbook (US-government primary source reproducing NATO security-directive marking rules) and corroborating NATO security briefings; matched case-sensitively so ordinary lowercase prose ("a nato secret") does not trigger it.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence on both forms. "NATO RESTRICTED / CONFIDENTIAL / SECRET" is a case-sensitive two-word phrase whose NATO prefix is itself a strong, low-collision context marker verified against primary sources; "COSMIC TOP SECRET" is a case-sensitive three-word codeword banner unique to NATO's highest classification. The bare two/three-letter abbreviations (NR, NC, NS, CTS, and the ATOMAL abbreviations CTSA/NSA/NCA) are attested marking forms but are deliberately NOT shipped: even hard-gated on NATO context they collide catastrophically with everyday tokens (NSA = National Security Agency, NC/NR = US state/business shorthand, NS = Nova Scotia, CTS = many uses), with no reliable disambiguation — documented as a skip rather than shipped as noise.
Jurisdictions: nato
Regulations: NATO Security Policy C-M(2002)49
Frameworks: NATO Security Policy
Data categories: government, security-classification
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\bNATO[\s-]+(?:RESTRICTED|CONFIDENTIAL|SECRET)\b|\bCOSMIC[\s-]+TOP[\s-]+SECRET\b

Corroborative evidence keywords

NATO, North Atlantic Treaty Organization, COSMIC, ATOMAL, national security

Proximity: 300 characters

Should match

This report is marked NATO SECRET and must be handled per NATO security policy. — Spelled-out NATO SECRET (NS) national-security level — the NATO prefix is strong context
Cover sheet: COSMIC TOP SECRET — access restricted to briefed personnel only. — COSMIC TOP SECRET (CTS) codeword banner, NATO's highest level
The annex is classified NATO CONFIDENTIAL ATOMAL and covers released atomic information. — ATOMAL caveat form — matched via its parent level marking NATO CONFIDENTIAL (NC)
Distribution list for the NATO RESTRICTED briefing pack is attached. — NATO RESTRICTED (NR), the lowest NATO classified level
Header reads COSMIC TOP SECRET ATOMAL for the working-group papers. — PDF line-wrap between COSMIC and TOP SECRET (the [\s-]+ separator tolerates a wrap-inserted newline); ATOMAL suffix rides on the COSMIC TOP SECRET match

Should not match

the nato secret was leaked to a journalist last spring, allegedly — lowercase prose (case-sensitive exclusion — the marking regex only matches ALL-CAPS tokens)
THE NSA REGULARLY MONITORS NATO COMMUNICATIONS ACROSS THE ALLIANCE — ALL-CAPS prose naming NSA (the agency) and NATO but with no marking — fails at the regex level (NATO is followed by COMMUNICATIONS, not a level word; the NSA abbreviation is deliberately not a shipped marking form)
THE SUMMIT WILL COVER COSMIC BACKGROUND RADIATION AND OTHER TOP RESEARCH TOPICS — ALL-CAPS prose containing COSMIC and TOP but not the contiguous COSMIC TOP SECRET banner — fails at the regex level

Known false positives

ALL-CAPS prose (headings, legal boilerplate, or documents rendered entirely in capitals) defeats the case-sensitivity signal; an all-caps rendering of "NATO SECRET" or "COSMIC TOP SECRET" with no marking intent (e.g. a headline or book title) can fire. Mitigation: Treat hits as lower confidence when the surrounding text is itself all-caps. The NATO/COSMIC prefixes keep collision low relative to bare classification words, and the corroborative NATO/COSMIC/ATOMAL keywords within 300 characters reinforce genuine marking context.
The bare NATO classification abbreviations (NR, NC, NS, CTS) and the ATOMAL abbreviations (CTSA, NSA, NCA) are real, verified marking forms but are not implemented: they are two/three-letter tokens that collide with extremely common non-marking uses (NSA = National Security Agency, NS = Nova Scotia, NC/NR = US-state and business shorthand, CTS = numerous), and no jurisdiction gate can reliably separate a genuine NATO marking abbreviation from these. Mitigation: Documented as a deliberate coverage gap rather than shipped as ungovernable noise. The spelled-out NATO <LEVEL> and COSMIC TOP SECRET forms capture the same marking vocabulary at high confidence.
NATO UNCLASSIFIED (NU) is a NATO marking but is a releasability/handling designation, NOT one of the four NATO classification levels (RESTRICTED and above) per C-M(2002)49; it is deliberately excluded from the level regex because it denotes releasable/unclassified content, carries little data-loss value, and would only broaden matches. Mitigation: Out of scope by design; this SIT targets protectively-marked (RESTRICTED and above) NATO content.
This SIT's SECRET / TOP SECRET / CONFIDENTIAL vocabulary overlaps with the US/UK/NZ/AU marking families, but the mandatory NATO or COSMIC prefix means a genuine NATO marking will not, on the prefix alone, co-fire those nations' bare-word tiers; conversely a document carrying both a NATO marking and a national marking is expected to fire both SITs as corroborating signals. Mitigation: No mitigation needed — the prefix makes the NATO forms structurally distinct from the national bare-word markings.