New Zealand Marking - SECRET / TOP SECRET

Detects the New Zealand Government SECRET and TOP SECRET national-security classifications under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator ((TOP )SECRET//..., e.g. SECRET//NZEO, TOP SECRET//REL TO NZL, FVEY), the TOP SECRET banner-words phrase (tolerant of a hyphen or PDF-line-wrap-inserted whitespace between TOP and SECRET), and a New Zealand government/PSR-context-gated bare SECRET banner. Deliberately omits a SEEMail square-bracket trigger-word tier: the complete SEEMail bracket trigger-word set is [SEEMAIL]/[TRUSTED]/[RESTRICTED]/[SENSITIVE]/[IN-CONFIDENCE], all at or below SEEMail's own RESTRICTED-tier service ceiling, so [SECRET]/[TOP SECRET] bracket forms are structurally implausible and unattested. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence on the `//` national-security-marking form and the TOP SECRET banner-words phrase: both are structurally distinctive, case-sensitive tokens with low natural-English collision risk, and the `//` separator convention is directly verified against the official PSR marking-format guidance (not inferred). The bare SECRET banner (75) is a common English word used constantly outside government context (TRADE SECRET, API SECRET, SECRET MANAGER, etc.), so it is the widest tier and is gated by New Zealand government/PSR corroborative evidence plus a dedicated NOT-exclusion for the most common non-government collocations.
Jurisdictions: nz
Regulations: Privacy Act 2020 (NZ)
Frameworks: PSR
Data categories: government, security
Scope: narrow
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:TOP[\s-]+)?SECRET//[A-Z]|\bTOP[\s-]+SECRET\b

Corroborative evidence keywords

New Zealand, PSR, Protective Security Requirements, Cabinet

Proximity: 300 characters

Should match

This cable is classified SECRET//NZEO — release restricted to New Zealand Eyes Only recipients. — Verified national-security marking format — SECRET classification with the NZEO (New Zealand Eyes Only) dissemination marking, double-forward-slash separated per PSR marking-format guidance
Document banner reads TOP SECRET — PDF line-wrap between TOP and SECRET (the banner-words tier tolerates a wrap-inserted newline)
Cover sheet marked TOP-SECRET for distribution to accredited staff only. — Hyphen-separated TOP-SECRET banner-words form
This SECRET briefing must be handled under New Zealand Government PSR requirements. — Gated bare-banner form — New Zealand government/PSR corroborative evidence present within 300 characters

Should not match

THE TRADE SECRETS ACT 1996 defines what constitutes a TRADE SECRET in commercial contexts, unrelated to any government classification. — Collocation NOT — the standalone "SECRET" in "TRADE SECRET" is excluded by the secret-collocation NOT-group (and this text also lacks New Zealand government/PSR context, a second independent defense)
please keep this a secret between us until the announcement — lowercase English word (case-sensitive exclusion)
SECRET SANTA GIFT EXCHANGE — sign-up sheet posted in the break room — bare tier excluded by the missing New Zealand government/PSR AND-gate (no corroborative context nearby); documented as a residual false-positive risk if such context coincidentally appears nearby in a real document
Deployment log line: https://ci.internal.contoso-corp.net/artifacts/SECRET//project-report.json was reviewed by the release team. — URL/path artifact — the `//`-tier's [A-Z] guard rejects the lowercase "p" following the separator (SECRET//project-report...); the bare-SECRET gated tier is separately excluded by the missing New Zealand government/PSR context

Known false positives

ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare SECRET banner tier relies on. Mitigation: Treat banner-tier-only (75) hits as lower confidence when the surrounding text is itself all-caps; the `//` tier and banner-words tier (both 85) remain the reliable signal.
SECRET is an extremely common English word in everyday non-government usage (TRADE SECRET(S), CLIENT SECRET, API SECRET, SECRET MANAGER), all of which are more common in general text than the PSR classification marking. Mitigation: The bare tier (75) requires New Zealand government/PSR corroborative evidence and excludes this collocation set via a dedicated NOT-group. The `//` and banner-words tiers (both 85) are unaffected — they are structurally distinctive and do not require the gate.
A [SECRET] or [TOP SECRET] SEEMail-style square-bracket trigger word is not shipped. SEEMail's confirmed bracket trigger-word set — [SEEMAIL], [TRUSTED], [RESTRICTED], [SENSITIVE], [IN-CONFIDENCE] (verified directly against the PSR marking-guidance page) — tops out at RESTRICTED/SENSITIVE (the "Restricted group" service tier), so SEEMail structurally cannot carry SECRET or TOP SECRET-classified content in the first place. This is a stronger case than nz-marking-confidential's unattested-bracket omission: there, no source attested [CONFIDENTIAL] as a real convention; here, the service's own classification ceiling rules it out entirely. Mitigation: No mitigation needed — this is a documented coverage decision, not a gap. Any "[SECRET]"/"[TOP SECRET]" bracket found in the wild would not be a genuine SEEMail marking.
This SIT's gated bare-SECRET tier (75) shares vocabulary with two Australian SITs: au-marking-secret-topsecret's own SECRET/TOP SECRET banner tier (85, ungated apart from the noise-exclusion NOT-group) and au-marking-protected's SECRET roll-up tier (85, also ungated apart from noise/collocation NOT-groups — neither AU tier requires positive AU government context). A genuine New Zealand SECRET or TOP SECRET document will therefore typically co-fire both AU SITs as well, since their bare-SECRET tiers have no jurisdiction gate of their own. Mitigation: Deploy policies should expect this cross-jurisdiction triple-hit and treat the SITs as corroborating, not conflicting, signals; do not add an NZ-context exclusion to the AU SITs, as that would break their own intended (broader) coverage.
New Zealand's SECRET//... and TOP SECRET//... marking format is interoperable with the Five-Eyes REL TO convention, so genuine hits with a US-recognized control token (e.g. SECRET//REL TO NZL, FVEY) also fire the existing us-classification-banner pattern, whose alternation includes SECRET and TOP SECRET with the same separator syntax. This co-fire is expected and correct — both SITs are identifying the same interoperable classification banner. (A dissemination marking not in us-classification-banner's control-token alternation, e.g. the NZEO-only example above, will not co-fire it.) Mitigation: Deploy policies should expect the double-hit and treat the SITs as corroborating, not conflicting, signals.

Collections

NZ Protective Markings