U.S. National Security Classification Banner

Detects U.S. national-security classification banner and portion markings (per Executive Order 13526 and the Intelligence Community marking system): a classification level — TOP SECRET, SECRET, CONFIDENTIAL — followed by one or more "//"-separated control or dissemination markings (SI, TK, HCS, SCI, SAP, NOFORN, ORCON, REL TO ...), or a parenthetical portion mark such as (S//NF) or (TS//SI). The bare words "secret" and "confidential" are far too common to match alone, so a match requires the "//" control structure or a parenthetical portion mark.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the "//" control structure and the parenthetical portion-mark syntax are unique to U.S. classification banners. Requiring the structure prevents the common English words "secret" and "confidential" from triggering matches.
Jurisdictions: us
Regulations: Executive Order 13526, NIST SP 800-53, FISMA
Frameworks: NIST CSF, ISO 27001, SOC 2
Data categories: government, security-classification
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:TOP SECRET|SECRET|CONFIDENTIAL|TS|S|C)//(?:SI|TK|HCS|SCI|SAP|NOFORN|NF|ORCON|OC|FGI|RD|FRD)(?://(?:SI|TK|HCS|SCI|SAP|NOFORN|NF|ORCON|OC|FGI|RD|FRD)){0,4}\b|\b(?:TOP SECRET|SECRET|CONFIDENTIAL|TS|S|C)//REL TO [A-Z]{2,5}(?:,[ ]?[A-Z]{2,5}){0,5}\b

Corroborative evidence keywords

classification, classified, top secret, secret, confidential, NOFORN, ORCON, REL TO, SCI, sensitive compartmented information, declassify on, derived from, portion marking

Proximity: 300 characters

Should match

TOP SECRET//SI//NOFORN
Header: SECRET//REL TO USA, FVEY
(TS//SI//NF)
S//REL TO USA,FVEY
C//NOFORN

Should not match

This information is secret and must stay confidential
CONFIDENTIAL business plan attached
CUI//SP-PRVCY//NOFORN

Known false positives

Templates, training decks, or marking guides that quote example banners (TOP SECRET//SI) for instructional purposes rather than marking real classified content. Mitigation: Require corroborative classification keywords (declassify on, derived from, portion marking) and exclude known training-material file paths.
Fiction, news reporting, or historical documents reproducing classification banners. Mitigation: Layer with document-source metadata to distinguish operational documents from published/quoted content.

References

Collections

Government Protective Markings