Understand the Protective Security Policy Framework (PSPF)

The PSPF requires Australian Government entities to follow specific security practices. These practices protect the government’s people, information and resources. PSPF requirements include how information is classified and marked, and what this means for its:

• storage
• handling
• access
• disposal.

Refer to your organisation’s protective security policy. It shows you how to apply PSPF requirements.

Implementation of the PSPF by government entities is supported by the Department of Home Affairs.

For more information, consult:

• PSPF annual release – sets out what government entities must do
• PSPF guidelines – best-practice advice for implementing the PSPF annual release
• PSPF standards, including the Australian Government email protective marking standard.
• Standards that other ‘controlling authorities’ manage, including the Australian Government recordkeeping metadata standard.

Add markings to government information

All information from government business operations and services is given a marking under the PSPF. Some are mandatory markings and others are optional.

Always follow your organisation’s internal procedures when applying markings. Your organisation may instruct you to apply optional markings.

Security classifications

There are 4 levels of security classification:

• OFFICIAL: Sensitive
• PROTECTED
• SECRET
• TOP SECRET.

Use all capitals for these markings, except for OFFICIAL: Sensitive which uses all capitals and an initial capital.

Security classification markings are ‘protective markings’.

Security classification protective markings are mandatory. All ‘security classified information‘, including emails, must carry protective markings. You must also mark information metadata.

Protective markings set minimum requirements for how information is accessed, stored and communicated.

Other government information

All other information is marked as either:

• OFFICIAL – a routine level of protection
• UNOFFICIAL – information that is not part of official government duties e.g. personal emails.

Use all capitals for OFFICIAL and UNOFFICIAL.

OFFICIAL and UNOFFICIAL are not security classifications and are optional markings.

OFFICIAL is a protective marking. Information marked as OFFICIAL has minimal requirements for how it can be accessed, stored and communicated.

Information management markers (IMMs)

IMMs include:

• Legal Privilege
• Legislative Secrecy
• Personal Privacy.

Use initial capitals (title case) for IMMs.

IMMs identify information with access or use restrictions that are not related to security. They are not protective markers or security classifications.

IMMs are optional markings. To assess when and how you should apply IMMs, consult:

• your organisation’s procedures
• PSPF annual release
• PSPF guidelines.

Security caveats

Security caveat markings include:

• EXCLUSIVE FOR (named person)
• CABINET
• AUSTEO – ‘Australian Eyes Only’
• AGAO – ‘Australian Government Access Only’
• REL – ‘Releasable to’ e.g. REL AUS/CAN/GBR/NZL/USA.

Use all capitals for security caveats.

Various government ‘controlling authorities’ manage and administer security caveats.

Security caveats identify information that has extra handling requirements, beyond existing security restrictions.

Security caveats are not security classifications. But they must only appear with a security classification.

Use text-based markings

The PSPF requires security classified information to be clearly marked with text-based markings. This applies unless text-based markings are impractical for operational reasons.

To achieve clear markings, the PSPF recommends that you:

• use recommended capitalisation, bolded text, large fonts and a distinctive colour (red preferred)
• place markings at the centre top and centre bottom of each page
• separate different types of markings and security caveats with unspaced double forward slashes
• arrange markings and place optional IMMs as shown in the example that follows.

Example

Image of ‘Figure 10: Marking physical (printed) information’, PSPF guidelines 2026, p 124. Provided by and courtesy of: Department of Home Affairs.

Colour-based marking

When you can’t use text-based marking, use an alternative colour-based marking. For more information, consult ‘9.2.3.2: Colour-based markings’ in PSPF guidelines.

Follow PSPF capitalisation style for markings in body text

Use the PSPF capitalisation style when you mention a marking in your content.

PSPF style makes the marking easy to spot in the text. It also helps users distinguish between a marking and the same words used descriptively.

It’s optional to use quotation marks around a protective marking the first time you mention it in body text.

Style Manual recommends using quotation marks at first mention to make technical terms stand out in non-technical content. However, PSPF capitalisation already ensures markings stand out in sentences. We have chosen not to use quote marks on this page.

But we do recommend using quotation marks for protective markings that follow expressions such as ‘stamped’, ‘marked’, ‘titled’, ‘defined as’ and ‘the term’.

Use non-breaking spaces

Use non-breaking spaces in protective markings and security clearances that contain 2 or 3 elements. This ensures that all elements stay together on one line.

You can insert a non-breaking space using the Unicode character U+00A0.

In HTML, use the entity   to insert a non-breaking space.

The keyboard shortcut in Word is Ctrl+Shift+Spacebar.