Security Marking

A security marking is a label applied to information to identify its security classification, sensitivity or handling restrictions. It tells everyone who handles the information what level of protection it requires. The Treasury Board policy on security says markings are applied to alert users to the level of protection that should be applied to information. Treasury Board policy

The term is used in Canadian information-security policy, in federal contract-security practice and in NATO information-management rules. It covers physical and electronic information, media and storage devices, and in some circumstances covering or transmittal material. Related terms include security classification, protected information, classified information, NATO Classified Information, NATO UNCLASSIFIED, dissemination limitation marking and security classification guide.

When Treasury Board policy requires a marking

Treasury Board policy requires security markings to be applied when information is created or collected. The marking reflects the security category assigned to the information and any applicable caveats. The policy applies to information in both physical and electronic form. Where required, it also applies to electronic media and storage devices that contain sensitive information. Treasury Board policy on security

The same policy requires departments to identify and document security requirements for contracts and information-sharing arrangements. These requirements are based on the sensitivity of the information, assets or sites to which individuals need access, as well as the work location and type of work.

Marking rules in the PSPC Contract Security Manual

Public Services and Procurement Canada (PSPC) runs the Contract Security Program. Federal contracts that involve protected or classified information require that information and assets be marked and handled according to their sensitivity and medium. The Contract Security Manual has a dedicated section on security markings.

The manual sets out several specific rules:

• Protected and classified information must be appropriately marked.
• Covering or transmittal letters, forms and circulation slips must indicate the highest category or designation of the material attached to them.
• Information from NATO, foreign governments, the European Union or the European Space Agency must bear both the originating classification marking and an annotation identifying its Canadian equivalent.

PSPC's guidance on work site security requirements adds that paper and electronic information should be marked to identify it as protected or classified. Organizations should follow government standards when they mark it.

PSPC's security requirement checklists provide for a security classification guide where multiple screening levels are identified. The checklist also records the categories and levels of safeguarding required at a supplier's premises.

NATO classification markings

NATO identifies four principal security classifications: COSMIC TOP SECRET (CTS), NATO SECRET (NS), NATO CONFIDENTIAL (NC) and NATO RESTRICTED (NR). They indicate progressively different levels of potential harm from unauthorized access or disclosure. NATO security policy

NATO states that classification markings indicate the sensitivity of classified information and the security procedures and regulations that apply to its protection. NATO security directive

NATO information that carries no security classification may still be marked NATO UNCLASSIFIED (NU). It may also carry administrative or dissemination-limitation markings, as described in NATO's policy on the management of non-classified information.

Markings also appear in NATO solicitations and contract-security clauses. In one NATO security clause, removable media containing NATO RESTRICTED information must be labelled with that classification marking. NATO ACT security clause

What security markings mean for a supplier bidding on Canadian contracts

If a contract involves protected or classified information, your firm is responsible for marking and handling that information according to the Contract Security Manual. Read the security requirements and checklist attached to a solicitation before you bid. They show the categories and levels of safeguarding that apply at your premises.

Plan for marking on every format you will handle, including paper, electronic files, removable media and storage devices. Transmittal letters and cover forms must show the highest designation of what they carry. If the work involves NATO or foreign-government information, make sure your procedures include both the originating marking and the Canadian-equivalent annotation.