ASD's Blueprint for Secure Cloud

Add PSPF X-Header and Subject Marking

This section describes the configuration of data loss prevention policies within Microsoft Purview associated with systems built according to guidance in ASD's Blueprint for Secure Cloud.

Estimated reading time: 28 minutes

Name

ItemValue
NameAdd PSPF X-Header and Subject Marking
DescriptionThis DLP policy is intended to apply X-Protective-Marking X-headers and subject markings to emails

Admin units

ItemValue
Admin unitsFull directory

Locations

ItemValue
Exchange emailAll users and groups
SharePoint sites
OneDrive accounts
Teams chat and channel messages
Devices
Instances
On-premises repositories
Power BI workspaces

Advanced DLP rules

  • UNOFFICIAL append subject
  • UNOFFICIAL add x-header
  • OFFICIAL append subject
  • OFFICIAL add x-header
  • OFFICIAL Sensitive append subject
  • OFFICIAL Sensitive add x-header
  • OFFICIAL Sensitive Legal-Privilege append subject
  • OFFICIAL Sensitive Legal-Privilege add x-header
  • OFFICIAL Sensitive Legislative-Secrecy append subject
  • OFFICIAL Sensitive Legislative-Secrecy add x-header
  • OFFICIAL Sensitive Personal-Privacy append subject
  • OFFICIAL Sensitive Personal-Privacy add x-header
  • OFFICIAL Sensitive NATIONAL-CABINET append subject
  • OFFICIAL Sensitive NATIONAL-CABINET add x-header
  • OFFICIAL Sensitive NATIONAL-CABINET Legal-Privilege append subject
  • OFFICIAL Sensitive NATIONAL-CABINET Legal-Privilege add x-header
  • OFFICIAL Sensitive NATIONAL-CABINET Legislative-Secrecy append subject
  • OFFICIAL Sensitive NATIONAL-CABINET Legislative-Secrecy add x-header
  • OFFICIAL Sensitive NATIONAL-CABINET Personal-Privacy append subject
  • OFFICIAL Sensitive NATIONAL-CABINET Personal-Privacy add x-header
  • PROTECTED
  • PROTECTED Legal-Privilege append subject
  • PROTECTED Legal-Privilege add x-header
  • PROTECTED Legislative-Secrecy append subject
  • PROTECTED Legislative-Secrecy add x-header
  • PROTECTED Personal-Privacy append subject
  • PROTECTED Personal-Privacy add x-header
  • PROTECTED NATIONAL-CABINET append subject
  • PROTECTED NATIONAL-CABINET add x-header
  • PROTECTED NATIONAL-CABINET Legal-Privilege append subject
  • PROTECTED NATIONAL-CABINET Legal-Privilege add x-header
  • PROTECTED NATIONAL-CABINET Legislative-Secrecy append subject
  • PROTECTED NATIONAL-CABINET Legislative-Secrecy add x-header
  • PROTECTED NATIONAL-CABINET Personal-Privacy append subject
  • PROTECTED NATIONAL-CABINET Personal-Privacy add x-header
  • PROTECTED CABINET append subject
  • PROTECTED CABINET add x-header
  • PROTECTED CABINET - Legal-Privilege append subject
  • PROTECTED CABINET - Legal-Privilege add x-header
  • PROTECTED CABINET - Legislative-Secrecy append subject
  • PROTECTED CABINET - Legislative-Secrecy add x-header
  • PROTECTED CABINET - Personal-Privacy append subject
  • PROTECTED CABINET - Personal-Privacy add x-header

UNOFFICIAL append subject

ItemValue
NameUNOFFICIAL append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsUNOFFICIAL
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=UNOFFICIAL]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority1

UNOFFICIAL add x-header

ItemValue
NameUNOFFICIAL add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsUNOFFICIAL
Actions
Set headersValue:VER=2018.6, NS=gov.au, SEC=UNOFFICIAL
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority2

OFFICIAL append subject

ItemValue
NameOFFICIAL append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority3

OFFICIAL add x-header

ItemValue
NameOFFICIAL add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL
Actions
Set headersValue:VER=2018.6, NS=gov.au, SEC=OFFICIAL
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority4

OFFICIAL: Sensitive append subject

ItemValue
NameOFFICIAL: Sensitive append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/OFFICIAL Sensitive
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority5

OFFICIAL: Sensitive add x-header

ItemValue
NameOFFICIAL: Sensitive add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/OFFICIAL Sensitive
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority6
ItemValue
NameOFFICIAL: Sensitive Legal-Privilege append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, ACCESS=Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority7
ItemValue
NameOFFICIAL: Sensitive Legal-Privilege add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, ACCESS=Legal-Privilege
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority8

OFFICIAL: Sensitive Legislative-Secrecy append subject

ItemValue
NameOFFICIAL: Sensitive Legislative-Secrecy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Legislative-Secrecy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, ACCESS=Legislative-Secrecy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority9

OFFICIAL: Sensitive Legislative-Secrecy add x-header

ItemValue
NameOFFICIAL: Sensitive Legislative-Secrecy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Legislative-Secrecy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, ACCESS=Legislative-Secrecy
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority10

OFFICIAL: Sensitive Personal-Privacy append subject

ItemValue
NameOFFICIAL: Sensitive Personal-Privacy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Personal-Privacy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, ACCESS=Personal-Privacy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority11

OFFICIAL: Sensitive Personal-Privacy add x-header

ItemValue
NameOFFICIAL: Sensitive Personal-Privacy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/Personal-Privacy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, ACCESS=Personal-Privacy
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority12

OFFICIAL: Sensitive NATIONAL CABINET append subject

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, CAVEAT=SH:NATIONAL CABINET]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority13

OFFICIAL: Sensitive NATIONAL CABINET add x-header

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, CAVEAT=SH-NATIONAL-CABINET
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority14
ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Legal-Privilege append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, CAVEAT=SH:NATIONAL CABINET, ACCESS=Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority15
ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Legal-Privilege add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, CAVEAT=SH-NATIONAL-CABINET, ACCESS=Legal-Privilege
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority16

OFFICIAL: Sensitive NATIONAL CABINET Legislative-Secrecy append subject

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Legislative-Secrecy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Legislative-Secrecy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, CAVEAT=SH:NATIONAL CABINET, ACCESS=Legislative-Secrecy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority17

OFFICIAL: Sensitive NATIONAL CABINET Legislative-Secrecy add x-header

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Legislative-Secrecy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Legislative-Secrecy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, CAVEAT=SH-NATIONAL-CABINET, ACCESS=Legislative-Secrecy
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority18

OFFICIAL: Sensitive NATIONAL CABINET Personal-Privacy append subject

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Personal-Privacy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Personal-Privacy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=OFFICIAL:Sensitive, CAVEAT=SH:NATIONAL CABINET, ACCESS=Personal-Privacy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority19

OFFICIAL: Sensitive NATIONAL CABINET Personal-Privacy add x-header

ItemValue
NameOFFICIAL: Sensitive NATIONAL CABINET Personal-Privacy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsOFFICIAL Sensitive/NATIONAL CABINET - Personal-Privacy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=OFFICIAL-Sensitive, CAVEAT=SH-NATIONAL-CABINET, ACCESS=Personal-Privacy
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority20

PROTECTED append subject

ItemValue
NamePROTECTED append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/PROTECTED
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority21

PROTECTED add x-header

ItemValue
NamePROTECTED add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, ACCESS=Legal-Privilege
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority22
ItemValue
NamePROTECTED Legal-Privilege append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, ACCESS=Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority23
ItemValue
NamePROTECTED Legal-Privilege add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, ACCESS=Legal-Privilege
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority24

PROTECTED Legislative-Secrecy append subject

ItemValue
NamePROTECTED Legislative-Secrecy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Legislative-Secrecy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, ACCESS=Legislative-Secrecy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority25

PROTECTED Legislative-Secrecy add x-header

ItemValue
NamePROTECTED Legislative-Secrecy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, ACCESS=Legal-Privilege
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority26

PROTECTED Personal-Privacy append subject

ItemValue
NamePROTECTED Personal-Privacy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Personal-Privacy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, ACCESS=Personal-Privacy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority27

PROTECTED Personal-Privacy add x-header

ItemValue
NamePROTECTED Personal-Privacy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/Personal-Privacy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, ACCESS=Personal-Privacy
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority28

PROTECTED NATIONAL CABINET append subject

ItemValue
NamePROTECTED NATIONAL CABINET append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority29

PROTECTED NATIONAL CABINET add x-header

ItemValue
NamePROTECTED NATIONAL CABINET add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority30
ItemValue
NamePROTECTED NATIONAL CABINET Legal-Privilege append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority31
ItemValue
NamePROTECTED NATIONAL CABINET Legal-Privilege add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Legal-Privilege
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority32

PROTECTED NATIONAL CABINET Legislative-Secrecy append subject

ItemValue
NamePROTECTED NATIONAL CABINET Legislative-Secrecy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Legislative-Secrecy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Legislative-Secrecy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority33

PROTECTED NATIONAL CABINET Legislative-Secrecy add x-header

ItemValue
NamePROTECTED NATIONAL CABINET Legislative-Secrecy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Legislative-Secrecy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Legislative-Secrecy
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority34

PROTECTED NATIONAL CABINET Personal-Privacy append subject

ItemValue
NamePROTECTED NATIONAL CABINET Personal-Privacy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Personal-Privacy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Personal-Privacy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority35

PROTECTED NATIONAL CABINET Personal-Privacy add x-header

ItemValue
NamePROTECTED NATIONAL CABINET Personal-Privacy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/NATIONAL CABINET - Personal-Privacy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:NATIONAL-CABINET, ACCESS=Personal-Privacy
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority36

PROTECTED CABINET append subject

ItemValue
NamePROTECTED CABINET append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority37

PROTECTED CABINET add x-header

ItemValue
NamePROTECTED CABINET add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET
Name:X-Protective-Marking
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority38
ItemValue
NamePROTECTED CABINET - Legal-Privilege append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED CABINET - Legal-Privilege
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED CABINET - Legal-Privilege]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority39
ItemValue
NamePROTECTED CABINET - Legal-Privilege add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Legal-Privilege
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Legal-Privilege
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority40

PROTECTED CABINET - Legislative-Secrecy append subject

ItemValue
NamePROTECTED CABINET - Legislative-Secrecy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Legislative-Secrecy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Legislative-Secrecy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority41

PROTECTED CABINET - Legislative-Secrecy add x-header

ItemValue
NamePROTECTED CABINET - Legislative-Secrecy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Legislative-Secrecy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Legislative-Secrecy
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority42

PROTECTED CABINET - Personal-Privacy append subject

ItemValue
NamePROTECTED CABINET - Personal-Privacy append subject
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Personal-Privacy
Actions
Modify subject
- Remove text that matches\s*?\[SEC=.*?\]
- Insert this replacement text [SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Personal-Privacy]
- PositionRemove matches and append
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority43

PROTECTED CABINET - Personal-Privacy add x-header

ItemValue
NamePROTECTED CABINET - Personal-Privacy add x-header
Conditions
Content contains
- Group nameDefault
- Group operatorAny of these
- Sensitivity labelsPROTECTED/CABINET - Personal-Privacy
Actions
Set headersVER=2018.6, NS=gov.au, SEC=PROTECTED, CAVEAT=SH:CABINET, ACCESS=Personal-Privacy
User notifications
Use notifications to inform your users and help educate them on the proper use of sensitive infoOff
Incident reports
Use this severity level in admin alerts and reportsLow
Send an alert to admins when a rule match occursOff
Use email incident reports to notify you when a policy match occursOff
Additional options
If there’s a match for this rule, stop processing additional DLP policies and rulesUnchecked
Priority44

Policy mode

ItemValue
Policy modeTurn the policy on immediately

Security & Governance

  • None identified

Design

  • None identified

Configuration

  • None identified

References

  • None identified

Do you have a suggestion on how the above page could be improved? Get in touch! ASD's Blueprint for Secure Cloud is an open source project, and we would love to get your input. Submit an issue on our GitHub, or send us an email at blueprint@asd.gov.au

Acknowledgement of Country icon

Acknowledgement of Country
We acknowledge the Traditional Owners and Custodians of Country throughout Australia and their continuing connections to land, sea and communities. We pay our respects to them, their cultures and their Elders; past, present and emerging. We also recognise Australia's First Peoples' enduring contribution to Australia's national security.

Authorised by the Australian Government, Canberra