8.14 Worked example: a four-level scheme
This scheme suits most organisations. Create the labels in this order, so no reordering is needed, or reorder them as in section 8.2.3.
| Setting | Public | Internal | Confidential | Strictly Confidential |
|---|---|---|---|---|
| Position (top → bottom) | 1 | 2 | 3 | 4 |
| Color | Green #107C10 |
Blue #0078D4 |
Orange #CA5010 |
Red #A4262C |
| Description | “Approved for anyone, inside or outside CONTOSO.” | “For CONTOSO staff. Not for customers or suppliers.” | “Limited to people who need it. Business impact if disclosed.” | “Named people only. Serious harm if disclosed.” |
| Sub-sensitivities | – | – | Personal Data, Finance, HR | – |
| Header marking | – | INTERNAL |
CONFIDENTIAL |
STRICTLY CONFIDENTIAL |
| Footer marking | – | – | CONFIDENTIAL – CONTOSO |
STRICTLY CONFIDENTIAL – Do not forward |
| Watermark | – | – | – | STRICTLY CONFIDENTIAL |
| Marking placement | – | Same line (letterhead templates) | Same line | Floating |
| Email header / footer | – | – / Internal |
CONFIDENTIAL / – |
STRICTLY CONFIDENTIAL /
Do not forward |
| Subject marking | – | – | [CONFIDENTIAL] |
[STRICTLY CONFIDENTIAL] |
| Justification required on downgrade | – | ✓ | ✓ | (replaced by No downgrade) |
| Downgrade not allowed | – | – | – | ✓ |
| Printing blocked | – | – | – | ✓ (Executives: Off) |
| Print trace ID | – | – | ✓ Footer line | ✓ Dense (applies only where printing is allowed) |
| Cannot be sent via Outlook | – | – | – | ✓ with exceptions for trusted partner domains, if any |
| Email file save blocked (Outlook) | – | – | – | ✓ |
| Copying blocked | – | – | – | ✓ with Allow copy with justification |
| Group targeting | Common | Common | Common | Common |
| Group exceptions | – | – | – | Executives: Printing blocked Off |
Complete the scheme in Policy → Rules:
- General Enforcement: set Default label to Internal. Turn on label requirements at save and send, keep Check attachment labels on, and leave Label from attachments on.
- Classification Rules: rules that Recommend or Enforce Confidential Personal Data (national ID numbers), Confidential Finance (IBAN, card numbers) and Strictly Confidential (your own keywords).
With this ladder:
- a document that a user labeled Internal and that later receives card numbers is raised to Confidential Finance at the next save;
- moving it back to Internal requires a justification;
- once it is Strictly Confidential, it can never be lowered, cannot be printed except by Executives (with a trace on every page), and cannot leave by Outlook except to the listed domains.