This pack turns the five modules of BY-G3 into hands-on marking practice: three documents to mark, the ladder game, subject-line surgery, a mailbox that won't tell you the answer, and the right-place/wrong-place sort — then the trainer answer key at the back.
| Sheet | Activity | Format | Time |
|---|---|---|---|
| 1 | Reference — six values, subject-line form, caveat rule | Cards | — |
| 2 | M1 · Three documents, three rungs | Artifact marking | 12 min |
| 3 | M2 · The ladder game — 12 cards + quick-fire sheet | Matching pairs | 10 min |
| 4 | M3 · Subject line surgery — 10 lines to red-line | Error-correction drill | 10 min |
| 5 | M4 · The system that won't tell you | Mailbox + tool check | 12 min |
| 6 | M5 · The open-plan briefing — 6 situations | Situation sort | 8 min |
| 7 | Answer key — trainer only | Key | — |
UNOFFICIAL → OFFICIAL → OFFICIAL:Sensitive → PROTECTED → SECRET → TOP SECRET
Choose the lowest rung that honestly covers the potential damage (Req 60). Ask the one question: what damage could result if this were seen by the wrong person? (Req 59). Not habit, not the last document, not "to be safe".
The originator judges the sensitivity — a named person stands behind the label. The originator also approves any later sanitisation, reclassification or declassification. If you receive information marked by someone else, you don't change its marking — you ask the originator. Lowest reasonable level, both directions: too high buries and trains distrust; too low exposes.
Markings are readable text — a person and a machine read the same value. Email subject-line form: [SEC=PROTECTED] at the start of the subject, exact spacing (no space inside the brackets, one space after the comma). A caveat never travels alone — it always pairs with a classification: [SEC=PROTECTED, ACCESS=Legal-Privilege].
The marking sets the minimum care — storage, handling, systems — and it doesn't end when you press send. Classified discussions happen only in approved locations. Marking is a handling instruction that travels with the information; the record keeps it.
1. Apologies · 2. Minutes of last meeting · 3. Project updates (5 min each) · 4. Parking: shared drive tidy-up · 5. Other business
"The Department of Sample Affairs has today announced record performance in the Northern Regions Grants Program, with [figures withheld — unannounced] per cent more grants delivered than the previous year." — Not yet approved for release.
Names, personal mobile numbers and home suburbs for 30 staff, prepared so movers can confirm deliveries during the office relocation next month.
Debrief: Why does "lowest reasonable" protect the marking system itself? What damage does over-marking cause — and under-marking?
| # | Item | Your marking |
|---|---|---|
| 1 | Team lunch invitation | |
| 2 | Unpublished grant decision list | |
| 3 | Personal mobile numbers for the office directory | |
| 4 | Draft annual report (pre-release) | |
| 5 | Building evacuation notice | |
| 6 | A complainant's case file notes | |
| 7 | The Minister's speaking notes, unannounced speech | |
| 8 | Internal training slides on records management |
Debrief: Which pairing was hardest? What did your disagreements teach about "consistent judgement"? (Expected bands in the answer key — the reasoning from damage decides, not the exact word.)
| # | As drafted | Corrected form |
|---|---|---|
| 1 | [SEC=OFFICIAL] Program update | |
| 2 | [SEC=PROTECTED] quarterly report — (marking at the end of a long subject) | |
| 3 | [SEC=official:Sensitive] Grantee meeting notes | |
| 4 | [SEC=PROTECTED,ACCESS=Legal-Privilege] Advice | |
| 5 | [SEC=OFFICIAL : Sensitive] Reporting dates | |
| 6 | [SEC=CONFIDENTIAL] Budget discussion | |
| 7 | [ACCESS=Cabinet] Draft submission | |
| 8 | [SEC=PROTECTED ] Minutes of the security committee (trailing space) | |
| 9 | "This email is SEC=OFFICIAL" — (marking in the body, subject blank) | |
| 10 | [SEC=TOP-SECRET] — (for a routine scheduling note) |
| Caveat | Pairs with (classification) |
|---|---|
| ACCESS=Legal-Privilege | |
| ACCESS=Cabinet | |
| ACCESS=National-Cabinet | |
| ACCESS=Exclusive |
Debrief: Why is the syntax fixed rather than "close enough"? What does a caveat without a classification invite?
| Question | Your answer |
|---|---|
| 1 · What value does this email carry, and why? | |
| 2 · What did the tool do, and what did it NOT do? | |
| 3 · If you reply quoting the attachment, what must your reply carry? | |
| 4 · Where does the marking live on a system, and why does that matter for records? | |
| 5 · "The tool usually adds it" — when is that not good enough? |
Debrief: Mark to the highest sensitivity present (ISM-0270); the email marking standard applies even when the client shows nothing (Req 67); markings are carried as structured fields (Req 68); the tool will not make the judgement for you (ISM-0271).
| Situation | Right / Wrong / Depends | Minimum care the marking triggers |
|---|---|---|
| 1 | ||
| 2 | ||
| 3 | ||
| 4 | ||
| 5 | ||
| 6 |
Debrief: Why does the minimum care continue after the email is sent? What does a "wrong place" choice cost in practice? (Req 62, Req 70)
A (agenda) → OFFICIAL: routine internal content; damage if disclosed is negligible-to-low. Some students
will mark UNOFFICIAL — acceptable if the reasoning is "no damage", but the entity default for work documents is
usually OFFICIAL; the reasoning decides.
B (draft media release with unannounced figures) → OFFICIAL:Sensitive (premature disclosure of unannounced
figures damages the announcement and the Minister's standing).
C (staff list with personal contact details) → OFFICIAL:Sensitive (personal information; disclosure to the
wrong person harms privacy).
The originator line must be signed on all three — a marking is never anonymous (Req 58–60).
1 OFFICIAL · 2 PROTECTED (pre-announcement financial figures) · 3 OFFICIAL:Sensitive (personal info) ·
4 OFFICIAL · 5 PROTECTED (personnel matter under investigation) · 6 UNOFFICIAL/OFFICIAL · 7 OFFICIAL:Sensitive
(unannounced figures) · 8 OFFICIAL · 9 PROTECTED (bank details — personal/financial data) · 10 PROTECTED
(floor plan of a secure area) · 11 OFFICIAL · 12 OFFICIAL.
Quick-fire: 1 UNOFFICIAL/OFFICIAL · 2 PROTECTED · 3 OFFICIAL:Sensitive · 4 OFFICIAL:Sensitive ·
5 UNOFFICIAL/OFFICIAL · 6 PROTECTED · 7 OFFICIAL:Sensitive/PROTECTED · 8 OFFICIAL.
These are bands, not verdicts — the reasoning from damage decides (Req 59–60). Entity guidance may set
specific defaults; name that in debrief.
1 correct as drafted. 2 → [SEC=PROTECTED] quarterly report (marking at the start). 3 →
[SEC=OFFICIAL:Sensitive] Grantee meeting notes (case). 4 → [SEC=PROTECTED, ACCESS=Legal-Privilege]
Advice (space after comma). 5 → [SEC=OFFICIAL:Sensitive] Reporting dates (no space before colon). 6 →
[SEC=PROTECTED] Budget discussion (CONFIDENTIAL is not a standard value). 7 → must pair the caveat:
[SEC=SECRET, ACCESS=Cabinet] Draft submission (or the entity's Cabinet marking rule). 8 → remove the
trailing space: [SEC=PROTECTED]. 9 → marking belongs in the subject: [SEC=OFFICIAL] + subject text.
10 → over-marking: routine scheduling note does not justify TOP SECRET; mark to the damage (Req 60).
Caveat pairs: Legal-Privilege → PROTECTED+; Cabinet → SECRET (per entity guidance); National-Cabinet → SECRET;
Exclusive → PROTECTED+. A caveat never travels alone (Req 64).
1 → PROTECTED: mark to the highest sensitivity in the message — the attachment (ISM-0270). 2 → the tool displayed nothing and added nothing; it did not make the judgement (ISM-0271). 3 → the reply must carry PROTECTED (quoting a PROTECTED attachment carries the level forward). 4 → markings are carried as structured fields on systems so the record keeps the handling instruction (Req 68). 5 → "usually adds it" is not evidence for this message; you check, you don't assume.
1 wrong place · 2 right place · 3 wrong place (unless the material is approved for transit and handled per policy — "depends" acceptable with that reasoning) · 4 wrong place/depends (approved home-working arrangements, screen privacy, others present) · 5 depends (approved copier, secure output handling) · 6 wrong place. Minimum care: restricted discussion locations (Req 70), secure storage and handling (Req 62). The marking's care applies until the record is final — not just at send.