VPDSF Technical Specification Email Protective Markings V1.1
This technical specification for email protective markings (the specification) outlines minor departures from the Commonwealth Government requirements as defined in the Protective Security Policy Framework (PSPF) and the Email Protective Marking Standard (EPMS) 2018.4.
This document defines the technical implementation of protective markings for emails, for Victorian public sector (VPS) organisations.
This document is intended for VPS organisations (including employees, contractors and external parties) and industry stakeholders that are subject to the protective data security provisions under Part Four of Victoria’s Privacy and Data Protection Act (2014) or are looking to implement the protective marking requirements within a VPS organisation.
This guide is designed to support practitioners and information security leads.
Disclaimer: The Commonwealth Protective Security Policy Framework (PSPF) issued policy updates recognising OFFICIAL: Sensitive as a security classification.
As OVICs material aligns with the protective marking scheme of the PSPF, OVIC will be update its guidance material and associated resources in due course to reflect these changes.
The change does not:
- trigger changes to the Commonwealth Email Protective Marking System (EPMS) and OVIC’s Technical Specification for Email Protective Markings, as OFFICIAL: Sensitive is already treated as a security classification within these documents
- change the access to information security clearance requirements for OFFICIAL: Sensitive, as employment screening for entity personnel remains sufficient
- change minimum protections and handling requirements for OFFICIAL: Sensitive detailed in the PSPF Guidelines and
- require changes to the Australian Government Security Caveat Guidelines, as caveats that allow use with OFFICIAL: Sensitive are already indicated.
