Industry Insights · Government information · 8 min read
What OFFICIAL: Sensitive Means and How to Handle It
OFFICIAL: Sensitive is an Australian Government security classification for information whose compromise would cause limited damage. Here is how it works.
If you work in an Australian Government agency, or supply one, you will see OFFICIAL: Sensitive on documents and emails. The marking tells you who can see the information, how to store and send it and how much harm a leak could cause.
The rules come from the Protective Security Policy Framework (PSPF), which the Department of Home Affairs reviews every year. This guide uses the terms in PSPF Release 2026, issued on 1 July 2026.
What does OFFICIAL: Sensitive mean?
OFFICIAL: Sensitive is the lowest of the Australian Government's four security classifications under the Protective Security Policy Framework (PSPF). It applies to official information whose compromise would be expected to cause limited damage to an individual, an organization or the government, so it needs more protection than routine OFFICIAL information.
PSPF Release 2026 lists the four security classifications as OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET. OFFICIAL, used for routine government business, and UNOFFICIAL, used for information that isn't part of official duty, are not security classifications and are not mandatory markings.
OFFICIAL: Sensitive has been a security classification since August 2023, when the Government Security Committee approved changing it from a dissemination limiting marker (DLM). Older DLMs such as Sensitive and For Official Use Only ceased on 1 October 2020. Information still carrying those markers is handled as OFFICIAL: Sensitive unless it has been otherwise classified.
How the PSPF decides when OFFICIAL: Sensitive applies
The originator decides. The originator is the entity that created the information, or that first received it unmarked from outside government. It assesses the damage that would follow if the information's confidentiality were compromised, using business impact levels (BILs). OFFICIAL: Sensitive matches BIL 2, a low to medium business impact.
The PSPF Guidelines describe limited damage to an individual as harm such as injuries that are not serious or life threatening, or mistreatment or humiliation that does not threaten life. Greater harm points to PROTECTED or a higher classification.
Two rules limit over-classification. The classification must be set at the lowest reasonable level. And under the PSPF Guidelines, applying a classification to restrain competition, hide violations of law, inefficiency or administrative error, or delay the release of information that doesn't need protection is not consistent with the PSPF.
Information management markers
Information management markers (IMMs) are optional labels for information with restrictions on access or use that aren't security related. PSPF Release 2026 states that IMMs are not protective markers or security classifications. The PSPF Guidelines list three:
- Legal privilege: information subject to legal professional privilege.
- Legislative secrecy: information covered by one or more legislative secrecy provisions. A warning notice naming the provisions is required.
- Personal privacy: personal information as defined in the Privacy Act 1988.
The Guidelines recommend applying an IMM together with a security classification. In email, an IMM can only be used with a classification of OFFICIAL: Sensitive or higher.
Handling basics for OFFICIAL: Sensitive
- Need-to-know: people access the information only when their official duties require it, not because of their position or convenience. Agency staff need employment screening, not a security clearance.
- Marking: documents carry a text-based marking, recommended at the center top and center bottom of each page.
- Email: the Australian Government Email Protective Marking Standard prefers the marking in an X-Protective-Marking message header, with the subject line as a fallback, for example [SEC=OFFICIAL:Sensitive].
- Transfer: the PSPF Guidelines say to encrypt OFFICIAL: Sensitive information sent over public networks, unless the entity has recognized and accepted the risk of not doing so.
- Paper and devices: PSPF Release 2026 sets minimum protections for using, storing, carrying and traveling with physical documents and mobile devices.
- Systems: cloud services that hold OFFICIAL: Sensitive information for Commonwealth entities are assessed by an IRAP assessor. Our guide to the IRAP assessment explains how that works.
OFFICIAL vs OFFICIAL: Sensitive vs PROTECTED
This table summarizes how PSPF Release 2026 and its Guidelines describe the three levels below SECRET.
| OFFICIAL | OFFICIAL: Sensitive | PROTECTED | |
|---|---|---|---|
| Security classification | No | Yes | Yes |
| What it's for | Routine business operations and services, the majority of official information | Official information that needs limited dissemination because it is sensitive | Valuable, important and sensitive information |
| Business impact level | 1, low | 2, low to medium | 3, high |
| Expected harm if compromised | No or insignificant damage | Limited damage to an individual, organization or government | Damage to the national interest, organizations or individuals |
| Need-to-know | Recommended | Required | Required |
| Minimum clearance for agency staff | None (employment screening) | None (employment screening) | Baseline |
Do suppliers have to follow OFFICIAL: Sensitive rules?
The PSPF's minimum protections and handling requirements apply to non-corporate Commonwealth entities, not directly to private companies. With limited exceptions, PSPF Requirement 0077 says that before an entity shares security classified information, including OFFICIAL: Sensitive, with a person or organization outside government, an agreement or arrangement such as a contract or deed must set out handling requirements and protections. Requirements 0040 and 0041 also call for proportionate security terms in contracts, and for entities to make sure service providers comply with the PSPF requirements the entity specifies.
So a supplier's obligations for OFFICIAL: Sensitive information come through its agreement with the agency. State and territory agencies that hold Australian Government security classified information apply the relevant PSPF protections under an intergovernmental memorandum of understanding. Read the full framework on the PSPF annual release page.
Where DekkoCORE fits
In DekkoCORE, files can be marked OFFICIAL, OFFICIAL: Sensitive or PROTECTED. DekkoCORE is IRAP assessed for Australian government information up to PROTECTED. Each person you share with gets the permission level you choose, such as View only or Download, and every view and download is recorded in the audit log. Learn more on the DekkoCORE security and compliance page.
Common questions
Frequently Asked Questions
Is OFFICIAL: Sensitive a security classification?
OFFICIAL: Sensitive is a security classification. Under PSPF Release 2026, the Australian Government uses four security classifications: OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET. OFFICIAL: Sensitive changed from a dissemination limiting marker to a security classification in August 2023.
Do you need a security clearance for OFFICIAL: Sensitive?
A security clearance is not required for OFFICIAL: Sensitive information. Agency personnel need an employment screening check and a need-to-know, and people outside government get access under an agreement or arrangement, such as a contract, that sets handling requirements.
What is the difference between OFFICIAL and OFFICIAL: Sensitive?
OFFICIAL covers routine government information whose compromise would cause no or insignificant damage, and OFFICIAL is not a security classification. OFFICIAL: Sensitive is a security classification for information whose compromise would cause limited damage to an individual, organization or government, and OFFICIAL: Sensitive information is accessed on a need-to-know basis.
How do you mark an email OFFICIAL: Sensitive?
Australian Government emails follow the Australian Government Email Protective Marking Standard. The preferred method places the marking in an X-Protective-Marking message header. Where that isn't possible, the marking goes at the end of the subject line, for example [SEC=OFFICIAL:Sensitive].
Can OFFICIAL: Sensitive information be stored in the cloud?
OFFICIAL: Sensitive information can be held in cloud services that meet PSPF requirements. Under PSPF Release 2026, cloud services holding OFFICIAL: Sensitive information for Commonwealth entities are assessed by an IRAP assessor, and security classified information is hosted with a provider certified under the Hosting Certification Framework.
What are the PSPF classification levels?
PSPF Release 2026 sets four security classifications, from lowest to highest: OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET. Each classification matches a business impact level, from 2 (low to medium) for OFFICIAL: Sensitive to 5 (catastrophic) for TOP SECRET. OFFICIAL and UNOFFICIAL are not security classifications.