To support specific business requirements and compartmentalise information, organisations may apply an optional Descriptor alongside the OFFICIAL-SENSITIVE classification marking.
What does a Descriptor indicate?
A Descriptor distinguishes a particular type of information and indicates the need for additional common sense precautions to limit access.
When should you use a Descriptor?
Organisations may apply a Descriptor to identify certain categories of sensitive information and indicate the need for common sense precautions to limit access. Where descriptors are permitted they must be supported by local policies and business processes.
How should you use a Descriptor?
Descriptors should be used in conjunction with a security classification and applied in the format: OFFICIAL-SENSITIVE [DESCRIPTOR].
