Classification considerations

This section provides general tips and things to consider when classifying.

Who should classify information?

The person or agency responsible for creating or preparing the information decides its classification and protective marking. This person or agency is called the ‘originator’.

If information is created outside the New Zealand Government, the person working for the government organisation who actioned the information should determine whether it requires a protective marking.

To classify, the first step is to assess the harm and impact if the information is compromised.

Justify before you classify

Classification is not ‘free’. As the classification level increases, information becomes harder to manage and harder to use.  It is important that information is classified correctly and that higher levels of classification are only used for information whose compromise would cause higher levels of harm.

The concept of ‘justify before you classify’ asks everyone who makes classification decisions to confirm their reasoning before classifying information. This isn’t a formal process, just an expectation that classifiers of information make a conscious choice every time they classify. 

Over-classifying information is harmful

Over-classifying information can be harmful such as:

• Public access to government information can become unnecessarily limited.
• Unnecessary administrative arrangements are set up that remain in force for the life of the information which imposes an unnecessary cost on the agency.
• Classified records, CONFIDENTIAL or higher, cannot be transferred to Archives New Zealand. They will need to be retained by the agency and if not eventually declassified will require a deferral of transfer from the Chief Archivist possibly indefinitely.
• The volume of protectively-marked information increases requiring larger secure storage facilities and secure systems to maintain the security controls.
• The Classification System and associated security procedures are brought into disrepute.

Persistent over-classification can lead to protective markings being devalued or ignored.

Unclassified information must still be protected

All of government information requires an appropriate degree of protection to keep it secure, available, and accurate. This includes unclassified and publicly available information. Agencies must apply appropriate standard protections for all government information they assess necessary based on their security risks and threats.

UNCLASSIFIED isn’t a security classification, but it is used as a protective marking to show that the impact from unauthorised disclosure or misuse has been assessed as low and standard protections are sufficient to keep it secure.

Your organisation should have policy on how you will mark, protect, and handle information that needs increased protection but doesn’t qualify for a security classification.

SENSITIVE information includes threat to life

Policy and privacy categories should not be considered as ‘less serious’ than the national security classifications.  The compromise of SENSITIVE information could still result in loss of life for an individual, e.g., if the contact details of police informers were released.

Some information is not about national security but could still result in the loss of life and other serious harm.

Information from other sources

Protective markings suggested by outside organisations or individuals should not automatically be accepted by New Zealand government agencies unless there has been a prior agreement.

Information derived directly from protectively-marked sources must carry, at a minimum, the highest security classification of any of the source classifications.

However, if you suspect that the protectively-marked sources are no longer correctly classified, it may be time for the source information to be reviewed. Contact the owning organisation to clarify and agree the correct classification and protective marking for the information.