Data Classification | Analog Informatics

Short Answers

Does the kit support markings above CMMC?

Yes. The catalog includes US government markings from UNCLASSIFIED to TOP SECRET / SCI, NATO markings, and national markings for several countries. Each family can be turned on or off.

Which national standards are in the catalog?

United States (Executive Order 13526 and 32 CFR Part 2001 levels), NATO, United Kingdom, Canada, Australia, European Union, Germany, and France. Organizations can add their own corporate markings.

Does the kit enforce the markings?

Yes. Each person gets a top clearance. Mandatory access control (MACL) can be off, warn, or enforce. In enforce mode, a person cannot read a record marked above their clearance.

Can a marking be lowered?

Only through a formal release. The release needs a justification, and every release is recorded in an append-only audit trail.

Do markings reach the SIEM?

Yes. The marking can be added to audit log entries, Windows Event Log entries, and syslog events sent to a Security Information and Event Management (SIEM) system.

Marking Families

Family	Example Markings
CMMC	Unclassified, FCI, CUI, CUI Specified
US government	UNCLASSIFIED, CONFIDENTIAL, SECRET, TOP SECRET, TOP SECRET / SCI
NATO	NATO UNCLASSIFIED, NATO RESTRICTED, NATO CONFIDENTIAL, NATO SECRET, COSMIC TOP SECRET
United Kingdom	OFFICIAL, OFFICIAL-SENSITIVE, SECRET, TOP SECRET
Canada	Protected A, Protected B, Protected C, CONFIDENTIAL, SECRET, TOP SECRET
Australia	UNOFFICIAL, OFFICIAL, OFFICIAL:Sensitive, PROTECTED, SECRET
European Union	RESTREINT UE / EU RESTRICTED, CONFIDENTIEL UE, SECRET UE, TRES SECRET UE
Germany	VS-NUR FUR DEN DIENSTGEBRAUCH (VS-NfD), VS-VERTRAULICH, GEHEIM, STRENG GEHEIM
France	DIFFUSION RESTREINTE, CONFIDENTIEL DEFENSE, SECRET DEFENSE, TRES SECRET DEFENSE
Corporate	Public, Internal, Company Confidential, Trade Secret, and custom markings

The organization decides which families apply to its contracts. The organization's security officer and its government customer decide how classified information must be handled.

How Enforcement Works

Pick a mode. Commercial mode leaves markings blank. CMMC mode shows Unclassified, FCI, and CUI. NIST SP 800-53 mode turns on the government families you choose.
Give each person a clearance. A clearance is the highest marking a person may read. Groups can carry a clearance too.
Mark records. People, groups, systems, shared files, and reports carry a marking. New records get the default marking.
Enforce. The kit follows the rules of the Bell-LaPadula model. A person may not read up. A person may write up. Lowering a marking needs a formal release.
Record everything. Marking changes, releases, and denied reads are audited under NIST SP 800-53 AU-2, AU-3, AU-9, and AC-16.

Screenshots

Classification settings with the classification mode set to CMMC (Unclassified, FCI, and CUI) and a switch that adds the marking to audit, Windows Event Log, and syslog events. — Choose a classification mode, and carry markings into audit logs and SIEM events.

Markings by sensitivity table listing CMMC markings (Unclassified, FCI, CUI, CUI Specified), US government markings from UNCLASSIFIED to TOP SECRET / SCI, and NATO markings, each with a rank. — One marking catalog ranks CMMC, US government, and NATO markings by sensitivity.

Continuation of the marking catalog with United Kingdom OFFICIAL through TOP SECRET, Canada Protected A, B, and C through TOP SECRET, and Australia UNOFFICIAL through SECRET. — National markings for the United Kingdom, Canada, Australia, and more are built into the catalog.

Access preview that tests a person, a marking, and an action against the enforced rules, a formal release form for lowering a marking with a required justification, and NIST SP 800-53 AC-16 entity markings. — Preview any access decision, and lower a marking only through an audited formal release.

Regulatory mandatory access control policy for CMMC Level 2 with a logon minimum of FCI and enforce mode, and a table of published default markings for people, groups, and systems. — Mandatory access control policies apply marking defaults for a framework in one step.

Secure Share encrypted vault with logins, secure notes, and files, classification markings for FCI and CUI, and sharing controls. — The document sharing vault stores and shares FCI and CUI with classification markings.

Scope

The kit labels and enforces markings on its own records, shared files, and reports. It is not a cross-domain solution and not an accredited classified network. Classified networks are accredited by the government customer.