Multi-Agency Public Protection Arrangements (MAPPA): national guidance

Annex 2: Government Security Classifications

Classifications

1. We each have a responsibility to protect and safeguard information.

2. Security classifications are used to indicate the sensitivity of information (in terms of the likely impact resulting from compromise, loss or misuse) and the need to defend against different potential threats.

3. All Scottish Government departments, non-departmental public bodies and agencies follow the UK Government Security Classification scheme⁽¹⁾ which uses three levels of security classifications: Official, Secret and Top Secret.

Official

4. This is the lowest classification and applies to the majority of information that is created or processed by the public sector. This includes routine business operations and services, some of which could have damaging consequences if lost, stolen or published in the media, but are not subject to a heightened risk profile.

5. There is no requirement to explicitly mark routine Official information.

Official-Sensitive

6. A limited subset of Official information could have more damaging consequences. This particularly sensitive information must be clearly marked Official-Sensitive. Special handling instructions may be added to the marking where the sensitivity justifies strict restrictions on information sharing.

Examples:

• case details involving vulnerable individuals where a serious risk of harm or criminal activity may result from disclosure
• information about investigations, civil or criminal proceedings that could disrupt law enforcement or prejudice legal cases
• security information
• personal data defined as 'special category' or 'sensitive' under data protection legislation

Secret and Top Secret

7. Classifications are used for highly sensitive information relating to defence, diplomacy or national security.

8. Further information on the government security classifications can be found here:

(1) UK Government Security Classifications

(2) Government Security Classifications Guidance for Third Party Suppliers.