Information classification and sensitivity labels in Microsoft 365: a practical guide for SA councils and small businesses

Most South Australian councils, not-for-profits and small businesses hold information that would hurt someone if it got out: staff and client records, rates and payment details, tender responses, legal advice, incident reports and board papers. In Microsoft 365 that information usually sits next to the lunch roster, with the same sharing settings and nothing to tell staff, or Microsoft Copilot, that it needs more care. Information classification fixes that by giving everyone a short, shared set of labels for how sensitive something is and what that means in practice. This guide explains a simple scheme, how it lines up with South Australian Government markings, and how to apply it with Microsoft 365 sensitivity labels. It is general guidance; check your contracts, your records obligations and Microsoft’s current documentation before you change settings.

Why classification matters now

• Oversharing is the common failure. Most data leaks in small organisations are a link shared with “anyone”, a file emailed to the wrong person or a folder open to the whole organisation, not a sophisticated attack.
• AI assistants find what people can already open. Copilot and similar tools surface any content a user has access to, so loose permissions become visible fast. Labels and tidy permissions are part of Copilot readiness.
• Breaches are judged on what was exposed. Knowing where personal and sensitive information lives makes it far easier to assess an incident under the Notifiable Data Breaches scheme.
• Government buyers ask. Suppliers handling South Australian Government information are increasingly asked how they protect, mark and dispose of it.

How South Australian Government classification works

South Australian public sector agencies use the South Australian Information Classification System (ICS), which commenced on 1 December 2019 under the South Australian Protective Security Framework (SAPSF) policy INFOSEC 1. It is based on the Commonwealth Protective Security Policy Framework with changes for the South Australian context, and it replaced the older ISMF classifications. The main markings are OFFICIAL, OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET, chosen by the harm that compromise would cause and set at the lowest reasonable level. OFFICIAL: Sensitive information, for example, must carry a text marking (including on emails), is shared on a need-to-know basis and must be encrypted when sent over public networks.

Councils, not-for-profits and businesses are not usually bound by INFOSEC 1 directly, but you may receive marked information from an agency, or a contract may require you to handle it to the same standard. When that happens, keep the originator’s marking and follow the handling rules; only the originator can change it. Check the current requirements on the Security SA website and in your agreement.

Step 1: agree a simple scheme

For most small organisations, three or four labels are enough. More than that and staff stop using them. A typical set:

• Public: approved for anyone, such as published reports, website content and brochures.
• Internal (or OFFICIAL if you work with government): everyday business information that isn’t for the public but would cause little harm if it leaked.
• Sensitive (or OFFICIAL: Sensitive): personal information, HR and payroll, financial details, legal advice, commercial-in-confidence tenders and security information.
• Restricted (optional): a small set such as investigations, board-only papers or incident records, limited to named people.

Write one line per label on what it covers and three or four rules: who can see it, whether it can go outside the organisation, how it is stored and how it is disposed of. Make Internal the default so nobody has to think about routine work.

Step 2: find where sensitive information lives

List the systems and locations that hold the Sensitive category: HR and payroll, finance, CRM and case management, specific SharePoint sites and Teams, shared mailboxes, and any old file server shares. Record an owner for each. If you are still moving off a file server, our file server to SharePoint and OneDrive migration guide covers cleaning up permissions on the way. For councils, line this up with your records disposal schedules and records management and FOI workflows, and remember that where information is stored can matter as much as how it is labelled; see our guide to Australian data residency.

Step 3: set up Microsoft 365 sensitivity labels

Microsoft Purview sensitivity labels let staff tag emails, documents, Teams, Microsoft 365 groups and SharePoint sites, and the label can add markings and protection that travel with the file. Plans differ, so check your licence first; our Microsoft 365 licence review guide explains how. In broad terms, Microsoft 365 Business Premium and E3 include manual labelling, while automatic labelling based on content needs E5-level licensing or an add-on.

• Create labels that match your scheme, with clear names and tooltips staff will understand.
• Add visual markings, such as a header or footer reading “OFFICIAL: Sensitive”, so a printed or forwarded copy still shows its sensitivity.
• Use encryption carefully. Encrypting the Sensitive or Restricted label limits who can open a file even if it is forwarded, but it can affect sharing with external parties, mobile apps and some third-party tools. Pilot it before you roll it out.
• Label containers so a Sensitive Team or SharePoint site blocks guest access and “anyone” links by default.
• Set a default label and require a justification when someone lowers a label.

Step 4: back labels with sharing and loss prevention rules

Labels work best alongside the settings in our Microsoft 365 security checklist: restrict “anyone” links, set link expiry, review guest access, and turn on audit logging. Where your plan includes data loss prevention, start with policies in test mode that warn staff when they send things like tax file numbers, bank details or Medicare numbers outside the organisation, then tighten once you know the false alarms.

Step 5: train staff and check it is working

• Run a 20-minute session with real examples from your own work, and add labels to your security awareness training.
• Give managers a one-page guide: which label, when, and who to ask.
• Review label use and sharing reports monthly for the first quarter, then each quarter. Look for Sensitive sites shared externally and documents that are clearly mislabelled.
• Update the scheme when you take on new government work or new kinds of data.

A 30-day starting plan

1. Week 1: agree three or four labels and their handling rules, and name an owner.
2. Week 2: list where Sensitive information lives and fix the worst oversharing.
3. Week 3: create and pilot sensitivity labels with a small group, including markings and container settings.
4. Week 4: train staff, publish labels to everyone, and switch on reporting and test-mode loss prevention.

Questions to ask your IT provider

• Which of our Microsoft 365 licences include sensitivity labels, and which features need an add-on?
• Where does our most sensitive information live, and who can open it today?
• How will encrypted labels affect sharing with our external partners and suppliers?
• How do we handle OFFICIAL: Sensitive information we receive from a South Australian Government agency?
• What reporting will show us whether labels are being used?

Talk to an Adelaide team

EITSAA helps Adelaide councils, not-for-profits and small businesses design a simple classification scheme, set up Microsoft 365 sensitivity labels and sharing controls, and prepare for Copilot and other AI tools as part of managed IT and AI governance. Get a quote for an information protection review, or call 0402 401 584, Monday to Friday, 9am to 5:30pm. Learn more about our managed IT and cyber security, AI governance and training and consultations services.