System for Classifying Documents and Email Messages

As we now approach the next step in our work to strengthen secure and aware information handling within our organization, support for information classification for Microsoft Office files and emails will gradually become available to employees and affiliated personnel in Microsoft 365 starting on 14 September. The exact date and time may vary slightly between users during the technical rollout.

Don’t forget to register for the Infostugan session on 10 September for an overview of the implementation, registration is available here! (The session will be held in Swedish)

What does the implementation mean?

To create a more secure organization, we need to have control over our information - which is why we need to start classifying information based on its sensitivity (confidentiality). You can select the sensitivity level of the information when you:

• create emails in Outlook
• create and work with documents in Word, Excel, and PowerPoint

You can select the sensitivity using a button directly in the system - the button looks like a shield (see image in the Swedish section). When you hover your mouse pointer over the different options, a tooltip appears directly in the program. Links to additional resources are provided further down in this email.

If you receive an email or a document that has already been classified, this will be clearly visible in the email or file (see image in the Swedish section).

It is not mandatory to use the system support, but all employees are encouraged to start testing and using the feature from 14 September. Please feel free to encourage your staff to try the function when it becomes available and to use the guidance texts to select the correct level.

What does choosing a sensitivity level mean in practice?

The implementation is intended to help you do the right thing - and to make it easier to think securely in everyday work.

When you choose a classification, this may mean that you get:

• clear labelling of the information
• guidance on how the information may be shared
• in some cases, protection that restricts sharing or access

From September onwards, not much will happen in practical terms when something is classified, other than that a label is attached to the information. Further ahead, security functions will be connected to the different sensitivity levels, and the first protections will be implemented in November. More information will of course be shared before then.

Important reminders

Information security rules:

The sensitivity levels are based on SLU’s rules for information classification (SLU.ua.2024.1.1.1-1752) and the classification model that has been developed. For this specific purpose, however, only the confidentiality aspect applies; integrity and availability do not. One important reminder is that information in class K3 (Highly Confidential Information) must not be handled via email or stored in Microsoft 365. More information is available on the overview page below.

Support for the organization:

The Infosäklyftet project has created an overview page for information security in the Microsoft 365 environment. The content of the page is updated continuously.

• Link to the overview page for information security in M365 - this page may be shared within the organization, including the subpages:
• Classification of information - what information classification is and a presentation of SLU’s classification model
• Sensitivity labels - guidance on the system support
• Link to Frequently Asked Questions / FAQ
• Link to the M365 project page on the Staff Web (Medarbetarwebben)

Training sessions:

Invitations will be sent to registered participants for digital sessions, known as Infostugor, where the implementation will be presented and feedback can be provided. To register for an Infostuga, please sign up via this link - registration is non-binding. (The session will be held in Swedish)