Markings and handling

Markings tell every reader how to handle what they see. Foxborne applies the marking your administrator sets, and it does not decide what is CUI: your contract and your security office do.

The system-high banner#

A banner fixed across the top of every screen carries the system-high marking for the whole deployment. While the banner is on, the status bar at the bottom repeats it as its first segment.

The console offers two levels, in the Astro UXDS classification colors, with white text. The colors are the same in the dark and light themes:

CUI

UNCLASSIFIED

An admin turns the banner on or off with Show the marking banner, and picks the level under Banner in the Marking dialog. The dialog is plain about its limits: "A classified deployment sets its banner from its own accreditation, not from here." Foxborne offers no classified levels.

The designation indicator#

Reports and case files carry the CUI designation indicator on their first page, under the top banner. It says who controls the information and who to ask about it.

Example data

Controlled by

Your organization

Controlled by

Your office

CUI category

EXPT

Dissemination

FEDCON

POC

Your office mailbox

The report prints five lines. Settings shows the same labels, and the Marking dialog names its fields slightly differently:

EXPT is the CUI Registry's category marking for Export Controlled. FEDCON, Federal Employees and Contractors Only, is one of the registry's limited dissemination controls.

The indicator prints only when the banner level is CUI. With UNCLASSIFIED, the export dialog reads No CUI designation.

Markings on every page#

Reports and case files carry the marking at the top and bottom of every page, with the designation indicator on the first. The incident's Export dialog repeats the rule under Marking: "L1 and L2 files carry the banner string. The case file prints it at the top and bottom of every page, with the designation indicator on the first."

A change to the marking reaches everything together. The Marking dialog applies it "to the banner, every report and every case file from the next render." The audit log records a Changed marking entry with the level and category.

Export-controlled evidence#

The Access page states the rule: "Evidence marked EXPT opens only for users whose identity provider asserts US person status. Everyone else sees the incident list without the evidence."

Foxborne does not decide who is a US person. It reads a SAML attribute from your identity provider, usPerson in the example configuration. The Members table shows each person as Asserted or Not asserted.

Access, on the Sign-in tab, shows whether the rule is Enforced. See Export-controlled evidence.

The system use notice#

Each user acknowledges a system use notice before every session. The sign-in page shows your administrator's text with the box I understand and consent, and the sign-in button stays disabled until the box is ticked.

Each acknowledgment is recorded in the audit log. Admins edit the text in Settings, under Marking, where empty text is refused and every change is audited.

Positions on export#

Flight logs contain positions. With Remove coordinates on export turned on in Settings, under Redaction, exported reports leave positions out unless the exporter turns them back on.

The report's Location line then adds Removed on export, and Before you export confirms Coordinates are removed on export.

Related#

• CUI marking sets the banner and the designation indicator.
• Export-controlled evidence covers the US person attribute and what it gates.
• Reports and case files shows where the markings sit on each page.
• Retention, holds and redaction covers coordinate removal and redaction patterns.