Object-Level Markings and Precedence - feedback

[Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu>]

Hi All,

We quickly review at the object-level marking but we are wondering about the precedence.

From 6.5.1:

"Multiple marking definitions of the same type can appear in the object_marking_refs list. If this occurs, markings appearing later in the list have precedence over those appearing earlier. For
example, a TLP marking appearing at position 3 in the list has precedence over a TLP marking appearing at position 2, but not a copyright marking appearing at position 1. Different types of marking
definitions will have different behaviors when multiple instances are applied; that behavior is defined in the marking definition type itself.

The marking definition extensions, which define how data is marked using a particular approach (e.g., TLP), define the behavior when one marking overrides another."

As the precedence highly depends of the marking in use and especially the exact definition of the marking, we would recommend to avoid specifying the
precedence rule within the standard. It's not uncommon in classification to have mutually exclusive cases where the precedence rule defined above might
lead to confusion in the implementation. We would recommend to remove from 6.5.1 the sentence defining a precedence rule and leave it for the marking
definition extensions only.

I hope this helps.

Cheers

-- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu