Body
Protecting CCC Data in Microsoft 365
Information Technology Services — Systems Team
What Are Sensitivity Labels?
Sensitivity labels are classification tags that appear in your Microsoft 365 apps — Word, Excel, PowerPoint, and Outlook. They help CCC protect sensitive information by marking documents and emails based on how sensitive the content is. When you create a new document or email, a default label ("Collaboration") is automatically applied.
Labels are not optional. CCC policy requires every document and email to carry a sensitivity label. The default label handles most everyday work automatically — you only need to change it when you're working with something more sensitive or more public.
Where You'll See Labels
- Word, Excel, PowerPoint: Look for the "Sensitivity" button in the Home tab ribbon. Your current label also appears in the title bar next to the file name.
- Outlook: The Sensitivity button appears when composing a new email. The label is visible in the message header.
- SharePoint and OneDrive: Labels travel with the file. When you upload a labeled document, the label stays.
What Happens When You Apply a Label
Depending on the label, one or more of the following may occur:
- Content markings appear — a footer identifying the sensitivity level
- Encryption is applied — only CCC accounts, approved partner organizations, or the people you choose can open the file
- Data loss prevention rules activate — you may see a policy tip, or Outlook may block the send, if you try to share sensitive content outside CCC
Which Label Should I Use?
Decision Tree
Start here: Who is this content for?
→ Anyone, including the public? Use: Public Examples: Course catalogs, event flyers, press releases, public-facing web content
→ CCC staff only, general internal work? Use: Collaboration (this is your default — it's already applied) Examples: Staff memos, meeting notes, internal procedures, routine correspondence
→ A specific CCC department only? Use: Department Restricted Examples: Department budgets, internal planning documents restricted to your team
→ Student records protected under FERPA?
- Staying inside CCC → Use: FERPA - Internal Access
- Going to an approved external partner (National Student Clearinghouse, transfer institutions, contracted service providers) → Use: FERPA - Authorized Partners
Examples: Transcripts, enrollment records, financial aid data, disciplinary records, advising notes with student identifiers
→ Sensitive college business that isn't about students? Use: Confidential Business Examples: Vendor contracts, HR documents, financial reports, strategic plans
→ Highly sensitive regulated data (SSNs, credit cards, bank accounts)?
- Routine internal handling → Use: Regulated PII - Internal Access
- Only a few named people should see it → Use: Regulated PII - Maximum Protection
Examples: Tax documents (W-2s, 1099s), employee SSNs, credit card numbers, banking information
Label Reference Table
| Label |
Access |
Encrypted |
Markings |
DLP Action |
| Public |
Anyone |
No |
None |
No restrictions |
| Collaboration |
All CCC staff |
No |
None |
Warning after a file is shared outside CCC from SharePoint or OneDrive. No warning on email. |
| Department Restricted |
All CCC staff |
No |
None |
Warning after a file is shared outside CCC from SharePoint or OneDrive. No warning on email. |
| FERPA - Internal Access |
CCC staff only |
Yes |
Footer |
Blocks sending outside CCC; override with business justification (logged) |
| FERPA - Authorized Partners |
CCC staff + approved partner organizations |
Yes |
Footer |
Blocks sending outside CCC; override with business justification (logged) |
| Confidential Business |
People you choose |
Yes |
Footer |
Blocks sending outside CCC; override with business justification (logged) |
| Regulated PII - Internal Access |
CCC staff only |
Yes |
Footer |
Blocks all external sharing; no override |
| Regulated PII - Maximum Protection |
People you choose; email can't be forwarded, printed, or copied |
Yes |
Footer |
Blocks all external sharing; no override |
What Do the Policy Tips Mean?
When you work with labeled content, you may see messages called "policy tips" in Outlook, OneDrive, and SharePoint. They're part of CCC's data loss prevention system. Here's what they mean:
Warning — CCC Internal file shared outside CCC (OneDrive and SharePoint only)
"This content is labeled CCC Internal and should not be shared outside Clackamas Community College. If external sharing is required, apply a different label or contact ITS."
What's happening: You shared a Collaboration or Department Restricted file with someone outside CCC. The share goes through. Shortly after, OneDrive or SharePoint marks the file with a warning icon, and this tip appears in the file's details. Email labeled Collaboration or Department Restricted sends normally, with no warning. What to do: If the share was a mistake, stop sharing the file. If it was appropriate, consider whether a different label fits better. If you think the warning is wrong, select Report an issue in the tip.
Send Blocked — Override Available
For Confidential Business and FERPA - Internal Access:
"This content is labeled Confidential and cannot be shared outside Clackamas Community College. Please remove external recipients or contact ITS if you believe this is an error."
For FERPA - Authorized Partners:
"This content contains FERPA-protected student data for Authorized Partners. External sharing is logged and requires FERPA authorization. If sharing to an unauthorized party, cancel and apply the FERPA Internal Access label. Contact ITS with questions."
What's happening: You added an outside address to a Confidential or FERPA-labeled email. The tip appears as soon as the address is added. If you select Send, Outlook shows Send blocked. What to do: If you don't have a legitimate business reason, remove the outside recipients. If you do (for example, sending transcripts to an approved transfer institution or a contract to a vendor):
- Select Show details in the policy tip, then select Override.
- Choose I have a business justification and type your reason. If the label was applied by mistake, choose This message doesn't contain sensitive information instead.
- Select Override, then select Send.
Your choice, your name, and the recipients are logged and may be reviewed by ITS. Select Undo in the banner if you change your mind before you send. Overriding only lets the email go. Who can open the content still depends on the label.
Send Blocked — No Override
For Regulated PII - Internal Access:
"This content is classified Highly Confidential – Internal Access Only. External sharing is blocked. If you believe you need to share this externally, contact ITS."
For Regulated PII - Maximum Protection:
"This content is classified Highly Confidential – Maximum Protection. All external sharing is blocked. No override is available. If you need to share this content externally, contact ITS to discuss alternative secure transfer methods."
What's happening: You're trying to send Regulated PII content outside CCC. Outlook shows Send blocked, and there is no override. What to do: Remove the outside recipients to send the message. Do not lower the label to get around the block. If you need to get this data to an outside agency, contact the CCC Help Desk to discuss secure transfer methods.
Changing Labels — Upgrading and Downgrading
Upgrading (applying a higher-sensitivity label) — You can upgrade a label at any time. For example, if you start with "Collaboration" and then paste student records into the document, change the label to "FERPA - Internal Access."
Downgrading (applying a lower-sensitivity label) — The system will ask you to provide a justification for why you're lowering the sensitivity. This is logged. Only downgrade if the content genuinely no longer contains sensitive information.
Removing a label — Labels cannot be removed. CCC requires every document and email to have a label.
Auto-Labeling Recommendations
In some cases, your Office app may display a banner recommending a specific label. This happens when the system detects sensitive content in your document — for example, a Social Security Number pattern or credit card number.
When you see a recommendation banner:
- Read the banner — it tells you what type of sensitive content was detected
- If the recommendation is correct, click "Apply Sensitivity Label" to accept it
- If you believe it's a false positive (the content isn't actually sensitive), you can dismiss the recommendation
The system errs on the side of caution. If you're unsure, apply the recommended label — it's always safer to over-classify than under-classify.
Frequently Asked Questions
Q: Can I share a Confidential document with a vendor? A: Yes, but Outlook will block the send until you override it with a business justification. Your justification is logged for compliance purposes.
Q: Why did my document get a label I didn't choose? A: All new documents start with the "Collaboration" label by default. If you see a different label, either the system recommended it based on the content, or someone else who edited the document changed the label.
Q: I emailed a Collaboration-labeled message outside CCC and didn't see a warning. Is that right? A: Yes. The CCC Internal warning applies to files shared from OneDrive and SharePoint, not to email. Before you send, make sure the person really needs the information.
Q: Do labels work in Office for the Web (browser-based Office)? A: Yes. Labels appear and function in the browser versions of Word, Excel, PowerPoint, and Outlook.
Q: What if I need to email a FERPA document to a transfer institution? A: Use the "FERPA - Authorized Partners" label. Outlook will block the send until you override it with a business justification. Only approved partner organizations can open the content. To get an organization added to the approved list, submit the FERPA Domain Addition request.
Q: Will the label stay if I email a document to someone outside CCC? A: Yes. The label and any encryption travel with the file. If the file is encrypted, the external recipient gets a protected message and must sign in, or request a one-time passcode, to open it.
Q: What happens if I accidentally apply the wrong label? A: You can change the label at any time. If you're downgrading (moving to a lower sensitivity), you'll be asked to justify the change. If you've already shared an encrypted document and need to change access, contact the CCC Help Desk.
Q: Who can see what label I applied? A: The Systems Team can see labeling activity through audit logs. Your manager and colleagues cannot see your labeling history unless they open the file and look at the label.
Need Help?
If you have questions about sensitivity labels, which label to apply, or if you believe a policy tip is appearing incorrectly, contact the CCC Help Desk. Include the app you're using, the label name, the exact message you saw, and the organization you were sending to. Please don't put student records or other sensitive content in your ticket.
Last updated: November 10, 2026 Published by: Information Technology Services — Systems Team. This page is linked from the Sensitivity button in your Office apps under "Learn More."