In ArcGIS Online and Portal, items can be given tags, and if the organization enables it, categories. Neither of these options can be made mandatory by the organization.
For organizations that require items to be provided a security grading (ex. Protected, Classified, Unclassified, etc), there is currently no way for this to be enforced through the above 2 options.
If trying to use tags, they use free text. If trying to use categories, adding a category cannot be made mandatory by the organization admin.
This is a big issue for IT security in these organizations as nearly all other systems that are used in the organization must provide a security grading but it is currently not possible in ArcGIS Online or Portal.
Perhaps there could be a on/off switch (Category mandatory vs Category is not mandatory) in the category settings and selecting one of the categories supplied by the admin will be mandatory when a user creates an item. Maybe categories isn't the best way to enforce the security grading, but that is the best alternative these organizations have at this time.
I know there has been some work put in by the ESRI DC office in partnership with one of their clients to provide a similar functionality through an add-on but having this somewhat simple capability built into Online and Portal out of the box would be best. The need for security attribute markings is also part of NIST control AC-16.
Interested to hear from others or to discuss with ESRI if more detail is necessary.
