Markup is the insertion of annotations or tags into content to add structure, meaning or review comments. In computing it commonly refers to text-based annotation languages and document review marks, where the markup separates presentation or notes from the underlying content.
What Markup Does in Content and Computing
Markup adds structure and meaning to content without rewriting the underlying material itself. In documents, it can mark headings, emphasis, comments, citations, or revision notes. In computing, markup languages use tags or annotations to separate content from how it is presented, interpreted, or reviewed.
That separation is the key idea: the base content remains readable on its own, while the markup layer tells software, editors, or renderers how to treat it. This is why markup shows up in HTML, XML, Markdown, rich-text editors, and document review workflows.
Markup as a Structural Layer
Markup is not the same as the content it describes. A tag such as a heading, paragraph, or comment mark gives text an explicit role, which makes it easier for systems to parse, display, search, transform, or validate the material. In practice, markup turns plain content into something machines can reliably process.
This structural layer is valuable because it creates consistency. A document processor can distinguish between a title, a list item, and an annotation even when all three appear in the same file. That makes markup foundational to publishing systems, web pages, content management, and document interchange.
Common Forms of Markup
Markup appears in several forms, depending on the medium and purpose. HTML is used to structure web content, XML to represent data in a tagged format, Markdown to add lightweight formatting cues, and review markup to capture comments, edits, or approval notes in documents.
- Presentational markup helps software render content in a desired visual form.
- Semantic markup indicates what a piece of content means or represents.
- Review markup records human feedback, edits, or editorial intent without altering the source text directly.
These forms often overlap, but they solve different problems. Semantic markup helps interpretation, presentational markup helps display, and review markup helps collaboration.
Why Markup Matters
Markup matters because it keeps content portable, readable, and automatable. By separating annotations from the underlying text, it lets teams reuse the same source in multiple formats and lets software apply rules consistently across large volumes of content. That makes markup central to web publishing, technical documentation, and structured data exchange.
It also helps preserve editorial intent. Review comments, change marks, and structural tags can explain what the content is, how it should appear, or what still needs attention. In that sense, markup is both a formatting tool and a communication layer between people and systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and OWASP SAMM set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | Markup must be safely encoded and parsed to preserve intended structure. |
| Recommendation — Validate and encode markup inputs before rendering or storing them. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Markup is a structured input form whose syntax must be validated before processing. |
| Recommendation — Apply input validation to accept only expected markup syntax. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Not selected. |
| OWASP SAMM | 1 — Governance | Markup-based workflows rely on controlled content review and editorial process maturity. |
| Recommendation — Define review and approval practices for markup-driven content workflows. | ||
Related resources from NHI Mgmt Group
- What is the difference between untrusted user markup and server-side template injection?
- How should teams use snapshot testing to protect ViewComponent rendering when they add new options or change markup?
- How does HyperText Markup Language work?
- Why does HyperText Markup Language matter for security teams?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org