U.S. National Security Classification Levels: A Complete 2024 Guide

Table of Contents#

1. What Is National Security Classification?
2. Core Federal Classification Levels for National Security
3. Who Is Authorized to Classify Government Information?
4. Classification Duration and Declassification Rules
5. Common Misconceptions About Classification Levels
6. Why This Framework Matters For the General Public
7. References

---

What Is National Security Classification?#

National security classification is a formal labeling system governed by Executive Order 13526 (signed in 2009) to restrict access to information whose unauthorized disclosure could harm U.S. national interests. The system serves two core, balanced goals:

1. Prevent access to sensitive data by unauthorized parties that could compromise defense, intelligence, or diplomatic operations
2. Standardize declassification timelines to ensure the public can access government records once the associated national security risk expires

Access to classified information requires two mandatory prerequisites: a security clearance matching the document’s classification level, and a demonstrated “need-to-know” (a valid work-related reason to access the specific information).

---

Core Federal Classification Levels for National Security#

There are only three formal classified levels for national security information, defined by the severity of harm that would result from unauthorized disclosure. A separate, unclassified control category (CUI) applies to non-classified information that still requires protection.

1. Top Secret (Highest Classification Level)#

• Damage threshold: Unauthorized disclosure would cause “exceptionally grave damage” to U.S. national security, as confirmed by the original classifying authority.
• Common examples:
  • Exact design specifications for U.S. nuclear warheads and delivery systems
  • Identities of undercover foreign intelligence assets operating in high-risk countries
  • Real-time plans for ongoing covert military operations or counterterrorism raids
  • Details of highly sensitive intelligence collection methods (e.g., surveillance of foreign government leadership)
• Access requirements: Top Secret security clearance (the highest level of federal clearance, requiring an extensive 10-year background check and periodic re-investigations every 5 years) plus verified need-to-know.

2. Secret (Mid-Tier Classification Level)#

• Damage threshold: Unauthorized disclosure would cause “serious damage” to U.S. national security.
• Common examples:
  • Unannounced planned deployment schedules for active U.S. military units
  • Details of confidential diplomatic negotiations with foreign governments that could undermine U.S. negotiating positions if leaked
  • Non-public performance specifications for non-nuclear military weapons systems
  • Assessments of foreign government military capabilities that could escalate international tensions if disclosed
• Access requirements: Secret security clearance (7-year background check, re-investigations every 10 years) plus verified need-to-know.

3. Confidential (Lowest Classified Level)#

• Damage threshold: Unauthorized disclosure would cause “damage” to U.S. national security.
• Common examples:
  • Routine, non-sensitive information shared in confidence by U.S. foreign allies
  • Internal security procedures for active U.S. military bases that are not publicly posted
  • Low-level intelligence assessments of foreign non-state group activities
  • Details of critical infrastructure vulnerability tests that could be exploited by bad actors if released
• Access requirements: Confidential security clearance (5-year background check, re-investigations every 15 years) plus verified need-to-know.

Controlled Unclassified Information (CUI)#

CUI is not a formal classified level, but it is a federally mandated control category for information that does not meet national security classification thresholds but still requires protection from unauthorized disclosure to avoid harm to public safety, government operations, or personal privacy.

• Common examples:
  • Personal identifiable information (PII) of federal employees or military service members
  • Law enforcement investigative records that could compromise ongoing cases
  • Vulnerability data for critical infrastructure (power grids, water systems, healthcare networks)
  • Proprietary information shared with federal agencies by private contractors
• Access requirements: No security clearance is required, but only authorized personnel with a valid work-related reason may access CUI.

---

Who Is Authorized to Classify Government Information?#

Classification authority is strictly limited to avoid over-classification, which wastes billions of dollars annually and blocks public access to non-sensitive records. There are two types of classification authorization:

Original Classification Authority (OCA)#

Only a small number of federal officials hold OCA, the right to assign a classification level to information that has never been classified before. OCAs are explicitly designated by the President, agency heads (e.g., Secretary of Defense, Director of National Intelligence), or senior officials those agency heads delegate in writing. OCAs are required to complete annual classification training to ensure they follow federal rules.

Derivative Classification#

A larger group of federal employees and approved private contractors may perform derivative classification, which means applying existing classification labels to new documents that incorporate, paraphrase, or restate previously classified information. Derivative classifiers do not have the authority to assign new classification levels to unclassified information, only to carry over existing labels from source materials.

---

Classification Duration and Declassification Rules#

Classification is not permanent for nearly all national security records:

• Default classification period: OCAs are required to set a specific declassification date when classifying information, not to exceed 10 years in most cases. If an OCA determines the information requires longer protection, the maximum default is 25 years from the date of original classification.
• Automatic declassification: All classified records older than 25 years are automatically declassified on December 31 of the 25th year after their creation, unless they are explicitly exempted for reasons including ongoing national security risk, protection of intelligence sources, or privacy concerns.
• Mandatory Declassification Review (MDR): Any member of the public may submit a request to the National Archives (NARA) to review a classified record older than 25 years for declassification, even if it was previously marked for extended classification.
• Special exceptions: Information related to nuclear weapons design and naval nuclear propulsion is governed by separate rules under the Atomic Energy Act, and may remain classified indefinitely if it meets ongoing risk thresholds.

---

Common Misconceptions About Classification Levels#

Misconception 1: “Sensitive Compartmented Information (SCI) is a classification level higher than Top Secret”#

Fact: SCI and Special Access Programs (SAPs) are not higher classification levels. They are additional access controls applied to information within the existing Top Secret, Secret, or Confidential levels, to limit access to only the small group of personnel with a direct need to know that specific information. A document marked “Top Secret/SCI” is still a Top Secret classified record, with extra access requirements.

Misconception 2: “Classified information is never released to the public”#

Fact: More than 50 million pages of classified records are declassified by NARA every year, and millions more are released in response to FOIA requests, with redactions only for information that still poses a security risk.

Misconception 3: “Any federal employee can classify information”#

Fact: Only designated Original Classification Authorities can assign new classification labels to unclassified information. 90% of federal employees do not hold any classification authority, and unauthorized classification of information is a violation of federal rules.

Misconception 4: “All redacted government documents contain classified information”#

Fact: The majority of redactions in publicly released government records are for CUI, including personal privacy information, law enforcement case details, and proprietary contractor data, not national security classified information.

---

Why This Framework Matters For the General Public#

• FOIA requests: Understanding classification levels helps you set realistic expectations for what information you can access via FOIA, and how to appeal redactions if you believe information was incorrectly classified.
• Media literacy: When news breaks about leaked classified documents, understanding the different levels helps you assess the potential severity of the disclosure and its impact on national security.
• Government contracting: If you work for a company that does business with the federal government, you are required to follow classification and CUI handling rules to avoid fines, loss of contract, or criminal penalties for unauthorized disclosure.
• Transparency oversight: As a taxpayer, you have the right to hold the government accountable for over-classification, which wastes billions of dollars every year in unnecessary security costs and blocks public access to non-sensitive government records.

---

References#

1. Executive Order 13526: Classified National Security Information, Office of the Federal Register, 2009. Retrieved from: https://www.archives.gov/isoo/policy-documents/eo13526.html
2. Information Security Oversight Office (ISOO) Classification Guidelines, National Archives and Records Administration (NARA), 2024. Retrieved from: https://www.archives.gov/isoo
3. NARA Controlled Unclassified Information (CUI) Program Official Handbook, 2023. Retrieved from: https://www.archives.gov/cui
4. U.S. Department of Justice FOIA Guide: Classified Information Exemptions, 2024. Retrieved from: https://www.justice.gov/oip/foia-guide