How Information Gets Classified: CUI vs. Classified

CUI is sensitive government information that requires safeguarding or controlled sharing but is not classified for national security reasons. Classified information is formally designated at a level because its unauthorized disclosure could damage national security. The distinction determines how information must be protected and who may access it.

The labels can sound interchangeable, but they mark different rules—not simply different degrees of secrecy. Understanding how information gets classified means separating the formal classification decision from the controls applied to sensitive, unclassified material such as CUI.

• 24 hours Time to submit a Tier 2 request to the CCO for first approval in the SEC document
• 60 days Typical requested TTL duration for Tier 2 access in the SEC document
• Tier 0 SEC document label for information described as public with no privacy concerns
• Tier 2 SEC document label for access requests requiring a stated purpose and approval process

How information gets classified under national-security rules

Formal classification is not the same as a handling label.

Formal classification identifies information that requires protection for national-security reasons; the supplied material does not specify the governing order, classification levels or test for making that decision. It therefore does not establish that a handling label such as controlled unclassified information (CUI) is itself a formal national-security classification.

• Classified information: the material describes it as requiring national-security protection, but gives no classification markings, levels or decision criteria.
• Unclassified information: the Executive Order Tracker from Hogan Lovells Cadwalader describes safeguarding classified information while also seeking to improve access to unclassified data.

The tracker summary says agency heads must change or withdraw guidance and regulations that obstruct sharing unclassified data within or between agencies. That access policy concerns unclassified information; it does not, in the supplied account, provide a test for classifying information or imply that classified material should be shared on the same basis.

The available material also gives no declassification timeline or process for challenging a classification decision. Those details cannot be inferred from the tracker summary, which addresses protection and unclassified-data access rather than how a classification decision is made or reviewed.

What does CUI mean for public access?

Controlled Unclassified Information (CUI) concerns how unclassified material is handled; it is not a national-security classification, and the label alone does not establish that a record can be released to the public. Whether a particular record may be disclosed depends on the access and disclosure rules that apply to it.

Unclassified does not necessarily mean unrestricted.

The available source material does not define CUI categories, identify a CUI regulation, or say which records in its examples carry a CUI marking. It therefore cannot establish that any specific example is CUI or publicly releasable.

• CUI: A handling label for unclassified material; it does not, by itself, answer whether the public may see a record.
• Classified information: A separate national-security classification, which the Executive Order Tracker summary says must be safeguarded.
• Public access: A disclosure question that still turns on the rules governing the record, not merely on whether it is unclassified.

The Executive Order Tracker summary describes federal agencies eliminating barriers to sharing unclassified data within and among agencies to improve efficiency and reduce fraud. That focus on interagency access does not create an automatic public right to every unclassified record, including one marked CUI.

How do access, handling, and release differ?

Classification determines whether information has formal national-security status; handling controls govern how records are accessed or shared and can apply to unclassified information without changing its status. The SEC document illustrates a separate access-control process: a Tier 2 request includes an initial approval request to the CCO within 24 hours.

SEC access tiers are not classification levels.

The SEC document describes access rules for its own tiers, not universal government classification categories. Its Tier 2 requests typically have a 60-day time-to-live (TTL), while policies, procedures, and aggregate statistics are listed as accessible without a TTL.

• Tier 2: The SEC process calls for requesting first approval from the CCO within 24 hours; requested access typically lasts 60 days.
• Without TTL: The SEC document names policies, procedures, and aggregate statistics as information that can be accessed without a time limit.
• Tier 0: The document describes this tier as public information with no privacy concerns.

These tiers describe access and handling in the SEC document; they do not establish an information’s formal national-security classification. A record’s access conditions and its classification status are distinct questions, so the SEC’s Tier 0 and Tier 2 labels should not be treated as general classification levels.

When does an unclassified label not guarantee release?

The label is not the whole disclosure decision.

An “unclassified” label does not, by itself, guarantee release to the public: it indicates that the information is not classified, but access can still depend on the record and the process governing it. The Pennsylvania Bulletin entry identifies various codes as unclassified, which indicates public accessibility in that context—not a rule that every unclassified government record must be public.

The distinction is also clear in the SEC document: Tier 0 information is public, while Tier 2 access requires a request and approval. The document describes a process for seeking Tier 2 access, including a requested time-to-live duration, typically 60 days; that is not the same as unrestricted public disclosure.

• Agency sharing: The Hogan Lovells Cadwalader Executive Order Tracker summary concerns inter- and intra-agency sharing of unclassified data and efforts to remove barriers to that access.
• Public disclosure: The SEC’s Tier 0 and Tier 2 categories distinguish public material from information available through a request-and-approval process.

These sources illustrate why “unclassified” should not be read as “open to everyone.” They do not provide a complete federal test for disclosure, a CUI release procedure, or rules for appealing a denial, so none of those steps can be inferred from the label alone.

What should a reader check before requesting a record?

Before requesting a record, check its exact label and whether you seek public release or access for an authorised purpose. “Classified,” “unclassified” and “CUI” are distinct categories; the SEC document also uses “Tier 0” and “Tier 2” access labels, which should not be mistaken for those categories.

• Classified or unclassified: Confirm the label shown on the material. The Pennsylvania Bulletin entry identifies listed codes as unclassified; that label alone is not a universal disclosure procedure.
• CUI: Treat it as a separate handling category, not as another name for classified information. The supplied material does not establish one universal CUI release process.
• SEC Tier 0 or Tier 2: Clarify whether you are asking for public information or access for a specific, legitimate purpose. The SEC example rejects a general review or fishing request as sufficient purpose documentation.

For a Tier 2 request under the SEC document, check the approval sequence and duration: submit the request to the CCO for first approval within 24 hours, and note that the typical time-to-live (TTL) is 60 days. The document describes some information, including policies, procedures and aggregate statistics, as available without a TTL duration.

Finally, verify the rules of the agency holding the record. The supplied material describes an SEC-specific access process and broader treatment of unclassified data, but does not establish one procedure that governs every CUI request or public-disclosure decision.

Questions readers ask

Key takeaways

• Formal national-security classification and CUI are different labels with different implications.
• The SEC document gives Tier 2 access a typical 60-day TTL and a CCO first-approval step within 24 hours.
• The SEC document treats policies, procedures, and aggregate statistics as accessible without TTL.
• An unclassified designation does not, by itself, prove that every record is publicly releasable.

Written byClara Fenwick

Clara Fenwick covers the intricacies of Congress, focusing on legislation, committee dynamics, and the interplay between political parties. Her editorial approach emphasizes deep analysis and contextual understanding, drawing connections between policy decisions and their broader implications. Clara aims to make complex legislative processes accessible to a wider audience.