2 cissp ® Official Study Guide Eighth Edition

Sensitive But Unclassified
Sensitive but unclassifi ed (SBU) 
is used for data that is for 
internal use or for offi ce use only (FOUO). Often SBU is used to protect information that 
could violate the privacy rights of individuals. This is not technically a classifi cation label; 
instead, it is a marking or label used to indicate use or management. 
Unclassified
Unclassifi ed
is used for data that is neither sensitive nor classifi ed. The dis-
closure of unclassifi ed data does not compromise confi dentiality or cause any noticeable 
damage. This is not technically a classifi cation label; instead, it is a marking or label used 
to indicate use or management. 
An easy way to remember the names of the five levels of the government 
or military classification scheme in least secure to most secure order is 
with a memorization acronym: U.S. Can Stop Terrorism. Notice that the 
five uppercase letters represent the five named classification levels, from 
least secure on the left to most secure on the right (or from bottom to top 
in the preceding list of items).

---

22
Chapter 1 
■
Security Governance Through Principles and Policies
Items labeled as confi dential, secret, and top secret are collectively known as classifi ed. 
Often, revealing the actual classifi cation of data to unauthorized individuals is a violation 
of that data. Thus, the term
classifi ed
is generally used to refer to any data that is ranked 
above the unclassifi ed level. All classifi ed data is exempt from the Freedom of Information 
Act as well as many other laws and regulations. The United States (U.S.) military classifi ca-
tion scheme is most concerned with the sensitivity of data and focuses on the protection of 
confi dentiality (that is, the prevention of disclosure). You can roughly defi ne each level or 
label of classifi cation by the level of damage that would be caused in the event of a confi -
dentiality violation. Data from the top-secret level would cause grave damage to national 
security, whereas data from the unclassifi ed level would not cause any serious damage to 
national or localized security. 
Commercial business/private sector classifi cation systems can vary widely because they 
typically do not have to adhere to a standard or regulation. The CISSP exam focuses on 
four common or possible business classifi cation levels (listed highest to lowest and shown in 
Figure 1.5 ): 
F I G u r e 1. 5
Commercial business/private sector classification levels
Confidential
Private
Sensitive
Public
High
Low