Sensitive but unclassified (SBU) information is subject to controls outside the formal system for classifying national security information. This module reviews the most common types of SBU information that require some degree of protection. All such information may be exempt from release to the public under the Freedom of Information Act.
Some information that is not formally designated as sensitive is nonetheless inappropriate for putting on a public Internet site. This is discussed in Pre-Publication Review of Public Web Site Content.
Most categories of SBU information are defined by federal law, while others such as For Official Use Only are defined by organization policy. Most legislative authorities are very specific in identifying the protected category of information, while others are general and leave much discretion to the agency or company.
Procedures for safeguarding SBU information depend upon the category of information and, in some cases, vary from one agency or company to another.
Generally speaking, the law provides protection for established categories of protected information only when the owners of the information have taken reasonable or required steps to protect it. These steps are sometimes stated in the law or regulation, however, they are often left up to the information owner to develop internally. Legal history shows that the following elements are key to successful enforcement of an information protection program. The agency or company must have:
Procedures for handling the various categories of SBU information vary from one agency or company to another. This is due to different legal and/or regulatory requirements for each category and the agency or organizations implementation of those requirements. Factors affecting the implementation are the degree of sensitivity of the information, nature of the threat to the information, vulnerability of the information, options that are available for protecting the information, and organizational facilities/capabilities for secure handling, storage and transmission.