# Classification, Compartmentation, and System Assurance **Entity class:** Security-boundary synthesis ## Definition **Classification, compartmentation, and system assurance** are distinct control planes. Classification marks expected damage from unauthorized disclosure; compartmentation narrows access by program, category, role, and need-to-know; system assurance determines whether the technical and administrative environment is trustworthy enough to process the information. Confidential, Secret, and Top Secret are classification levels. Sensitive Compartmented Information is a handling and access regime for intelligence information, not a fourth classification level. FIPS 199 Low, Moderate, and High and DoD cloud Impact Levels describe system or information impact and hosting requirements; they are not substitutes for classification markings. ## Relationships - **information levels:** [[wiki/Classification|Classification]]. - **need-to-know partition:** [[wiki/Compartmentation|Compartmentation]]. - **system controls:** [[wiki/Assurance Infrastructure|Assurance Infrastructure]] and [[wiki/CNSSI 1253|CNSSI 1253]]. - **authorizing decision:** [[wiki/Authorization to Operate|Authorization to Operate]]. ## Sources / Provenance - [National Archives — Executive Order 13526](https://www.archives.gov/isoo/policy-documents/cnsi-eo.html) - [ODNI — ICD 503](https://www.dni.gov/files/documents/ICD/ICD-503.pdf)