In federal usage, “classified” is the umbrella term for information protected under national security rules, and “Confidential” is the lowest of its three tiers, sitting below Secret and Top Secret. In the private sector, “confidential” means something else entirely: trade secrets, customer data, and internal records protected by contracts and privacy laws rather than national security statutes. So when comparing confidential vs classified, the answer depends on which world you’re in. Inside government, Confidential is a subset of classified. Outside government, confidential information has nothing to do with classification at all.
The Three Tiers of Classified Information
Executive Order 13526 sets the framework the federal government uses to classify and protect national security information.1National Archives. Executive Order 13526 – Classified National Security Information It creates three levels, distinguished by the harm that would result if the information were released without authorization:
- Confidential: Information whose unauthorized release could reasonably be expected to cause damage to national security.
- Secret: Information whose release could cause serious damage to national security.
- Top Secret: Information whose release could cause exceptionally grave damage to national security.
The wording is deliberate. Each tier steps up from “damage” to “serious damage” to “exceptionally grave damage,” and an official marking a document must be able to identify the specific harm that disclosure would cause.2The White House. Executive Order 13526 – Classified National Security Information
Because Confidential sits at the base of this hierarchy, every Confidential document is by definition classified. The reverse is not true. Most classified information carries a Secret or Top Secret marking, which triggers stricter handling, tighter access controls, and more expensive storage.
How Confidential Differs From Secret and Top Secret in Practice
The three tiers are not just labels. They pull different levels of vetting, physical protection, and access control behind them.
Clearance and Background Investigation
Accessing classified material requires two things at any tier: a security clearance at or above the level of the information, and a demonstrated need to know that specific information for your job. A Top Secret clearance does not grant a pass to read every Top Secret document; if the material is not relevant to your duties, you have no right to see it.
The investigations behind each clearance differ. Both Confidential and Secret clearances require a Tier 3 investigation, which covers criminal records, credit history, employment verification, and interviews with references.3Defense Counterintelligence and Security Agency. Federal Investigative Standards for Tier 3 and Tier 3 Reinvestigation Top Secret clearances require a Tier 5 investigation, which digs significantly deeper and includes interviews with neighbors, coworkers, and extended contacts going back years.4National Institutes of Health. Understanding U.S. Government Background Investigations and Reinvestigations
Before touching any classified material at any tier, every person must sign Standard Form 312, a nondisclosure agreement that spells out the legal consequences of mishandling what they see.5General Services Administration. Classified Information Nondisclosure Agreement The form warns that violations can result in losing your clearance, losing your job, and facing criminal prosecution.
Storage Requirements
Federal regulations require all classified information, even Confidential, to be stored in GSA-approved security containers or vaults.6eCFR. 32 CFR 2001.43 – Storage The difference between the tiers is in the supplemental controls layered on top:
- Top Secret: GSA-approved container or vault, plus additional safeguards such as inspections every two hours, an intrusion detection system with a 15-minute alarm response time, or security-in-depth coverage of the surrounding area.
- Secret: Same container requirements, with inspections every four hours and alarm response extended to 30 minutes.
- Confidential: Same container or vault, with no supplemental controls required beyond the container itself.
Approved container types include Class 5 containers for classified documents, components, and equipment, and Class 6 containers for maps, plans, and drawings.7GSA. Types of Security Containers Top Secret material handled regularly in a work environment generally requires a Sensitive Compartmented Information Facility (SCIF), a specially constructed room built to block electronic surveillance and physical intrusion.
Criminal Exposure for Mishandling
The tier of the information does not by itself set the penalty. What matters is the conduct. A government employee, contractor, or consultant who knowingly removes classified documents and keeps them somewhere unauthorized faces up to five years in prison under 18 U.S.C. 1924, regardless of whether the material is Confidential, Secret, or Top Secret.8Office of the Law Revision Counsel. 18 U.S.C. 1924 – Unauthorized Removal and Retention of Classified Documents or Material Gathering, transmitting, or willfully retaining defense information with reason to believe it could harm the United States or benefit a foreign nation carries up to ten years under 18 U.S.C. 793, plus mandatory forfeiture of any property derived from a foreign government as a result of the violation.9Office of the Law Revision Counsel. 18 U.S.C. 793 – Gathering, Transmitting, or Losing Defense Information Knowingly sharing classified information about codes, cryptographic systems, or communication intelligence carries up to ten years under 18 U.S.C. 798.10Office of the Law Revision Counsel. 18 U.S. Code 798 – Disclosure of Classified Information
Administrative consequences can be career-ending on their own. A clearance revocation locks someone out of national security roles across the federal government and defense industry, and many cases never reach a courtroom because the loss of clearance and job is treated as sufficient.
What “Confidential” Means in the Private Sector
Step outside government and the word changes meaning. Companies use “confidential” to protect trade secrets, financial projections, customer lists, and proprietary technology from competitors. The legal backing comes from contract law and, since 2016, from the Defend Trade Secrets Act, a federal statute that gives trade secret owners a civil cause of action in federal court when their information is stolen or misused.11U.S. Congress. Defend Trade Secrets Act of 2016 Remedies include injunctions, actual damages, and up to double damages when the theft was willful.
The enforcement mechanism is different from the government system. Employees sign nondisclosure agreements that define what counts as confidential and what happens if they share it. Violations lead to civil lawsuits seeking money damages or court orders, not prison sentences. The burden of proof is lower, and the process is adversarial: one company suing another, or a company suing a former employee, rather than a federal prosecution.
Businesses also protect personal data under federal privacy laws. HIPAA, for instance, requires healthcare providers and their business partners to safeguard individually identifiable health information such as medical records, treatment histories, and personal identifiers like names, addresses, and Social Security numbers.12U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule HIPAA’s scope is limited to health-related data held by covered entities. Social Security numbers in a retailer’s database or a bank’s customer files fall under different privacy frameworks. The same word, “confidential,” appears across all of these contexts, which is why comparisons between corporate and government data protection so often confuse people.
Controlled Unclassified Information: The Middle Ground
One category worth flagging so it doesn’t get mixed up with either side of the comparison: some federal information is too sensitive for public release but does not meet the damage thresholds required for Confidential, Secret, or Top Secret marking. Executive Order 13556 created the Controlled Unclassified Information program to standardize how agencies handle it.13The White House. Executive Order 13556 – Controlled Unclassified Information
The CUI registry maintained by the National Archives covers dozens of categories, including critical infrastructure data, law enforcement records, export-controlled research, financial supervision information, and immigration case files.14National Archives. CUI Registry Before CUI existed, agencies used a patchwork of labels such as “For Official Use Only,” “Sensitive But Unclassified,” and “Law Enforcement Sensitive,” each with inconsistent rules.
CUI does not require a security clearance, but it still carries handling restrictions, and contractors working with CUI must meet cybersecurity standards. It is neither classified nor freely public. Understanding that it occupies its own space explains why some federal documents carry restrictions even though they bear no classification markings and no relationship to the private-sector idea of confidentiality.