The U.S. government controls sensitive information through two systems that work together: classification levels attached to the information itself, and security clearances issued to the people who need to see it. Government security classification levels and clearances line up in parallel — information is labeled Top Secret, Secret, or Confidential based on the damage its release could cause, and individuals are cleared to one of those same levels after a background investigation. Holding a matching clearance is necessary but not sufficient. You also need a verified “need to know” tied to your official duties before you can access any particular document.
The Three Classification Levels
Executive Order 13526 establishes three tiers of classification, each defined by the severity of harm that unauthorized disclosure could cause.1The White House. Executive Order 13526 – Classified National Security Information
Top Secret applies when disclosure could reasonably be expected to cause exceptionally grave damage to national security. War plans, intelligence-gathering methods, and weapons design details typically sit here.
Secret applies when disclosure could cause serious damage. Significant military capabilities and sensitive diplomatic communications generally fall in this tier.
Confidential is the lowest level, applied when disclosure could cause damage to national security. Certain operational details and technical specifications often land here.
Only an Original Classification Authority — a government official specifically designated to make these calls — can apply a classification. That authority flows from the President through executive order and is delegated to agency heads and select officials below them. Anyone else who encounters information they believe needs protection has to send it to the appropriate authority for a decision within 30 days.2eCFR. 32 CFR 2400.8 – Limitations on Delegation of Original Classification Authority
Two default rules cut against overclassification. If there is significant doubt about which level fits, the information goes to the lower level. If there is significant doubt about whether it should be classified at all, it isn’t.
Classification is not permanent either. Information is automatically declassified after ten years unless the classifying authority determines it needs protection for up to 25 years, and every document must carry a declassification date or event at the time of classification.3eCFR. 15 CFR Part 4a – Classification, Declassification, and Public Availability of National Security Information
Controlled Unclassified Information Sits Outside This System
A large category of sensitive government information doesn’t qualify for a classification label at all. Controlled Unclassified Information, or CUI, covers material that laws or policies require agencies to protect without rising to a national security level — privacy records, proprietary business information submitted to the government, law enforcement sensitive material, and controlled technical data, among others. The CUI Program, codified at 32 CFR Part 2002, replaced an inconsistent patchwork of older markings like “For Official Use Only” with standardized rules across the executive branch.4eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI)
You do not need a security clearance to handle CUI. You do need to follow the prescribed controls, and mishandling it carries real consequences. CUI Basic follows a uniform set of baseline handling rules; CUI Specified applies when the authorizing law imposes particular requirements beyond that baseline.
How a Security Clearance Works
A security clearance is the government’s determination that you are eligible to access classified information at a given level. You cannot apply on your own. Only a federal agency or a government contractor with a classified contract can sponsor you, and the clearance is tied to a position that requires access — not to you as an individual seeking credentials.
Once sponsored, you complete Standard Form 86, a detailed questionnaire covering personal history, finances, foreign contacts, and employment.5U.S. Office of Personnel Management. Standard Form 86 Certification SF 86C The depth of the resulting investigation depends on the sensitivity of the position. Federal investigative standards break these into five tiers:
- Tier 1 (Low): the minimum investigation for non-sensitive positions needing basic facility access or credentialing.
- Tier 2 (Moderate): moderate-risk public trust positions that do not involve national security.
- Tier 3 (Moderate): the standard for Confidential and Secret clearances, covering non-critical sensitive positions.
- Tier 4 (High): high-risk public trust positions and Top Secret eligibility.
- Tier 5 (High): the most thorough investigation, required for Sensitive Compartmented Information access and the most sensitive positions.
Plan for a long wait. Top Secret clearances average over 240 days, and Secret clearances average more than 130. Backlogs fluctuate, and the government has been working to shorten timelines through automation and the Trusted Workforce 2.0 reforms, but months of processing time is normal.
Once you are cleared, the level makes you eligible. It is not a blank pass to see everything at that level. You still have to demonstrate a need to know: a verified connection between the specific information and your official duties. A Top Secret holder working on satellite programs has no business reading Top Secret counterterrorism reports, even though both share the same classification.
What Investigators Are Actually Looking For
The government evaluates clearance applicants against 13 broad criteria known as the National Security Adjudicative Guidelines, published under Security Executive Agent Directive 4:7Director of National Intelligence / NCSC. National Security Adjudicative Guidelines for Determining Eligibility for Access to Classified Information or Eligibility to Hold a Sensitive Position
- Allegiance to the United States
- Foreign Influence
- Foreign Preference
- Sexual Behavior
- Personal Conduct
- Financial Considerations
- Alcohol Consumption
- Drug Involvement and Substance Misuse
- Psychological Conditions
- Criminal Conduct
- Handling Protected Information
- Outside Activities
- Use of Information Technology
Adjudicators apply a whole-person analysis, weighing mitigating factors against concerns. Financial problems are the most common reason clearances get denied or revoked. Debt itself is not disqualifying; unmanaged debt suggests vulnerability to coercion or poor judgment. Past marijuana use likewise doesn’t automatically disqualify anyone. The Director of National Intelligence has clarified that past recreational use is relevant but not determinative, and agencies weigh how recent, how frequent, and whether the applicant has committed to stopping. Ongoing use remains a serious problem because marijuana is still illegal under federal law regardless of state legalization.
The single biggest mistake applicants make is lying or omitting information on the SF-86. Investigators expect imperfect histories. They are far more concerned about dishonesty, which raises trustworthiness questions no mitigating factor can easily resolve.
Access Beyond the Standard Levels
Some information is so sensitive that a Top Secret clearance alone does not get you in the door. Two additional control systems restrict access further.
Special Access Programs impose safeguarding and access controls that exceed what is normally required at the same classification level.8Department of Defense Issuances. DoD Directive 5205.07 – Special Access Program Policy Acknowledged SAPs are programs whose existence is publicly known and whose budgets are generally unclassified. Unacknowledged SAPs go further: even the program’s existence is concealed, its purpose is not disclosed, and its funding is either classified or not linked to the program in public records.9CDSE. Special Access Program (SAP) Types and Categories Both types are reported annually to the relevant congressional committees.
Sensitive Compartmented Information is classified intelligence derived from intelligence sources, methods, or analytical processes. Access is managed through compartments established by the Director of National Intelligence, and each compartment can carry its own access rules on top of the underlying clearance.
For both SAPs and SCI, you must be formally read in to a specific program or compartment through signed acknowledgments and briefings. Access is limited to the minimum number of people necessary, each with a validated need to know, the appropriate underlying clearance, and any additional personnel security requirements the program imposes.
Obligations After You’re Cleared
Getting cleared is not a one-time event. The old model relied on periodic reinvestigations every five or ten years. Under Trusted Workforce 2.0, that model is being replaced by continuous vetting — automated systems that monitor various databases and flag changes in a cleared person’s circumstances as they occur.10Performance.gov. Trusted Workforce 2.0 Transition Report The national security workforce was fully enrolled in continuous vetting by the end of 2022, and the non-sensitive public trust population was targeted for complete enrollment around the end of 2025.
Cleared individuals also have affirmative self-reporting duties under Security Executive Agent Directive 3, and those duties intensify with your level of access.11Director of National Intelligence / NCSC. Security Executive Agent Directive 3 – Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position
All cleared personnel must submit itineraries for unofficial foreign travel and generally get approval before traveling. Deviations from approved plans, or unplanned day trips to Canada or Mexico, must be reported within five business days of returning.
Secret and Confidential holders must also report applying for or receiving foreign citizenship, possessing or using a foreign passport, and going bankrupt or falling more than 120 days delinquent on any debt.
Top Secret holders carry the broadest requirements. On top of everything above, they must report involvement in foreign businesses, foreign bank accounts, ownership of foreign property, voting in a foreign election, marriage, cohabitation, new foreign national roommates, and any unusual financial windfall of $10,000 or more, including inheritances and gambling winnings.
Failing to report is not just a security concern. It is a separate personal conduct issue that can independently justify revoking a clearance.
Reciprocity When You Change Jobs
If you already hold a valid clearance and move to a different agency or contractor, the receiving organization is generally required to accept your existing clearance rather than restart the investigation. Reciprocity is established by the Intelligence Reform and Terrorism Prevention Act of 2004 and reinforced by Executive Order 12968 and later guidance from the Director of National Intelligence.12Director of National Intelligence. Reciprocity Policy
Exceptions exist. An agency can deny reciprocity under documented circumstances, and intelligence community elements have additional latitude to protect sources and methods. In practice, transfers can still hit bureaucratic friction. Knowing the policy exists gives you standing to push back if a new employer claims you need a completely new investigation.
Penalties for Mishandling Classified Information
Consequences range from career-ending administrative action to serious prison time, depending on what happened and whether it was intentional.
Administratively, security violations can lead to clearance suspension or revocation. For military personnel and many civilian employees, losing a clearance effectively ends the role. A soldier whose position requires a clearance may be forced into a different specialty or involuntarily separated.
Criminal penalties escalate with the conduct. Knowingly removing classified documents and storing them at an unauthorized location carries up to five years in prison.13Office of the Law Revision Counsel. 18 USC 1924 – Unauthorized Removal and Retention of Classified Documents or Material Gathering, transmitting, or losing defense information under the Espionage Act carries up to ten years and covers a range of negligent and intentional conduct.14Office of the Law Revision Counsel. 18 USC 793 – Gathering, Transmitting or Losing Defense Information Knowingly disclosing classified communications intelligence, cryptographic information, or similar material to an unauthorized person also carries up to ten years.15Office of the Law Revision Counsel. 18 USC 798 – Disclosure of Classified Information
Prosecutors have discretion, and not every mishandling incident results in criminal charges. The investigation itself can be career-destroying, and administrative consequences often follow even when no charges are filed.
Appealing a Clearance Denial or Revocation
If your clearance is denied or revoked, you have the right to challenge that decision. The process begins with a Statement of Reasons explaining which adjudicative guidelines raised concerns. You can respond in writing and request a hearing before an administrative judge at the Defense Office of Hearings and Appeals.
If the judge rules against you, the deadlines are tight. Your notice of appeal must reach the DOHA Appeal Board within 15 calendar days, and your appeal brief is due within 45 days. The government then has 20 days to respond. Missing these deadlines can end your appeal rights entirely.16DOHA. A Short Description of the DOHA ISCR Appeal Process
The Appeal Board does not hear new evidence or re-evaluate the facts. It conducts a limited review for legal error. Beyond the Appeal Board, there is generally no further appeal. Legal counsel experienced in security clearance matters can help, and while representing yourself is permitted, the process is adversarial enough that self-representation puts you at a meaningful disadvantage — particularly when foreign contacts or complex finances turn on how adjudicators weigh mitigating factors.