Declassification

Declassification is the formal decision that information no longer needs its classification. Sensitivity changes over time: a product launch plan is confidential until launch day and public afterwards. Over-protecting such information wastes effort and hinders legitimate sharing. In US government usage, Executive Order 13526 defines declassification as an authorised change from classified to unclassified, and calls a move to a lower classification level downgrading. Commercial practice often uses the one word for both.

The decision belongs to the data owner, or to an authorised declassification authority in government, not to whoever holds a copy. Labels can carry a review date or a declassification event, and periodic reviews catch data whose sensitivity has lapsed. Declassifying information is a different act from releasing the media it was stored on. Because of data remanence, media that held classified data generally needs media sanitisation before reuse at a lower level, even when some of its contents have been declassified. Marking and labelling must then be updated so the new level is visible to users.

Exam relevance: a scenario is likely to describe information that has become public or aged out of its sensitivity, and ask who may change its label or what must happen to its media. Candidates are expected to route the decision to the owner and to keep it separate from sanitising media.