What's the difference between a security classification and a dissemination control marking like NOFORN or ORCON?

A security classification and a dissemination control marking answer two different questions about the same record. The classification level tells you how sensitive the information is. The dissemination control tells you who may receive it once it has been classified. They appear together on the same document, but they are not interchangeable.

Security classification: the level of harm

A classification level reflects the degree of damage to national security that unauthorized disclosure could reasonably be expected to cause. The familiar levels—Confidential, Secret, and Top Secret—form a hierarchy, with each step indicating greater potential harm. Assigning a level is an act of original or derivative classification, performed under the governing executive order on classified national security information and overseen by the Information Security Oversight Office.

The classification level, by itself, says nothing about nationality, agency, or onward sharing. A Secret document and a Top Secret document are simply rated at different sensitivity tiers.

Dissemination controls: limits on sharing

Dissemination control markings narrow the audience within the population already cleared for that classification level. They are sometimes called handling caveats. Common examples include:

• NOFORN (“Not Releasable to Foreign Nationals”) — restricts access to U.S. persons, even if a foreign partner holds an equivalent clearance.
• ORCON (“Originator Controlled”) — requires the originating agency’s permission before the information may be shared beyond the initial recipients.

A properly cleared official with Top Secret access may still be barred from a specific document because of a NOFORN or ORCON caveat. The clearance establishes eligibility; the dissemination control adds a further, distinct gate.

Why the distinction matters for records work

When you review records for declassification, FOIA, or transfer, you must address both layers. Removing or downgrading a classification level does not automatically lift a dissemination control, and a caveat may reflect an equity belonging to another agency. Treating the two as one risk can lead to improper release or improper withholding.

This level-versus-handling structure also echoes how unclassified sensitive information is managed under the Controlled Unclassified Information program, where a category and its limited-dissemination markings work as separate but complementary signals.

For related guidance, see the declassification topic hub.