What is the difference between a restricted and confidential document?

Widely-adopted corporate and academic classification schemes place “Restricted” at a higher sensitivity level than “Confidential.” Restricted information (often called “High-Risk”) may be released only to individually named, specifically authorized persons who have a strict business need-to-know. Confidential information (often called “Moderate-Risk”) is still sensitive but may be disseminated to a broader, pre-defined group whose members perform a common function or belong to the same organization unit. This mapping aligns with ISO/IEC 27002’s requirement that access controls become increasingly granular as information sensitivity rises.

A. Reverses the normal sensitivity ordering; Confidential is not normally narrower than Restricted.
C. “Across the organization” is broader than typical “Confidential” scope and contradicts most classification schemes.
D. “Friends and family” are never an authorized audience under an ISMS.

1. ISO/IEC 27002:2022, cl. 5.12 & 5.13 – escalating control requirements with higher sensitivity.

2. Stanford Univ. Information Security Office, “Data Classification Guidelines,” v.2022-04, Table 1: High-Risk (Restricted) vs. Moderate-Risk (Confidential).

3. MIT Information Protection Policy, §3.2, 2021 – Restricted information limited to individually authorized users.