What is the difference between a restricted and confidential document?

ISO/IEC 27002 (cl. 5.12) presents “restricted” as the highest-sensitivity label, accessible only to specifically approved persons on a strict need-to-know basis, whereas “confidential” is normally available to a wider, pre-authorised group that still requires protection but with less stringent limitation. Therefore, “Restricted – shared among named individuals” and “Confidential – shared among an authorised group” is the accurate distinction.

A. Inverts the normal hierarchy: makes Confidential more restrictive than Restricted, contradicting ISO/IEC 27002 examples.

C. “Confidential – shared across the organisation only” gives organisation-wide access, exceeding the limited-group access defined for confidential information.

D. “Confidential – shared with friends and family” is outside any ISO/IEC 27000-series control and violates need-to-know principles.

1. ISO/IEC 27002:2022, Clause 5.12, Note 1 & Example classification list – “…labels such as ‘Restricted’ (highest, need-to-know, named individuals) and ‘Confidential’ (authorised groups)…” (pp. 35-36).

2. ISO/IEC 27002:2013, Clause 8.2.1, Note 2 – Example four-level scheme showing ‘Restricted’ above ‘Confidential’.

3. MIT Information Security Office, “Data Classification Guidelines”, §3 “Restricted Data vs. Confidential Data” – restricted = specific named users; confidential = wider authorised groups (2021 courseware hand-out).

4. University of California Berkeley, “Data Classification Standard”, Table 1 – Protection Level 4 ‘Restricted’ (named individuals) vs. Level 3 ‘Confidential’ (authorised groups) (rev. 2022).