A distribution statement is included in official documents to denote the minimum security level required to read it. While most people would assume a distribution statement would only be found in military or government documents, this is not the case. A large number of private organizations, particularly large companies, banks and research firms, use these statements as well. While many different methods of securing information exist, most systems are based on the five-level American military system, the four-level business system or the four-level inter-organizational system.
The distribution statement is generally very prominent on the document. If there is a cover page, it isn’t uncommon for the statement to be printed both at the top and bottom of the page. Inside the document, the distribution statement is generally found at the top of the first page among the header information. These prominent positions assure the owners that anyone who reads the document will either have proper clearance or intentionally disregard the statement.
One of the most well-known types of distribution statement is the five level one used by the American military, as well as many other Western military groups. The highest tier is Top Secret, meaning only people with the highest levels of clearance are able to read the document. It then descends down through security levels: Secret, Confidential, Restricted and Sensitive but Unclassified. The final level is Unclassified and is available to anyone.
Many businesses use a similar distribution statement system. The basic system has Confidential at its highest level followed by Private, Sensitive and Public. In many cases, this system is much more relaxed than the government version. On the other hand, when a business works heavily with the government or the military, it isn’t uncommon for them to adopt a similar security system. This is especially common when people within the company have government security clearance as part of their normal jobs.
The last common system is best known as traffic light security. This system functions on the principle that most people have an ingrained viewpoint of certain colors. In this system, red documents are only available to the highest level. Yellow has a wider audience and green documents are available to anyone in the organization. The last color, white, is open to the public.
This system is common when different organizations are working together on a project. Instead of trying to integrate two different security systems, the traffic light option is used instead. This system also works well when the cooperating organizations don’t speak the same language, since a written distribution statement could be misinterpreted. The only restriction is the individual country’s perception of the various colors.
