"SBU has not been defined in statutory law. When using the term, some
agencies refer to definitions for controlled information, such as
"sensitive," in the Computer Security Act, and to information exempt
from disclosure in the Freedom of Information Act (FOIA) and the
Privacy Act. The identification of information to be released pursuant
to these laws may be discretionary, subject to agency interpretation
and risk analysis."
