Information is classified based on how much damage the material would do to National Security. There are technically only 4 levels of classification: Unclassified, Classified, Secret, and Top Secret, but there are other descriptions that can be attached to those classifications to further instruct how to handle those materials. As an example SBU refers to something that is Sensitive but Unclassified. There are also things called “Read Ons” where you may have the correct clearance to handle a particular level of classified material but you need to be “read on” to some special instructions that are specific to that document, building, room, etc.
There is a classification authority that provides guidance and determines what is and is not classified and what level of classification is proper however 1) it really isn’t clear what the difference is between the varying degrees of damage information may do and 2) individual agencies in the government are responsible for labeling material the proper classification.
As far as who gets access, everything is needs to know. So even if you have a Top Secret clearance you are only given access to information that is necessary for you to do your job regardless of the classification of the material that you want. Typically the highest ranking person in the chain of whoever has that information and whoever wants that information makes that determination.
Other important notes:
Things that can hold a classification: Documents, CDs, Thumbdrives, Computers, Phones, LAN lines, Networks, Rooms, Buildings, Etc. *All of these things have a level of classification and you have to ensure that you are not handling high level classified material on things that have lower levels of classification. IE You can’t have a conversation about Top Secret information on an unclassified phone.
Material is classified “at birth”. As soon as you have a piece of information whether it is in writing, verbal, or digitized, that material is classified. If I am discussing via phone, activities that I am conducting with my job, that discussion is classified at one of those levels regardless of whether or not anyone formally puts a stamp on the conversation or announces that the conversation is classified. At some point I would need to put that information into a report and label it correctly but not labeling it doesn’t mean it’s unclassified. If anything me not labeling that information in the correct manner or not having the conversation over a properly secured channel is grounds for punishment and potentially losing my clearance.
There is also a procedure for “declassifying” things but typically, at least at my level, once something has a certain level of classification we only make it more classified, not less. We don’t declassify things because it’s timely and there really isn’t a reason to have to do it. The whole point of classification is to compartmentalize information, not make it so that more people can see it.
An entire conversation, report, etc also all holds the level of classification for the highest classified material of any piece of that thing regardless of how much information is present. So if you have a 500 page document that is all unclassified but one line is Top Secret, the entire document is labelled Top Secret. There is a “proper” way of doing this that prevents the entire document from having to be labelled Top Secret but it’s extremely time consuming so it’s just easier for us to label entire documents by the classification of the most sensitive piece of material.