The difference between the minimum clearance or authorization of information system (IS) users and the maximum sensitivity (e.g., classification and categories) of data processed by the system.