(a) NARA may withhold from disclosure, in accordance with 5 U.S.C. 552(b)(2), the following:

(1) Records that contain information on substantial internal matters of agencies that, if disclosed, could risk circumvention of a legal requirement, such as a statute or an agency regulation.

(2) Records containing information that states or assesses an agency's vulnerability to outside interference or harm. NARA withholds records that identify agency programs, systems, or facilities deemed most sensitive. NARA also withholds records describing specific measures that can be used to counteract such agency vulnerabilities.

(b) The Archivist of the United States may determine that this general restriction does not apply to specific records because enough time has passed that agency statutes or regulations would not be compromised and programs, systems, and facilities would not be harmed.