Derivative classification is the reproducing, extracting, or summarizing of classified information, or the application of classification guidance from an existing document to a new one. If you've ever worked in defense contracting, federal government agencies, or intelligence sectors, you've likely encountered this requirement. Unlike original classification—which determines that specific information requires protection because its unauthorized disclosure could damage national security—derivative classification relies entirely on pre-existing source material.
Understanding how to execute this process correctly protects sensitive information and prevents accidental security violations. Mistakes in this domain can lead to compliance failures, administrative penalties, or unauthorized disclosures. This guide covers the legal basis, practical steps, and common pitfalls of derivative classification.
The Legal and Regulatory Framework
Derivative classification doesn't happen in a vacuum. It operates under strict federal oversight, primarily governed by Executive Order 13526 in the United States, which outlines the prescribed system for classifying, safeguarding, and declassifying national security information.
When you create a derivative document, you are acting as an extension of an original classification authority (OCA). You aren't making a new policy decision about what is secret; you are recognizing that the content you're handling mirrors facts already classified by someone else.
Key Principles of the Framework
- Source Tracking: Every piece of derived information must tie directly back to an authorized classification guide (SCG) or a previously classified source document.
- No Upward Reclassification: You cannot arbitrarily raise the classification level just because multiple unclassified or lower-classified items are brought together, unless specifically authorized by an SCG.
- Duration of Classification: Derived products carry the same declassification instructions as the source material unless specified otherwise.
Step-by-Step Guide to Derivative Classification
Executing derivative classification requires methodical attention to detail. Skipping a step or guessing at classification levels invites compliance risks.
1. Identify the Source Material
You can't classify derivative work without a clear point of origin. Start by gathering all source documents, contracts, or Security Classification Guides (SCGs) that apply to your project.
- Check the SCG: The SCG is your primary blueprint. It lists specific elements of a program, technology, or operation and states whether they are unclassified, confidential, secret, or top secret.
- Inspect Source Documents: If you're pulling facts from an existing report, check its classification block to confirm its markings and declassification date.
2. Analyze the Content for Classified Facts
As you draft your new document, evaluate every paragraph, sentence, and data point against your source material. Ask yourself whether the information you've written reveals a classified fact, figure, vulnerability, or capability.
For example, if a source document states that a specific radar component operates at a frequency band of 8 to 12 GHz, and your new technical manual repeats that exact pairing, that specific fact is derived and must be marked accordingly.
3. Determine the Classification Level
Match each extracted fact to the corresponding level dictated by the source document or SCG.
- If the source is Secret, your derived content incorporating that specific fact is Secret.
- If you combine unclassified facts from multiple sources, the result remains unclassified unless the SCG explicitly states that the specific compilation creates a classified vulnerability.
4. Apply Proper Markings
A derivative document must explicitly display its classification posture so downstream readers know how to handle it. Proper marking requires three distinct elements on the face of the document:
- Overall Classification: The highest level of classification contained in the document must appear at the top and bottom of every page.
- Portion Markings: Each section, paragraph, and sometimes title must be marked with parentheses indicating its level:
(U)for unclassified,(C)for confidential,(S)for secret, or(TS)for top secret. Place these immediately before the affected text. - Derivative Authority Block: The bottom of the first page or the cover must include a "Classified By" line, a "Reason" line (if applicable under older guidelines), and a "Declassify On" line derived directly from the source documents.
You can review specific marking templates and standards through the Defense Counterintelligence and Security Agency reference portal.
Common Mistakes to Avoid
Even experienced professionals occasionally trip over subtle procedural rules. Watch out for these frequent missteps:
- Over-Classification: Marking unclassified information as classified just to be "safe." This violates federal policy, restricts lawful information sharing, and clogs secure systems with unnecessary overhead.
- Vague Source Attribution: Citing a general project name instead of specific source documents or SCG sections in the authority block. Auditors look closely at traceability.
- Ignoring Declassification Instructions: Copying an old declassification date without verifying whether the source material has been extended or updated.
Frequently Asked Questions
What is the difference between original and derivative classification?
Original classification is the initial determination that specific information requires protection in the interest of national security, performed exclusively by authorized officials. Derivative classification is the act of incorporating, paraphrasing, or summarizing that already-classified information into a new document.
Do I need a security clearance to perform derivative classification?
Yes. Handling, analyzing, and marking classified information requires an active security clearance commensurate with the level of data being processed, along with formal derivative classification training.
Can unclassified facts become classified when combined?
Yes, this is known as the "mosaic theory" or compilation effect. However, you cannot make this determination on your own. It must be explicitly spelled out in the applicable Security Classification Guide (SCG).
How often must I renew my derivative classification training?
Federal regulations and Department of Defense guidelines typically require personnel with derivative classification responsibilities to complete refresher training every two years.
