Derivative classification is the process of incorporating, paraphrasing, restating, or generating new forms of information that is already classified, and ensuring that the resulting product carries the correct classification markings. Unlike original classification—which is the initial determination that specific information requires protection in the interest of national security—derivative classification relies entirely on pre-existing source material or authorized guidance.
If you hold a security clearance or work within defense contracting, mastering this process keeps you compliant with federal standards and prevents unauthorized disclosures. This guide breaks down the core principles, essential reference tools, marking mechanics, and common compliance traps associated with handling classified source data.
Core Principles of Derivative Classification
When you create new documents based on sensitive government data, you aren't making a fresh judgment call about secrecy. You are acting as a bridge, carrying forward existing protection levels. Three primary concepts govern how you determine whether your new text requires protection:
- Contained In: This applies when your new material explicitly uses facts, figures, or statements directly taken from a classified source document without altering their substance.
- Revealed By: This occurs when your new text doesn't quote the source directly, but a reader can logically deduce the classified information by performing additional interpretation or analysis.
- Classification by Compilation: This happens when you combine individually unclassified pieces of information into a single product, and that specific aggregation reveals a classified picture.
You must never assume information is safe to release just because you changed the wording. If the underlying meaning originates from a classified source, the new output inherits those security requirements.
Authorized Sources for Guidance
You cannot guess classification levels. Before you write or publish any document referencing sensitive topics, you must consult specific authorized resources to verify markings.
The primary tools at your disposal include:
- Security Classification Guides (SCGs): Issued by program managers or original classification authorities, these documents act as blueprints. They list specific elements of a project, system, or contract and state their exact classification level, reasons, and declassification instructions.
- Previously Classified Source Documents: If you are drafting a response to a report, contract, or memo, the source document itself provides the baseline. You look at its portion markings and overall banner to see what rules apply.
Relying on memory or informal office habits violates standard protocols. If guidance is missing, ambiguous, or contradictory, you're required to pause and seek clarification from your facility security officer or primary security manager before proceeding.
Step-by-Step Execution of Derivative Classification
Executing this process correctly requires a systematic approach to analyzing text and applying administrative controls.
- Analyze the source material: Review your working drafts alongside your authorized SCGs to isolate which sentences, paragraphs, or data points originate from classified contexts.
- Determine classification levels: Match each piece of information to its mandated level—typically Confidential, Secret, or Top Secret. If multiple sources apply to a single paragraph, the highest level dictates the overall marking.
- Apply portion markings: Place parenthetical markers (e.g., (U), (C), (S), or (TS)) directly before every paragraph, section, header, and chart to denote its specific classification status.
- Add banner and authority lines: Insert overall banner markings at the top and bottom of pages. Include a "Derived From" line citing your source document or SCG, a "Classified By" line naming your identity and position, and a "Declassify On" line matching your source guidance.
According to the Defense Counterintelligence and Security Agency, taking shortcuts during this marking phase is a primary driver behind inadvertent security violations and reportable infractions across government and contractor networks.
Common Compliance Mistakes to Avoid
Even experienced analysts run into trouble when rushing through documentation. Watch out for these frequent missteps:
- Over-classification: Marking unclassified data as sensitive "just to be safe" clogs secure systems and violates executive orders. Only classify what is explicitly supported by your guidance.
- Ignoring source expiration: Copying a "Declassify On" date from an old document without verifying whether the underlying event or timeline has changed.
- Vague source citations: Writing "Multiple Sources" on your derivation line instead of listing the specific SCGs or documents used for the compilation.
- Unsecured drafting: Typing classified drafts on unapproved local machines or processing notes outside of secure facilities like the SIPRNET.
Frequently Asked Questions
Do I need original classification authority to perform derivative classification?
No. Original classification authority belongs exclusively to authorized officials designated by the president or agency heads. Derivative classifiers simply inherit and apply those established determinations using approved guides.
What should I do if I suspect information is improperly classified?
You have a professional obligation to challenge classifications you believe are too high or incorrect. Submit a formal challenge through your organization's security management chain without fear of reprisal.
Can unclassified facts become classified when grouped together?
Yes. This is known as classification by compilation. Even if individual sentences contain everyday public knowledge, placing them into a specific sequence or context can reveal a protected vulnerability.
Where do I find the declassification date for my new document?
You must pull the declassification instructions directly from the "Declassify On" line of your source document or from the specific project Security Classification Guide. Never guess a future date.
