Which of the Following Are Authorized Sources for Derivative Classification
If you've ever sat in front of a classified document and wondered, "Wait — can I even use this to create something new?" you're not alone. Derivative classification is one of those areas where the rules matter enormously, but they're not always explained in a way that makes practical sense. Get it wrong, and you're looking at potential security violations. Get it right, and you're protecting sensitive information while doing your job effectively.
So let's cut through the confusion. Here's what actually qualifies as an authorized source for derivative classification — and what doesn't.
What Is Derivative Classification, Exactly?
Derivative classification is the process of creating, developing, or producing a new document that incorporates, paraphrases, restates, or generates classified information from an existing classified source. You're not inventing new secrets here. You're taking something that's already been classified by an authorized authority and using it to create something else — a new report, a briefing paper, an email, whatever the work requires.
Here's the key point: you can only derivatively classify from sources that are themselves properly authorized to establish classification. That means the original source had to come from someone with the legal authority to make classification decisions in the first place — an Original Classification Authority, or OCA And it works..
This isn't a gray area. The problem is most people never get trained on the specifics, or they assume "any classified document" is fair game. The rules are actually pretty clear about which sources count and which don't. That's where things go wrong Not complicated — just consistent. Nothing fancy..
Why It Matters
Here's why you should care about getting this right. Because of that, derivative classification errors are among the most common security violations in classified environments. We're not talking about malicious leaks — we're talking about well-intentioned people who didn't realize they were using an unauthorized source, or who misapplied classification guidance, or who relied on something that looked legitimate but wasn't Took long enough..
The consequences are real. In practice, improper derivative classification can result in overclassification (making information harder to share unnecessarily) or underclassification (failing to protect information that should be protected). Overclassification clogs up the system and makes collaboration harder. Both cause problems. Underclassification can actually harm national security But it adds up..
Beyond that, there are personal consequences. Plus, willful or negligent unauthorized disclosure of classified information is a crime. Even accidental mishandling can end careers and trigger security investigations Most people skip this — try not to..
So yeah — it matters.
How Derivative Classification Works
The process itself is straightforward in theory. You identify classified information from an authorized source, you incorporate it into a new document, and you apply the appropriate classification markings. But the critical first step is making sure your source is actually authorized No workaround needed..
Classification Guides
This is the most common and most reliable authorized source. Classification guides are formal documents issued by Original Classification Authorities that tell you what information within their jurisdiction is classified, at what level, and why. Think of them as the instruction manual for a specific topic area.
Classification guides come in different forms:
- Agency-specific guides issued by OCAs within a particular department or agency
- National-level guides that cover information across multiple agencies
- Program-specific guides that address particular classified programs or initiatives
The key thing about classification guides is that they're authoritative. Here's the thing — if a classification guide says something is classified at the Secret level, you can use that as the basis for derivatively classifying your own document. The guide itself is the authorization.
Derivatively Classified Documents
Here's where it gets a little more nuanced. You can use other derivatively classified documents as sources — but only if they were properly marked and classified in the first place Surprisingly effective..
The logic works like this: if someone else already went through the proper process, used an authorized source, and correctly applied classification markings, then you can rely on their work as a valid basis for your own derivative classification. The chain of custody matters. Their document should show:
- The classification level (Top Secret, Secret, Confidential)
- The specific basis for classification (which source and what authority they used)
- Any relevant caveats or handling instructions
If any of that is missing, or if you have reason to believe the original classification was improper, you need to treat that document with caution Surprisingly effective..
Original Classification Decisions
Sometimes you'll have access to original classification decisions documented in classification management systems or decision logs. These are the authoritative determinations made by OCAs when they first decided information should be classified.
These decisions typically document:
- What specific information was classified
- At what level
- The classification rationale
- The applicable classification guidance
If you can trace back to a valid original classification decision, that's absolutely an authorized source for your derivative work.
Executive Orders and National Policy Directives
The foundational authority for the entire classification system comes from Executive Orders issued by the President. The main one currently in effect is Executive Order 13587, which establishes the framework for structural reforms to improve classified document security and sharing.
These executive orders don't typically classify specific information themselves, but they establish the rules for how classification works. They tell you who can classify, what the levels mean, what can and can't be classified, and what procedures must be followed. Understanding these directives is essential context for doing derivative classification properly Less friction, more output..
ISOO Directives and Guidance
The Information Security Oversight Office (ISOO) issues directives and guidance that implement the requirements of executive orders. These documents provide the detailed procedures and requirements for both original and derivative classification.
ISOO directives (like those in 32 CFR Parts 2001 and 2003) are authoritative guidance on how the classification system operates. They don't typically serve as direct sources for derivatively classifying specific information, but they're essential references for understanding the rules of the road.
What Does NOT Count as an Authorized Source
Now here's where a lot of people get into trouble. There are plenty of sources that look like they should be valid, but aren't It's one of those things that adds up. That's the whole idea..
Unmarked or improperly marked documents — If a document doesn't have classification markings, or if the markings are wrong or incomplete, you can't use it as an authorized source for derivative classification. The absence of proper markings is a red flag Worth keeping that in mind..
Documents classified based on outdated guidance — Classification guidance changes. If you're using a source that was classified under old guidance that has since been revised or rescinded, you need to verify it's still valid Easy to understand, harder to ignore..
Unverified oral information — Someone telling you something is classified in a conversation isn't enough. You need documented, authoritative sources.
Classified information from allied nations — This gets complicated and depends on specific sharing agreements. Generally, you can't derivatively classify from foreign government information unless there's an explicit authorization to do so.
Your own assumptions — Never, ever classify information based on your own judgment that it "seems classified." That's not how the system works. You need an authorized source.
Common Mistakes People Make
Let me be honest — derivative classification is one of those areas where the gap between "what the rules say" and "what people actually do" is pretty wide. Here are the mistakes I see most often:
Assuming all classified documents are valid sources. Just because something is marked "Secret" doesn't mean the original classification was done correctly. If the source document doesn't show the proper classification basis, or if you suspect errors, you need to verify before using it But it adds up..
Relying on memory instead of checking. People sometimes think they remember what was in a classified document and use that as the basis for their own classification. That's not derivative classification — that's guesswork. You need to go back to the actual source.
Ignoring classification guides. Guides exist specifically to help you. If there's a classification guide relevant to your topic, you should be using it. It's literally the most authoritative source available.
Not updating when guidance changes. Classification guidance gets revised. If you're working with information that was classified under an older guide, check whether that guidance is still in effect.
Practical Tips for Getting It Right
Here's what actually works:
-
Always start with classification guides relevant to your topic. These are your first and most reliable source.
-
Check the source document's markings before using it. Look for the classification level, the source/authority line, and any handling caveats. If something's missing, investigate Most people skip this — try not to..
-
When in doubt, ask. Your security office or classification authority exists for a reason. If you're unsure whether a source is authorized, ask before you proceed That's the whole idea..
-
Document your classification basis. When you derivatively classify, you need to show why the information is classified and what authorized source you're relying on. This is for your protection as much as anything else Turns out it matters..
-
Keep up with changes. Classification guidance isn't static. Check periodically to make sure you're working with current information Not complicated — just consistent..
FAQ
Can I use a classified email as a source for derivative classification? Yes, if the email is properly marked with classification level, the source of classification, and handling instructions. Treat it like any other classified document.
What if I can't find an authorized source but I'm certain the information is classified? You can't derivatively classify without an authorized source — period. If you believe information should be classified but there's no guidance or source to support it, you need to consult with an Original Classification Authority or your security office Simple as that..
Are classification guides available to everyone with a clearance? Not always. Some classification guides are themselves classified. But your security office should be able to tell you what guides are relevant to your work and whether you have access Simple, but easy to overlook. Took long enough..
Can I derivatively classify from a document that was originally classified at a higher level than what I'm producing? Yes, you can. If the source is classified at the Secret level, you can derivatively classify your document at Secret (or Confidential, if the specific information warrants a lower level). The key is that you're applying the classification correctly based on what's actually in the source.
What happens if I use an unauthorized source by mistake? If you discover an error, correct it as soon as possible. Report it to your security office, fix the markings on your document, and document what happened. Honest mistakes happen — the system is designed to catch and correct them. The problems come when people ignore errors or don't bother to check in the first place.
The Bottom Line
Derivative classification isn't complicated once you understand the rules — but those rules matter. Which means properly marked documents are valid sources. Still, classification guides are your best friend. Everything else needs a closer look.
The simplest way to stay out of trouble: when you're not sure, ask. Your security office, your classification authority, your supervisor — someone in that chain knows the answer. It's always better to take five minutes to verify than to spend months dealing with the consequences of a classification error Nothing fancy..
Get it right, and you'll protect the information you're trusted with while doing your job effectively. That's the whole point It's one of those things that adds up..
