Executive Order 13526 is the presidential directive that governs how the federal government classifies, protects, and eventually releases national security information. President Barack Obama signed it on December 29, 2009, replacing Executive Order 13292 and setting a more standardized framework across agencies, with a stated push to reduce over-classification and move records back into the public domain on a predictable schedule. It applies to most national security information, but not to nuclear weapons data classified under the Atomic Energy Act, which follows its own rules.
The Three Classification Levels
EO 13526 sorts classified information into three tiers based on the damage its unauthorized release could cause. The person making the decision must be able to identify or describe the specific damage; a vague sense that something ought to be secret does not meet the standard.
- Top Secret applies when unauthorized disclosure could reasonably be expected to cause “exceptionally grave damage” to national security.
- Secret applies when disclosure could cause “serious damage” to national security.
- Confidential is the lowest tier, used when disclosure could cause identifiable damage to national security.
Each level triggers different handling and storage requirements, but the underlying test is the same across all three.
Who Can Classify Information
Original Classification Authority
Original classification authority (OCA) is the power to decide, in the first instance, that certain information warrants protection. Under EO 13526, only three categories of officials hold this power: the President and Vice President; agency heads and officials the President specifically designates; and government officials who receive a written delegation from those designees. That delegation cannot be passed further down the chain, and agencies must keep it to the minimum necessary.
The rules tighten at higher levels. Only the President, Vice President, or a designated agency head can delegate Top Secret authority. Secret and Confidential authority can also be delegated by certain senior agency officials, but only if that official already holds Top Secret authority. Every delegation must be in writing, must identify the official by name or position, and must be reported to the Information Security Oversight Office.
Derivative Classification
Most classification decisions in daily government work are derivative, not original. Someone incorporating, restating, or summarizing information that an OCA already classified is a derivative classifier. A policy analyst writing a briefing that draws from three classified source documents falls in this category. The analyst does not need OCA status, but must carry forward the classification markings from the originals, including the longest declassification timeline among them.
Derivative classifiers must complete training on proper marking and the avoidance of over-classification at least once every two years. Miss that window and the authority to apply classification markings is suspended until the training is complete. This is where the bulk of classification activity happens, and also where over-classification tends to creep in, because a cautious classifier may default to the highest source marking rather than evaluating what the material actually requires.
What Can and Cannot Be Classified
EO 13526 limits classification to information that falls within one of eight specific categories. If information does not fit any of them, it cannot be classified regardless of how sensitive someone believes it is:
- Military plans, weapons systems, or operations
- Foreign government information
- Intelligence activities, sources, methods, or cryptology
- Foreign relations or foreign activities of the United States
- Scientific, technological, or economic matters relating to national security
- Programs for safeguarding nuclear materials or facilities
- Vulnerabilities or capabilities of national security systems and infrastructure
- Development, production, or use of weapons of mass destruction
Even when information fits one of these categories, the classifying official must identify specific, describable damage that disclosure would cause. The order also draws hard lines: classification can never be used to conceal legal violations, cover up waste or inefficiency, prevent embarrassment, restrain competition, or delay the release of information that does not genuinely need protection. If there is significant doubt about whether something needs classification, the order says it should not be classified.
How Long Classification Lasts
Every original classification decision must include a specific date or event that triggers automatic declassification. The classifying official is expected to choose the shortest reasonable timeframe. When an earlier date cannot be determined, the default is 10 years from the original decision. If the sensitivity genuinely requires more time, the official can extend the period up to 25 years, but must justify the longer duration.
Two narrow exceptions allow classification beyond 25 years without going through a formal exemption process: information that would reveal the identity of a confidential human intelligence source, and information that would reveal key design concepts of weapons of mass destruction. Everything else hits the 25-year automatic declassification wall unless an agency head secures a specific exemption.
Safeguarding Classified Information
Access to classified information requires two things: a security clearance at the appropriate level and a demonstrated need to know the specific information. A Top Secret clearance does not entitle someone to see all Top Secret material. There must be a legitimate reason tied to the person’s duties.
The federal background investigation system uses a tiered structure. A Tier 3 investigation covers non-critical sensitive positions and supports Secret eligibility. A Tier 5 investigation, far more extensive, covers critical sensitive positions and is required for Top Secret eligibility. A Tier 5+ investigation supports access to Sensitive Compartmented Information (SCI). All cleared personnel sign nondisclosure agreements before handling classified material.
Handling requirements are strict. Classified documents must be stored in approved security containers, and discussions must take place in secure facilities. Digital records require air-gapped or encrypted systems designed to prevent unauthorized access. Every classified document must be clearly marked with its level and declassification instructions so that anyone who encounters it knows what protections apply.
Challenging a Classification
EO 13526 does something people often miss: it expects authorized holders of classified information to challenge decisions they believe are wrong. If a cleared analyst encounters a document they think is improperly classified or should sit at a lower level, the order directs them to raise that challenge through their agency’s procedures.
Agencies must ensure that challengers face no retaliation, that an impartial official or panel reviews the challenge, and that the challenger is informed of the right to appeal the agency’s decision to the Interagency Security Classification Appeals Panel. The mechanism exists because the drafters recognized that over-classification is a persistent problem, and the people best positioned to spot it are those working with the material daily.
How Records Get Declassified
Automatic Declassification at 25 Years
The backbone of the declassification system is the 25-year automatic rule. Records with permanent historical value that reach the 25-year mark are declassified without individual review unless an agency head has secured a specific exemption. The order lists nine categories eligible for exemption, including intelligence source identities, weapons of mass destruction details, active military war plans, foreign government information, and information that would compromise cryptologic systems or presidential protection operations. Securing an exemption is not automatic: the agency head must determine that release would still damage national security after 25 years, and the exemption must fit one of the defined categories.
Systematic Review
Agencies also conduct systematic reviews of records that have not yet reached the 25-year threshold but may no longer need protection. These reviews often target collections of high public interest and clear records that have lost operational sensitivity well before the automatic deadline. Much of this work happens at the National Archives.
Mandatory Declassification Review
Any member of the public can request that an agency review specific classified information for possible release through the Mandatory Declassification Review (MDR) process. Unlike a general FOIA request, an MDR submission asks the agency to evaluate whether the classification itself is still justified. Agencies must respond within a reasonable timeframe and explain their reasoning if the information stays sensitive. If FOIA is broader in scope and enforceable in federal court, MDR is narrower but offers a faster administrative appeal, because a denial can go directly to ISCAP rather than into litigation. Intelligence community agencies may reject MDR requests from non-citizens.
The Interagency Security Classification Appeals Panel
When an agency denies a declassification request or a classification challenge, the requester can appeal to the Interagency Security Classification Appeals Panel (ISCAP). The panel includes senior representatives from the Departments of State, Defense, and Justice, plus the National Archives, the Office of the Director of National Intelligence, and the National Security Advisor. ISCAP can overrule an agency’s decision to keep records classified, providing an independent check.
The National Declassification Center
EO 13526 created the National Declassification Center (NDC), housed at the National Archives, to work through a large backlog of previously reviewed archival records. When the center stood up in January 2010, roughly 372 million pages awaited processing. NDC staff can review records and recommend declassification, but the originating agency keeps final authority over its own material.
Penalties for Mishandling Classified Information
Consequences range from administrative action to federal prison, depending on intent and severity. On the administrative side, personnel who fail to follow safeguarding protocols face loss of their clearance, suspension, or termination. For a government employee whose position depends on maintaining a clearance, losing it is effectively career-ending.
Criminal exposure is more severe. Under 18 U.S.C. § 1924, knowingly removing classified documents from authorized locations and retaining them elsewhere carries a fine and up to five years in prison; the statute applies to officers, employees, contractors, and consultants who gained access by virtue of their position. Under 18 U.S.C. § 798, knowing disclosure of classified information related to communications intelligence, cryptographic systems, and similar programs carries up to ten years. Broader provisions of the Espionage Act can reach intentional disclosures that harm national security.
What EO 13526 Does Not Cover
Two boundaries are worth knowing. First, the order does not apply to Restricted Data or Formerly Restricted Data classified under the Atomic Energy Act of 1954. Nuclear weapons design information, special nuclear material production data, and related military applications follow a separate system overseen by the Departments of Energy and Defense, with their own handling and declassification rules and no 25-year automatic release. Second, a large volume of sensitive government information is not classified at all but sits in the Controlled Unclassified Information (CUI) category, governed by 32 CFR Part 2002 rather than EO 13526. CUI includes law enforcement sensitive data, export-controlled technical information, and personally identifiable information held by federal agencies. It requires standardized marking and handling, but does not trigger classification levels, clearances, or the declassification timelines set by the order.