Original Classification Authority: Levels, Duration, and Penalties

Original classification authority is the power to make the initial decision that specific government information needs protection from public disclosure on national security grounds. It is governed by Executive Order 13526, signed in 2009, and it belongs to a deliberately small set of officials. As of fiscal year 2024, only 1,661 officials across 19 federal agencies held it.¹ Everything the classification system does downstream, from document markings to declassification deadlines, starts with a decision made by one of these people.

Who Holds This Authority

Three groups can classify information for the first time. The President and Vice President hold the authority automatically. Agency heads and other officials specifically designated by the President hold it by name. Certain subordinate officials receive it through a formal written delegation.² The President’s power traces to Article II of the Constitution; the Vice President’s flows from the executive order itself.

Delegation rules tighten as the classification level rises. Only the President, Vice President, or a presidentially designated agency head can delegate Top Secret authority. Secret and Confidential authority can be delegated by those same officials plus the agency’s senior security official, provided that person already holds Top Secret authority. Delegations cannot be redelegated unless the executive order says so, and each one must be in writing and identify the recipient by name or position.²

Delegations must be kept to the minimum needed for effective operations, and agency heads are responsible for confirming that every subordinate with the authority has a genuine, continuing need to use it.³ Every delegation is reported by name or position to the Information Security Oversight Office and published in the Federal Register.⁴ The FY 2024 count breaks down to 694 officials with Top Secret authority, 963 with Secret, and 4 with Confidential.¹

How It Differs From Derivative Classification

Most classified documents are not created by someone with original classification authority. They come from derivative classification, which is a separate process.⁵ Original classification is the first-time decision that particular information warrants protection. Derivative classification happens later, when someone incorporates, paraphrases, or restates already-classified content in a new document and carries the markings forward.

The practical line: an analyst pulling from three classified reports to write a briefing is classifying derivatively and does not need original classification authority. Only the initial determinations about the underlying material required it. Copying or reproducing an existing classified document does not count as derivative classification at all.

What Information Can Be Classified

Information must be owned by, produced by or for, or under the control of the federal government, and it must fall within one of eight categories:

Military plans, weapons systems, or operations
Foreign government information
Intelligence activities, sources, methods, or cryptology
Foreign relations or foreign activities of the United States
Scientific, technological, or economic matters relating to national security
Programs for safeguarding nuclear materials or facilities
Vulnerabilities or capabilities of systems, installations, infrastructure, or protection services relating to national security
Development, production, or use of weapons of mass destruction

Fitting a category is not enough on its own. The classifying official must also determine that unauthorized disclosure could reasonably be expected to cause identifiable or describable damage to national security. When significant doubt exists about whether information needs classification at all, it should not be classified.²

What Cannot Be Classified

The executive order forbids classification when the purpose is to conceal violations of law, hide inefficiency or administrative errors, prevent embarrassment to any person or agency, restrain competition, or delay release of information that poses no national security concern. Basic scientific research not clearly related to national security is also off-limits.² Information that has been properly declassified and released to the public cannot be reclassified.

The Three Classification Levels

Every original classification decision assigns one of three levels, each tied to the harm that unauthorized disclosure would cause:

Top Secret: exceptionally grave damage to national security
Secret: serious damage to national security
Confidential: damage to national security

“Damage to the national security” means harm to national defense or foreign relations, weighed against the sensitivity, value, usefulness, and origin of the information.² At every level, the classifier must be able to identify or describe the specific damage. A general sense that the information “seems sensitive” does not qualify.

An official authorized at a given level can classify at that level or any lower one. Someone with Secret authority cannot mark a document Top Secret. When there is significant doubt about which level fits, the official must choose the lower one.²

What Exercising the Authority Requires

Before an official can classify anything, two things must happen. First, the official needs a formal written designation identifying them by name or position.³ Second, the official must complete training in proper classification and declassification, including how to avoid over-classification.

Training is not one-and-done. Every official with original classification authority must complete refresher training at least once each calendar year. Miss it and the authority is automatically suspended until the training is complete.⁶ An agency head or senior official can grant a waiver for unavoidable circumstances, but the waiver must be documented and the training completed as soon as possible.

When the official actually classifies a document, the document must show a “Classified By” line with the classifier’s name or personal identifier and position title. If the agency and office of origin are not otherwise obvious, that information must appear below the classifier’s name.⁷ The document must also carry the classification level, the reason referencing one of the eight categories, and instructions for declassification. Every classified document traces back to a specific official.

How Long a Classification Lasts

At the moment of classification, the official sets a date or event for declassification. The default maximum is 10 years from the classification date. If the information is sensitive enough to justify longer, the official can set a date up to 25 years out and must explain why the extended duration is necessary.³ Instead of a date, some officials designate a triggering event, such as the conclusion of a military operation. The event must be defined clearly enough that anyone can tell when protection has expired.

Classified records with permanent historical value are automatically declassified on December 31 of the year they turn 25, whether or not anyone has reviewed them.² Narrow categories can be exempted from that rule if an agency head shows that release would cause a specific harm, such as revealing a human intelligence source or compromising cryptologic systems. The Interagency Security Classification Appeals Panel must approve those exemptions.⁸

Even exempted records generally face automatic declassification at 50 years. A very short list of categories, such as information that would identify a confidential human source or reveal key weapons of mass destruction details, can extend beyond that.²

Challenging a Classification Decision

Anyone who holds a security clearance and has authorized access to classified information can challenge a classification they believe is improper. The executive order says cleared holders are “encouraged and expected” to raise these challenges. Agencies must set up procedures that protect challengers from retaliation, provide review by an impartial official or panel, and inform individuals of their right to appeal.⁹

The original classification authority must respond in writing within 60 days. If the agency cannot meet that deadline, it must tell the challenger in writing and give an expected date for a decision.¹⁰ If the agency denies the challenge or fails to respond within 120 days, the challenger can appeal to the Interagency Security Classification Appeals Panel within 60 days of the final decision or the missed deadline. The Panel will not take cases pending in federal court, cases involving information subject to a recent FOIA review, or cases concerning information under a prepublication review agreement.¹¹

Penalties for Misuse

Officials who knowingly, willfully, or negligently classify information in violation of the executive order face administrative sanctions:

Reprimand
Suspension without pay
Removal from position
Termination of classification authority
Loss or denial of access to classified information

At a minimum, the agency head or senior official must promptly strip classification authority from anyone who shows reckless disregard for the rules or a pattern of errors in applying classification standards.¹² The “at a minimum” language sets a floor, not a ceiling. The same sanctions apply to contractors, grantees, and certificate holders who handle classified information, not just government employees.

1
National Archives. ISOO FY 2024 Annual Report
2
National Archives. Executive Order 13526 – Classified National Security Information
3
eCFR. 15 CFR Part 4a – Classification, Declassification, and Public Availability of National Security Information
4
Federal Register. Original Classification Authority
5
National Archives. Original vs Derivative Classification
6
eCFR. 32 CFR Part 2001 Subpart G – Security Education and Training
7
eCFR. 5 CFR 1312.8 – Standard Identification and Markings
8
eCFR. 32 CFR 2001.26 – Automatic Declassification Exemption Markings
9
GovInfo. Executive Order 13526 – Classified National Security Information
10
eCFR. 6 CFR Part 7 Subpart B – Classified Information
11
eCFR. ISCAP Bylaws, Rules, and Appeal Procedures
12
The White House. Executive Order 13526 – Classified National Security Information