What Are Derivative Classifiers Required to Have?

Derivative classifiers are required to have a security clearance at or above the level of the information they handle, a signed Standard Form 312 nondisclosure agreement, and a documented need to know the specific material for their official duties. On top of those access conditions, they must complete recurring classification training, work only from authorized sources, and apply personally identified markings to every product they create. Executive Order 13526 sets these requirements.¹

The Three Access Conditions

Section 4.1 of Executive Order 13526 sets three conditions that must all be met before anyone, derivative classifiers included, can touch classified information.¹

First, an agency head or designee must make a favorable eligibility determination. In practice, that means passing a background investigation and being granted a clearance at a level equal to or higher than the information involved. A person handling Secret material needs at least a Secret clearance; a person handling Top Secret needs Top Secret.

Second, the person must have signed Standard Form 312, the Classified Information Nondisclosure Agreement.² The SF 312 is a legally binding contract with the federal government, and its key language states that the obligations apply during the period of access “and at all times thereafter.” The duty to protect classified information lasts for life, not just while you hold the clearance or the job.³

Third, and the one people misunderstand most often, is need to know. A clearance is not a passkey. Holding a Top Secret clearance gives no automatic right to any Top Secret document in the government. The person must have a legitimate professional reason to see the specific information. A cleared counterterrorism analyst has no standing to read classified material on submarine propulsion, whatever their clearance level. Agency heads are required to establish control measures that limit access to authorized individuals with a genuine need.⁴

Current Training

Before exercising any classification authority, a derivative classifier must complete training on proper marking techniques, the principles behind classification decisions, and the legal consequences of mishandling classified information. After that initial training, Executive Order 13526 requires refresher training at least once every two years, with specific emphasis on avoiding over-classification.¹

Miss the two-year window and your authority is automatically suspended until you complete the training. An agency head, deputy agency head, or senior agency official may grant a waiver when unavoidable circumstances prevent timely completion, but the training must still be finished as soon as possible.

The Department of Defense uses a tighter cycle. Since October 2019, all DoD personnel and contractors who access classified systems or perform derivative classification must complete the training annually.⁵ The Under Secretary of Defense for Intelligence directed the change after reported marking discrepancies across the department.⁶ Other federal agencies follow the Executive Order’s biennial baseline unless their own policies set a stricter one.

Authorized Source Material

Derivative classifiers do not make classification calls from personal judgment. They must work from one of two authorized sources: a security classification guide or a properly marked source document. Anything else, including informal guidance from a colleague or a hunch about sensitivity, is off limits.

Security classification guides are the primary tool. Issued by original classification authorities, they specify exactly what information within a program requires protection, at what level, and for how long. The Department of Defense describes them as providing “mandatory guidance to all personnel who perform derivative classification” so decisions stay consistent across the department.⁷

When no guide covers the information at hand, the classifier may work from a properly marked source document and carry its markings forward. If a guide and a source document conflict about the same information, the guide controls. The classifier is responsible for transferring every relevant marking accurately, including classification level, the “Derived From” citation, and declassification instructions.¹

Required Markings on Every Product

Every derivatively classified document must carry a classification authority block identifying who classified it, where the classification came from, and when it can be declassified. These are regulatory requirements, not formatting preferences, and they apply to all classified media, including emails and digital files.⁸

Classified By

The derivative classifier must be identified by name and position, or by a personal identifier such as an employee number, in a way that is immediately apparent on the document. The agency and office of origin must also appear if not otherwise evident. A typical marking reads: “Classified By: Jane Smith, Senior Analyst, Office of Intelligence, Department of Good Works.”⁹ Putting your name on the product means taking personal responsibility for the accuracy of the markings.

Derived From

This line identifies the source document or security classification guide that authorized the classification, including agency, office of origin where available, and date. When a document draws on more than one source, the line reads “Derived From: Multiple Sources,” and a full list of every source must be included on or attached to the document.⁹ The list has to be specific enough that a future holder can find each source: titles, dates, offices of origin.¹⁰

Declassify On

The classifier must carry forward the declassification instructions from the source. Under Executive Order 13526, information generally remains classified for no more than ten years from original classification, unless the original classification authority determined the sensitivity warrants up to twenty-five.⁹ When sources carry different declassification dates, the classifier uses the longest duration among them.¹⁰ If a source is missing its instruction entirely, the classifier calculates a date twenty-five years from the source document’s date, or from the current date if the source date is unavailable.

What Cannot Be Classified

Derivative classifiers also need to recognize when classification would be improper. Executive Order 13526 prohibits classifying information to conceal violations of law, prevent embarrassment to a person or agency, restrain competition, or delay the release of information that does not genuinely require protection for national security reasons.¹¹ Basic scientific research unrelated to national security cannot be classified either. If a source or guide appears to classify something in one of these prohibited categories, the classifier has the right, and the responsibility, to raise a classification challenge, and Section 1.8 of the Executive Order bars retaliation for a good-faith challenge.¹

Ongoing Reporting Obligations

Access is not a one-time grant. Clearance holders must self-report life events that could affect their eligibility. Security Executive Agent Directive 3 identifies the reportable categories, and they apply uniformly across the federal government.¹²

Planned foreign travel, reported in advance (official government travel follows agency-specific procedures)
Continuing foreign contacts involving personal or professional bonds
Foreign financial interests, including accounts, property, investments, or businesses
Any arrest, criminal charge, or conviction, regardless of outcome
Financial problems such as bankruptcy, wage garnishment, or liens
Any use of illegal drugs or misuse of prescription drugs
Changes in personal status, including marriage, divorce, or legal separation

The old five-year and ten-year periodic reinvestigation cycles have been replaced by continuous vetting, which monitors credit records, criminal databases, public records, and other data sources on an ongoing basis.¹³ Self-reporting still matters, because continuous vetting may not catch everything and failing to report a known issue is itself a security concern.

Why the Requirements Are Strict

Getting any of this wrong carries real consequences. Administrative penalties can include official reprimands, suspension of classification authority, demotion, or permanent revocation of a clearance, which often means losing the job that required it.

Federal criminal law imposes further penalties for unauthorized disclosure. Under 18 U.S.C. § 793, gathering, transmitting, or losing defense information carries up to ten years in prison.¹⁴ Section 798, targeting unauthorized disclosure of classified information related to communications intelligence, carries the same ten-year maximum.¹⁵ Fines can reach $250,000 for felony convictions, and courts may order forfeiture of proceeds obtained from a foreign government as a result of the violation.

These penalties can attach to negligent handling, not just intentional leaks. A derivative classifier who applies the wrong markings and lets classified information land in an unclassified system has created a security incident. That is why the clearance, the signed SF 312, the documented need to know, the current training, and the authorized-source discipline are non-negotiable: each one closes a gap the next one cannot.

1
National Archives. Executive Order 13526 – Classified National Security Information
2
General Services Administration. Classified Information Nondisclosure Agreement
3
General Services Administration. SF 312 – Classified Information Nondisclosure Agreement
4
eCFR. 32 CFR 2001.45 – Information Controls
5
Defense Counterintelligence and Security Agency. Derivative Classification
6
Center for Development of Security Excellence. Derivative Classification Training Memo
7
Department of Defense. DoD Manual 5200.45 – Original Classification Authority and Writing a Security Classification Guide
8
National Archives. ISOO Training Tip 1 – Classified By Line in the Classification Authority Block
9
eCFR. 32 CFR 2001.22 – Derivative Classification
10
National Archives. Classification Management Training Aid – Derived From Multiple Sources
11
National Archives. Derivative Classification Training
12
Office of the Director of National Intelligence. Security Executive Agent Directive 3 – Reporting Requirements
13
Defense Counterintelligence and Security Agency. Report a Security Change, Concern, or Threat
14
Office of the Law Revision Counsel. 18 USC 793 – Gathering, Transmitting, or Losing Defense Information
15
Office of the Law Revision Counsel. 18 USC 798 – Disclosure of Classified Information