What Is DoD 5200.1-R? Replacement, Classification, and CUI

DoD 5200.1-R was the Department of Defense regulation that set the rules for identifying, marking, storing, transmitting, and eventually declassifying classified national security information across every military branch and defense agency. It has been formally cancelled and reissued as the DoD Manual 5200.01 series, but the substantive framework it built still governs day-to-day information security work throughout the defense community. If you ran across the citation “DoD 5200.1-R” in a training slide, a security classification guide, or an older policy memo, the underlying rules are still in force; they simply live in the updated manual volumes now.¹

What Replaced DoD 5200.1-R

The regulation was reissued as a multi-volume manual rather than a single document. Volume 1 of DoDM 5200.01 covers classification and declassification policy. Volume 2 sets marking requirements. Volume 3 lays out the physical and procedural safeguards for classified material. Tying the volumes together is DoD Instruction 5200.01, which assigns responsibilities across defense components and keeps the program aligned with Executive Order 13526 and the implementing rules at 32 CFR Parts 2001 and 2002.²

For anyone working with classified information today, the DoDM 5200.01 series is the authoritative source. Legacy references to 5200.1-R still point to the same program; the number changed, the operational framework did not.

Classification Levels

Executive Order 13526 establishes the three classification levels the DoD program applies. Each is defined by the level of damage that unauthorized disclosure could reasonably be expected to cause:³

Top Secret is applied when disclosure could reasonably be expected to cause exceptionally grave damage to national security. Examples include compromise of critical intelligence sources or advanced weapons system designs. Top Secret material carries the strictest physical controls and the highest-level background investigation for anyone who handles it.
Secret is applied when disclosure could reasonably be expected to cause serious damage to national security. It covers a broad range of intelligence activities, diplomatic negotiations, and operational military plans. Handling requires a current Secret-level clearance at minimum.
Confidential is applied when disclosure could reasonably be expected to cause damage to national security. It is the lowest tier and covers information like routine operational details or logistics that would benefit an adversary without being catastrophic.

The official who classifies information must be able to identify or describe the specific damage disclosure would cause. Vague assertions of harm do not meet the standard. That requirement exists to curb over-classification, a persistent problem across the government.

Restricted Data and Formerly Restricted Data

Nuclear-related information sits outside the executive order framework. “Restricted Data” is defined by the Atomic Energy Act and covers information about the design or manufacture of nuclear weapons, the production of special nuclear material, and the use of that material to produce energy.⁴ It is classified by operation of law the moment it is created, not by a classifier’s decision.

“Formerly Restricted Data” is nuclear information that the Department of Energy and DoD have jointly determined relates primarily to military use of nuclear weapons and can be safeguarded under the normal national security information system. Despite the word “formerly,” this information remains classified. Neither category is subject to the automatic declassification timelines that apply to other classified information; any declassification requires a specific review by the Department of Energy.

Who Can Classify Information

Original Classification Authority

Only officials specifically designated in writing can make the initial decision that information requires classification. Executive Order 13526 limits original classification authority to the President, the Vice President, agency heads designated by the President, and officials who receive a written delegation from those principals. Delegations must be kept to the minimum necessary, and Top Secret authority can only be delegated by the President, Vice President, or an agency head.³

Within DoD, the positions holding original classification authority include the Secretary of Defense, the Secretaries of the Military Departments, the Chairman of the Joint Chiefs of Staff, Combatant Command commanders, and the heads of other DoD components or their specifically authorized delegates.⁵ Every person exercising this authority must complete classification and declassification training at least once per calendar year. Miss the training and the authority is suspended until it is completed.

Derivative Classification

Most classification decisions in DoD are derivative rather than original. Derivative classification happens when someone creates a new document that incorporates or restates information already classified by someone else. The person doing this is not making a fresh judgment; they are carrying forward the classification markings from a source document or security classification guide.⁶

Derivative classifiers must complete training before performing this function and again every two years.⁷ Common errors include applying the wrong level to a paragraph, failing to identify all sources used, or marking a document at a higher level than any source material warrants. Those errors matter because every downstream handler relies on the markings to decide how to store and transmit the document.

Marking Requirements

Markings tell every person who touches a document exactly how sensitive each portion is and when protection expires. DoDM 5200.01 Volume 2 requires:⁶

Banner lines showing the overall classification at the top and bottom of every page.
Portion marks on each paragraph, section, chart, or graphic showing that portion’s individual classification level. A single document can carry Top Secret, Secret, Confidential, and unclassified portions on the same page.
A classification authority block on the face of the document identifying who classified it, the reason, and when the information is scheduled for declassification. On derivative documents, the block identifies the source documents or classification guide used rather than an original classifier.

Incorrect markings are one of the fastest ways to trigger an administrative inquiry, because they can cause information to be stored in containers or transmitted over networks not authorized for that level.

Physical Storage and Need to Know

When classified information is not under someone’s direct personal control, how it must be stored depends on its level. The requirements come from 32 CFR 2001.43 and DoDM 5200.01 Volume 3:

Top Secret must be stored in a GSA-approved security container, a vault built to federal standards, or an approved open storage area. In a GSA-approved container, at least one supplemental control is required: inspection every two hours by someone with at least a Secret clearance, an intrusion detection system with a 15-minute alarm response, or a security-in-depth environment with an approved lock on the container.⁸
Secret can be stored the same way as Top Secret, or in a GSA-approved container or vault without supplemental controls. Open storage areas require security-in-depth plus either four-hour inspections or an intrusion detection system with a 30-minute response.
Confidential is stored the same way as Secret or Top Secret, but no supplemental controls are required beyond the GSA-approved container itself.

Beyond the container, access is governed by the need-to-know principle. Holding the right clearance level is necessary but not sufficient. You must also have a specific, job-related reason to see the particular information. Someone with a Top Secret clearance who works in logistics does not automatically get to read Top Secret intelligence reports. That restriction is one of the most important safeguards against insider threats, and it is where supervisors and security managers spend a significant part of their oversight effort.¹

Controlled Unclassified Information

Not all sensitive DoD information is classified. Controlled Unclassified Information (CUI) is the standardized designation for unclassified information that still requires safeguarding under law, regulation, or government-wide policy. DoD implemented its CUI program through DoDI 5200.48, which replaced the patchwork of legacy markings such as “For Official Use Only” (FOUO) and “Sensitive But Unclassified” that agencies had used inconsistently for decades.⁹

The CUI Registry maintained by the DoD CUI Program Office sorts controlled information into categories including defense, export control, intelligence, law enforcement, privacy, and procurement and acquisition.¹⁰ Information previously marked FOUO must be assessed against the Registry to determine whether it qualifies as CUI, though existing FOUO-marked documents do not need to be physically re-marked. CUI is separate from the classified information program 5200.1-R governed, but the two often appear in the same working environments.

Declassification

Classified information does not stay classified forever. The default rule under Executive Order 13526 is that classified records with permanent historical value are automatically declassified on December 31 of the year that is 25 years from the date of creation. That happens whether or not anyone has reviewed the records.³

Agency heads can exempt specific information from the 25-year deadline, but only if release would clearly and demonstrably be expected to cause harm in one of nine defined categories. Those include revealing the identity of a confidential human intelligence source, assisting in the development of weapons of mass destruction, impairing cryptologic systems, exposing active war plans, or causing serious harm to foreign relations. Exempt information faces a second automatic declassification deadline at 50 years, and even that can be extended to 75 years only for the most sensitive material, such as human intelligence source identities.

Any member of the public can also request review of a specific classified document through the Mandatory Declassification Review process. The originating agency must conduct a fresh review and release the information if protection is no longer warranted. Agencies additionally conduct systematic reviews of older records transferred to the National Archives to keep information from being held classified longer than necessary.¹

Consequences of Mishandling

When someone discovers that classified information may have been compromised, the response has to be immediate. Reporting to a security manager or commanding officer triggers a preliminary inquiry into what was exposed, who had unauthorized access, and how the breach occurred. If the preliminary inquiry confirms a significant breach, a formal investigation follows. Administrative consequences for the person responsible can range from a written reprimand to permanent revocation of a security clearance.

In serious cases involving intentional disclosure, federal criminal statutes apply. 18 U.S.C. 793 covers willfully transmitting defense information to someone not authorized to receive it, carrying a fine and up to ten years in prison.¹¹ 18 U.S.C. 798 specifically targets unauthorized disclosure of classified communications intelligence and cryptographic information, with the same ten-year maximum.¹² 18 U.S.C. 1924 applies to government officers, employees, or contractors who knowingly remove classified documents and keep them at an unauthorized location, and carries up to five years.¹³

Accidental incidents are taken seriously too. An improperly secured safe, a classified document left on a printer, or an email sent to an unclassified network can all trigger an investigation. The handling rules that 5200.1-R established, and that DoDM 5200.01 now carries forward, exist because the consequences of a real compromise are severe enough that near-misses warrant the same investigative attention as confirmed breaches.

1
Department of Defense. DoD Manual 5200.01 – DoD Information Security Program: Overview, Classification, and Declassification
2
Department of Defense. DoD Instruction 5200.01 – DoD Information Security Program and Protection of Sensitive Compartmented Information
3
National Archives. Executive Order 13526 – Classified National Security Information
4
Office of the Law Revision Counsel. 42 USC 2014 – Definitions
5
Executive Services Directorate. Original Classification Authority and Writing Security Classification Guides
6
Department of Defense. DoD Manual 5200.01 Volume 2 – DoD Information Security Program: Marking of Information
7
National Archives. Derivative Classification Training
8
eCFR. 32 CFR 2001.43 – Storage
9
Executive Services Directorate (WHS). DoD Instruction 5200.48 – Controlled Unclassified Information (CUI)
10
DoD CUI Program. CUI Registry
11
Office of the Law Revision Counsel. 18 U.S. Code 793 – Gathering, Transmitting or Losing Defense Information
12
Office of the Law Revision Counsel. 18 U.S. Code 798 – Disclosure of Classified Information
13
Office of the Law Revision Counsel. 18 USC 1924 – Unauthorized Removal and Retention of Classified Documents or Material