Which source does the government actually use when it says “this is classified”?
You’ve probably heard the term derivative classification tossed around in a security briefing, a compliance manual, or that one email that made you wonder whether you should have deleted the attachment. But when it comes down to it, the real question is: what’s the primary source that tells you what to classify?
The short answer is: the original classification authority’s (OCA) original classification decision. In practice that means the source document—the intel report, policy memo, or directive that was first marked classified by the person who has the authority to do so. Everything else you do later—adding a cover sheet, pulling a paragraph into a briefing, or posting a redacted excerpt—must flow from that original decision.
Below we’ll unpack what that looks like, why it matters, and how you can avoid the most common slip‑ups that trip up even seasoned analysts.
What Is Derivative Classification
Derivative classification is the process of taking already‑classified material and applying the same classification markings to new products that contain that material. Think of it as copying a color from a paint swatch: the hue doesn’t change, you just use it on a different wall Simple, but easy to overlook..
The Core Idea
When you receive a classified document, you’re not given a free pass to re‑classify it however you like. Instead, you inherit the classification level (Confidential, Secret, Top Secret) and the reason (the classification authority’s “original classification authority” or “originating source”). Your job is to preserve that classification in any derivative work.
The Primary Source Explained
The primary source is the very first document that the original classification authority (OCA) marked as classified. It could be:
- An intelligence report from a national agency
- A policy directive from the Department of Defense
- A diplomatic cable from the State Department
- A technical manual from a research lab
That source carries the original classification decision—the level, the de‑classification date (if any), and the applicable classification guide. Every derivative product you create must trace back to that source Not complicated — just consistent..
Why It Matters / Why People Care
If you get the source wrong, you’re either over‑classifying (wasting time, limiting information sharing) or under‑classifying (risking a security breach). Both cost money, reputation, and sometimes even national security Took long enough..
Real‑World Impact
Imagine you’re preparing a briefing for a joint task force. You pull a paragraph from a Top Secret intelligence assessment, but you label the slide Confidential because you thought the rest of the deck was only Confidential. The next day, the security office flags the deck, you’re pulled into a formal review, and the whole operation gets delayed Took long enough..
On the flip side, over‑classifying can choke collaboration. If you label a routine logistics memo as Top Secret just because it references a classified source, you might block a partner agency that only has Secret clearance from getting the info they need Less friction, more output..
Compliance and Accountability
Federal regulations (like the National Security Act and the Intelligence Community Directive 503) explicitly require that derivative classifiers reference the original classification authority’s source. Failure to do so can lead to administrative actions, loss of clearance, or even criminal penalties in extreme cases.
How It Works
Below is the step‑by‑step flow most agencies follow, from the moment the original document is created to the point you finish your derivative product.
1. Identify the Original Classification Authority
-
Who can be an OCA?
- Senior officials designated by law or executive order (e.g., the Secretary of Defense, the Director of National Intelligence).
- Agency heads, certain senior military officers, and certain civilian officials with a written delegation.
-
What to look for?
- The classification markings on the document (e.g., “TOP SECRET – NOFORN”).
- The authority citation in the header/footer, often a line like “Classified by: [Name], [Title]”.
2. Locate the Source Document
-
Where is it stored?
- Secure classified information systems (e.g., SIPRNet for Secret, JWICS for Top Secret).
- Physical classified folders in a SCIF.
-
What counts as the source?
- The original report, directive, or memo that first contained the classified material.
- Any annexes or appendices that were part of that original package.
3. Determine the Classification Parameters
- Classification level – Confidential, Secret, or Top Secret.
- Classification reason – “Foreign Government”, “Military Plans”, “Intelligence Sources and Methods”, etc.
- De‑classification date – If the source includes a “forever” or a specific date, you must honor it.
4. Apply the Same Markings to Your Derivative
- Markings on the document – Header/footer, banner, and any cover sheets must match the source.
- Portions of the document – If only part of your product contains classified material, use “portion markings” (e.g., “[TOP SECRET – Portion]”).
- Metadata – Ensure electronic files retain the same classification metadata tags; many systems will auto‑apply them if you import the source.
5. Document the Derivative Process
-
Derivative classification worksheet – Some agencies require a brief log stating:
- Source document title and reference number
- Classification level and reason
- Date of creation of the derivative product
-
Retention – Keep that worksheet for the required period (often 5 years) in case of an audit Worth keeping that in mind..
Common Mistakes / What Most People Get Wrong
Even with clear guidance, people stumble. Here are the pitfalls you’ll see over and over.
Assuming the Clearance Level Equals the Classification Level
Your personal clearance (e.g., Secret) does not dictate the classification you must apply. If the source is Top Secret, you must mark your derivative Top Secret—even if you only have Secret clearance. The rule is “need‑to‑know” meets “original classification,” not “what I can see.”
Ignoring Portion Markings
A common slip is to label an entire document Secret when only a single paragraph is classified. That not only over‑classifies but also creates confusion for downstream users who may think the whole thing is restricted That alone is useful..
Forgetting the De‑classification Date
Some sources are set to automatically de‑classify after a certain period. If you copy that material after the date has passed, you can downgrade the classification—provided you have proper documentation. Missing that window can lock you into an unnecessary classification forever.
Relying on Memory Instead of the Actual Source
“Hey, I remember that memo being Top Secret, so I’ll mark it that way.” Bad idea. Always pull up the original document and verify the markings. Policies are strict about documented evidence, not recollection.
Using the Wrong Classification Guide
Each agency has its own classification guide (e.g., DoD Manual 5200.01, IC DGC). Applying a Navy guide to an Army document—or vice‑versa—can lead to mismatched reasons and improper handling instructions Turns out it matters..
Practical Tips / What Actually Works
Below are the habits that keep you on the straight‑and‑narrow side of the classification line.
-
Keep a “source‑lookup” cheat sheet
- List the most common OCAs you work with, their titles, and where their documents live.
-
Use automated classification tools
- Many secure systems flag when you import text from a classified source and auto‑apply the correct markings. Don’t turn that feature off.
-
Create a quick‑reference worksheet
- A one‑page template that you fill out each time you start a derivative product. It forces you to capture the source, level, reason, and de‑classification date.
-
Do a “portion‑marking audit” before distribution
- Scan the final product for any unmarked classified text. A simple “find” for words like “SECRET” or “TOP SECRET” can catch missed banners.
-
Ask when in doubt
- If the source document is ambiguous, route it to your security officer. It’s better to get a “yes, that’s correct” than to guess and get flagged later.
-
Stay current on classification guides
- Agencies update their guides annually. Subscribe to the internal bulletin or set a calendar reminder to review changes.
FAQ
Q1: If the original source is “Classified – No Further Dissemination (NOFORN)”, can I create a derivative that’s only “Secret”?
A: No. The NOFORN restriction sticks to any derivative. You must mark the new product with the same NOFORN caveat, regardless of the classification level you assign Simple, but easy to overlook..
Q2: Can I downgrade a classified excerpt if the de‑classification date has passed?
A: Yes, but only if the source explicitly states a de‑classification date and you have documentation proving the date has elapsed. Record the downgrade in your worksheet.
Q3: What if I can’t locate the original source document?
A: Do not guess. Treat the material as “unclassified until verified.” Seek guidance from your security manager to locate the source or obtain a clearance to use the material.
Q4: Are there any exceptions where I can add a higher classification than the source?
A: Only if you have original classification authority yourself for the new material you are adding. You cannot unilaterally raise the classification of existing content without proper authority.
Q5: How does derivative classification apply to oral briefings?
A: The same principle holds. Any spoken content that includes classified material must be treated as classified, and you must ensure all participants have the appropriate clearance and need‑to‑know.
When you’re juggling multiple documents, tight deadlines, and a sea of acronyms, it’s easy to let the source slip out of view. But remember: the primary source for derivative classification is simply the original classification decision made by the authorized official. Keep that document front and center, follow the step‑by‑step process, and double‑check your markings.
Do it right, and you’ll keep information flowing where it’s needed, without tripping the security alarms. Miss it, and you’ll be the one stuck in a compliance review while everyone else moves on Practical, not theoretical..
Stay sharp, keep the source handy, and let the classification markings do their job. Happy (and secure) writing!
