Derivative classification and security classification guides, explained

Derivative classification is the act of putting already classified information into a new document and marking the new document to match its source. Section 6.1(o) of Executive Order 13526 defines it as "incorporating, paraphrasing, restating, or generating in new form" classified information. The definition includes classifying information under classification guidance. The order excludes duplication or reproduction. Section 2.1(a) says a person who extracts or summarizes classified information, or marks it as a guide directs, does not need original classification authority. Each person who applies derivative markings carries the original markings forward, so an original classification authority (OCA) decision reaches every new document built from the source.

Who derivatively classifies

The Information Security Oversight Office (ISOO) marking booklet, Revision 4 of January 2018, says only people with the appropriate security clearance, whose work requires them to restate classified source information, may derivatively classify. Such a person ordinarily works from one of two kinds of source: a classified document, or a classification guide issued by an OCA. With a source document, its markings determine the new markings. With a guide, the guide's instructions apply.

The same rule reaches industry. Under section 117.13(b) of Title 32 of the Code of Federal Regulations (CFR), contractor personnel make derivative classification decisions when they incorporate, paraphrase, restate, or generate classified information in new form. The source may be a properly marked document or a current guide provided by the government contracting activity. Section 117.13(d) says that activity provides the guidance in the contract security classification specification, or equivalent.

What the derivative classifier must do

Section 2.1(b) of the order sets three duties. The classifier is identified by name and position, or personal identifier. The classifier observes and respects original decisions. The classifier carries forward the pertinent markings. With multiple sources, that means the longest declassification period among them and a list of the sources.

Section 2001.22 fills in the detail:

• The reason for the original decision is not transferred to the new document.
• If a source lacks a declassification instruction, the classifier carries forward a date 25 years from the source's date, or from the current date if the source is undated.
• If a source is marked Originating Agency's Determination Required (OADR), Manual Review (MR), or X1 through X8, the classifier calculates a date 25 years from the source's date.
• A source that is itself marked "Multiple Sources" is cited by name, not as "Multiple Sources."

Section 2.1(c) of the order adds that, whenever practicable, a derivative classifier uses a classified addendum when classified information is a small part of an otherwise unclassified document.

The two-year training rule

Section 2.1(d) of the order requires training in derivative classification at least once every 2 years, with an emphasis on avoiding over-classification. Section 2001.71(d) requires the training before a person first derivatively classifies. At a minimum it covers derivative classification principles, levels, duration, markings, prohibitions and limitations, sanctions, challenges, classification guides, and information sharing.

A classifier who misses the two-year mark has the authority suspended until trained. An agency head, deputy agency head, or senior agency official may grant a documented waiver for unavoidable circumstances. Original classification authorities train on a shorter cycle: at least once each calendar year, under section 2001.71(c). Section 117.13(c)(4) applies the two-year cycle to contractor employees. Section 2001.71(a) places all of this inside a formal agency program of initial, refresher, and specialized training and termination briefings.

How a security classification guide works

Section 6.1(h) of the order defines a classification guide as an OCA's written guidance that identifies the elements of information on a subject that must be classified, with a level and duration for each. Section 2.2(b) requires personal, written approval by an official who has program or supervisory responsibility for the information, or is the senior agency official, and who may classify originally at the guide's highest level.

Section 2001.15(b) lists the minimum contents: the subject, the OCA, a point of contact, the date of issuance or last review, the elements of information, the level for each, handling caveats, a reason citing section 1.4 of the order, and declassification instructions. Each agency keeps a list of its guides.

The Department of Defense (DoD) manual is DoD Manual 5200.45, effective January 17, 2025. The manual reissues the April 2, 2013 manual, "Instructions for Developing Security Classification Guides." For each element of information, the guide's tables give the classification, reason, declassification date, dissemination controls, Controlled Unclassified Information (CUI), and remarks. Ranges such as "U-S" are not permitted. Each guide is reviewed at least once every 5 years. Every guide needs a DD Form 2024, the sole input to the DoD guide index that the Defense Technical Information Center (DTIC) manages. Unclassified guides are not authorized for public release and may be protected as CUI.

The ISOO booklet's worked example adds one point about duration. A guide's "25 years" runs from the date the new document is created, not from the guide's date.

What to check

• Does the "Derived From" line name the source document or guide, with agency, office, and date, or list every source?
• If a source was marked OADR, MR, or X1 through X8, was the date calculated as 25 years from the source's date?
• Has the person who applied the markings completed derivative classification training in the past two years?
• Does the guide name its OCA, a point of contact, and its date of issuance or last review?
• Does the guide give one level per element of information, rather than a range such as "U-S"?
• For a contractor, did the guidance arrive in the contract security classification specification?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1Executive Order 13526, Classified National Security Information · National Archives, Information Security Oversight Office (order of December 29, 2009)
2. 232 CFR 2001.22 Derivative classification · Electronic Code of Federal Regulations
3. 332 CFR 2001.71 Coverage · Electronic Code of Federal Regulations
4. 432 CFR 2001.15 Classification guides · Electronic Code of Federal Regulations
5. 532 CFR 117.13 Classification · Electronic Code of Federal Regulations
6. 6Marking Classified National Security Information, Revision 4, January 2018 · Information Security Oversight Office (ISOO Handbook 2018-01)
7. 7DoD Manual 5200.45, Original Classification Authority and Writing a Security Classification Guide, January 17, 2025 · Office of the Under Secretary of Defense for Intelligence and Security (esd.whs.mil copy captured September 17, 2026, Internet Archive)

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.