Classification guidance and challenges

← All Insights

1. Original classification stays with the government

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, keeps the power to classify in government hands. Only a U.S. Government official designated or delegated the authority in writing can make an original classification decision (32 CFR 117.13(a)). An original classification authority (OCA) classifies information under Executive Order 13526 and 32 CFR part 2001 (32 CFR 117.13(a)(1)). The OCA marks it TOP SECRET, SECRET or CONFIDENTIAL, and except as statute provides, may use no other terms.

UNCLASSIFIED identifies information that does not meet the criteria for classification (32 CFR 117.13(a)(2)). Controlled unclassified information (CUI) commingled with classified information must be marked as CUI, following 32 CFR part 2002, the CUI guidance and any guidance from the government contracting activity (GCA).

2. What contractors do: derivative classification

Contractor personnel make derivative classification decisions when they incorporate, paraphrase, restate or generate in new form information that is already classified (32 CFR 117.13(b)(1)). They mark the new material consistently with the source markings. The basis is OCA guidance, either a properly marked source document or a current security classification guide from the GCA (32 CFR 117.13(b)(2)). Making copies of existing classified information does not count as derivative classification.

A source document without portion markings under an approved waiver must carry a warning that it may not be used as a source for derivative classification (32 CFR 117.13(b)(3)). An email on a classified system that carries a classified attachment but no classified information in its body serves as a transmittal document and is not derivatively classified (32 CFR 117.13(b)(4)). Its overall classification reflects the highest level in the attachment.

3. Duties of a derivative classifier

Contractors give employees the classification guidance they need (32 CFR 117.13(c)). Each authorized derivative classifier marks the face of each document with a classification authority block giving the employee’s name and position or personal identifier, the entity name and, where applicable, the division or branch (32 CFR 117.13(c)(1)). The rule’s example block also shows the source, under “Derived From,” and the declassification date, under “Declassify On.”

Derivative classifiers observe and respect original classification decisions (32 CFR 117.13(c)(2)). They carry forward the pertinent markings (32 CFR 117.13(c)(3)). With multiple sources, they carry forward the declassification date or event with the longest period of classification, and a listing of the sources. Where classified information is a small portion of an otherwise unclassified document, they use a classified addendum whenever possible (32 CFR 117.13(c)(5)).

4. Classification guidance from the GCA

The GCA incorporates security requirement clauses in classified contracts and the solicitations leading to them (32 CFR 117.13(d)(1)(i)). It provides the classification guidance needed during performance through the contract security classification specification or an equivalent (32 CFR 117.13(d)(1)(ii) and 32 CFR 117.13(d)(1)(iii)). That specification identifies the specific elements of classified information that need protection (32 CFR 117.13(d)(2)). At the discretion of the cognizant security agency (CSA), contractors may help develop and revise it (32 CFR 117.13(d)(3)).

The contractor complies with all aspects of the guidance (32 CFR 117.13(d)(4)). Users are encouraged to tell the originator when they learn of information suggesting a guide needs to change. Classification guidance is the exclusive responsibility of the GCA, which makes the final determination. A contractor that receives a classified contract without a specification notifies the GCA, and then the CSA if the GCA does not respond.

On completion of a classified contract, the contractor returns all government-provided or deliverable information (32 CFR 117.13(d)(5)). Unless the GCA advises otherwise, it may keep copies for two years, and the specification continues for that period. If there is a continuing need beyond two years, the GCA issues a final specification with disposition instructions.

5. Challenging a classification

Contractors raise challenges with the GCA when information is classified improperly or unnecessarily, when downgrading or upgrading is justified, or when guidance is missing, improper or inadequate (32 CFR 117.13(e)(1)). If the GCA gives no remedy, the contractor makes a formal written challenge describing the issue, the reasons and recommended corrective action (32 CFR 117.13(e)(2)). The information is protected at the assigned or proposed level, whichever is higher, until action is complete (32 CFR 117.13(e)(3)).

With no written answer within 60 days, the contractor asks the CSA for help (32 CFR 117.13(e)(4)). With no response within 120 days, it may appeal to the Interagency Security Classification Appeals Panel through the Information Security Oversight Office (ISOO). A challenge is never a basis for adverse action, and a contractor that believes it suffered one gives full details to ISOO (32 CFR 117.13(e)(5)).

6. Contractor-developed information

The rule covers unsolicited proposals and information developed outside a classified contract (32 CFR 117.13(f)). Information previously identified as classified is classified under the appropriate guide or source (32 CFR 117.13(f)(1)). If it was not, but the contractor believes it should be, the contractor protects it as classified and submits it to the interested agency for a determination (32 CFR 117.13(f)(2)). It is marked “CLASSIFICATION DETERMINATION PENDING” with the level at which it is protected.

The material may still be marked entity-private or proprietary unless it was based on prior deliverables or government material. To be eligible for classification, it must incorporate classified information the contractor was given and be owned by, produced for or controlled by the government (32 CFR 117.13(f)(3)).

7. Leaks, downgrading and declassification

Improperly released classified information is not automatically declassified, even when it becomes publicly available (32 CFR 117.13(g)). Contractors keep protecting it until the GCA advises otherwise, raise questions with the GCA and notify the CSA if an employee downloads it. Contractors are not authorized to implement downgrading or declassification instructions, even for material marked for automatic action, and they seek GCA guidance when the date or event arrives (32 CFR 117.13(h)(2)). Declassification is not approval for public disclosure (32 CFR 117.13(h)). Marking rules are covered in marking classified material.

Key terms

OCA	An original classification authority, always a government official.
Derivative classification	Classifying new material based on existing classified sources or guides.
Classification authority block	The marking that identifies the derivative classifier and source.
Classification challenge	A contractor request to correct a classification.
Classification determination pending	The marking for contractor material awaiting a decision.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Handling classified documents correctly matters in the field. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.