Computer Security
Computer Science Homework Help
Purpose Provide a thorough understanding of the responsibilities associated with derivative classification and the procedures to follow to correctly derivatively classify documents.
Audience Military, civilian, and contractor personnel responsible for oversight or application of derivative classification.
POC GeneralSecurity.Training@dss.mil Pass/Fail % 75%
Estimated completion time
120 minutes
Course Overview
In the course of working with classified information, individuals sometimes generate or create new documents and materials based on that information. These individuals are responsible for maintaining the protection of that classified information. These individuals are called derivative classifiers. They must carefully analyze their work product to determine what classified information it contains or reveals, and evaluate that information against official classification guidance.
Based on that evaluation, derivative classifiers must ensure that the information in the new material is identified as classified by applying the appropriate markings to the material. This process of determining whether information has been previously classified and properly marking it is called derivative classification.
Derivative classifiers need to understand what their responsibilities are, what processes to follow, and what resources to consult to safeguard information that, if revealed, could cause damage to the national security.
Derivative Classification Course Introduction
Student Guide
Course Objectives
• Identify the responsibilities associated with derivatively classifying information
• Identify the process and methods for derivatively classifying information
• Identify authorized sources to use when derivatively classifying information
• Applying authorized sources, derivatively classify information based on the concepts of “contained in,” “revealed by,” and “compilation”
Lessons in the Course
• Course Introduction
• Derivative Classification Basics
• Classification Concepts
• Practical Exercise
• Course Conclusion
Page 2
Student Guide
Course: Derivative Classification
Lesson: Derivative Classification Basics
Introduction
Because protecting classified information from improper disclosure is so critical, there are responsibilities and procedures to follow when using classified information to create new documentation. You must be familiar with these responsibilities and procedures as well as where to go for guidance so you can successfully implement and execute them at your activity or facility.
Lesson Objectives
• Define derivative classification
• Identify the requirement for and importance of derivative classification
• Identify who will have derivative classification responsibilities and the requirements he or she must meet
• Identify the steps involved in the derivative classification process
• Identify authorized sources to use when derivatively classifying information
Derivative Classification Overview
1. What is Derivative Classification?
The initial decision about what information should be classified is called original classification. Because this is a very important, sensitive decision, the Government has granted only a limited number of government officials the authority to perform original classification.
Derivative classification is different. It is the process of using existing classified information to create new material, and marking that newly-developed material consistent with the classification markings that apply to the source information. Copying or duplicating existing classified information is not derivative classification.
Whereas only authorized government officials can perform original classification, no specific delegation of authority is required to be a derivative classifier. In fact, all cleared DoD and authorized contractor personnel who generate or create material from classified sources are derivative classifiers.
Like original classification, derivative classification has far-reaching effects on the Department of Defense and industry. Classifying information helps protect our national security. It limits access to only those individuals with the appropriate clearance level
Derivative Classification Derivative Classification Basics
Student Guide
and a legitimate need to know the information. Classification also impacts resources; it imposes costs for things like security clearances, physical security measures, and countermeasures. Because of the importance of classification, but also its inherent limitations and costs, it is crucial that derivative classifiers follow appropriate procedures and observe all requirements.
2. Derivative Classification Responsibilities
In general, derivative classifiers are responsible for ensuring that they apply the highest possible standards when derivatively classifying information. Derivative classifiers who generate new products bear the principal responsibility for the accuracy of the derivative classification. For this reason, it is important to follow DoD policy requirements.
Derivative classifiers have a variety of responsibilities they must meet in order to properly perform derivative classification. First, they must understand derivative classification policies and procedures. Before derivative classification can be accomplished, the classifier must have received the required training. Training must be accomplished in the proper application of the derivative classification principles of as specified in EO 13526, as well as emphasizing the avoidance of over-classification. At a minimum, the training shall cover the principles of derivative classification, classification levels, duration of classification, identification and markings, classification prohibitions and limitations, sanctions, classification challenges, security classification guides, and information sharing. Personnel shall receive this training prior to derivatively classifying information. In addition to this preparatory training, derivative classifiers shall receive such training at least once every two years. Derivative classifiers who do not receive such mandatory training at least once every two years shall have their authority to apply derivative classification markings suspended until they have received such training. They must also have expertise in the subject matter on which they are creating documentation, as well as on classification management and marking techniques. Derivative classifiers must also have access to classification guidance. This helps meet the responsibility of analyzing and evaluating information to identify elements that require classification.
The most important responsibilities derivative classifiers have is to observe and respect the original classification authority’s decision and to use only authorized sources to determine derivative classification.
The information in boxes like the one below is supplemental content that you may find useful; however, it will not be addressed in the course examination.
To understand derivative classification policies and procedures:
• Complete the online course: Derivative Classification • Complete the Marking Classified Information online training course offered by CDSE • Consult DoDM 5200.01, Volumes 1-4 and/or DoD 5220.22-M • Contact your government security official or Facility Security Officer (FSO)________
3. Policy Guidance
There are two primary sources of policy guidance for derivative classification.
Page 2
Derivative Classification Derivative Classification Basics
Student Guide
Within the Department of Defense, DoDM 5200.01, Volumes 1-4, Information Security Program, provides the basic guidance and regulatory requirements for the Department of Defense Information Security Program. For industry, DoD 5220.22-M, the National Information Security Program Operating Manual (NISPOM) contains information on derivative classification responsibilities.
How Does Derivative Classification Work?
1. Derivative Classification Concepts
So how do you determine whether the information contained in a new product is classified? As a derivative classifier, you are responsible for checking whether the content of the information already exists in one of the acceptable forms of classification guidance. If the guidance tells you the information in your new product is classified, you must classify and treat it as such. Note that for derivative classification purposes, the term “document” refers to any physical medium in or on which information is recorded or stored. This includes written or printed matter, audiovisual materials, and electromagnetic storage media. Let’s take a closer look at these authorized sources for derivative classification.
2. Authorized Sources fo r Derivative Classification
To ensure that the original classification of information is maintained, derivative classifiers must use only authorized sources of classification guidance to derivatively classify information. While it might be tempting, derivative classifiers must not rely on their memories or general rules about classification.
There are only three authorized sources for derivative classification. The first source is a Security Classification Guide (SCG). An SCG is a collection of precise, comprehensive guidance about a specific program, system, operation, or weapon system telling what elements of information are classified. For each element of information, the SCG includes its classification level, the reasons for that classification, and information about when that classification will be downgraded or terminated. For this reason, SCGs are the primary source for derivative classification.
A second authorized source is an existing, properly marked source document from which information is extracted, paraphrased, restated, and/or generated in a new form for inclusion in another document. You must carry the classification of that existing material forward into your new end product.
The third authorized source is the DD Form 254, the DoD Contract Security Classification Specification. DD Form 254 provides classification guidance to contractors performing on classified contracts. It informs them of the level of information they will need to access, the required level of security clearance for access, and the performance requirements; for example, safeguarding and special security requirements.
These three sources are the only authorized sources for derivative classification. Any other source is unauthorized, and must not be used as the basis for derivative classification. Some examples of such unauthorized sources appear in the box below:
Page 5
Derivative Classification Derivative Classification Basics
Student Guide
Examples of unauthorized sources of classification:
0 Memory: “I remember that project was classified Secret 5 years ago, so it must be Secret now.”
0 Unconfirmed source: “Someone told me this document can be declassified.”
0 Just because: “I am going to classify this document Top Secret because that is how we have always done it.”
0 Media/Internet: “I saw it on the news last night so it must be declassified.”________