A Derivative Classifier Must Mark a Document as Secret Due to Compilation: What Else the SCG Requires

When a derivative classifier marks a document Secret because of compilation, the Security Classification Guide (SCG) requires an additional annotation that states the compilation itself is the basis for the classification, and the classifier must identify the specific compilation authority or the source documents whose aggregation triggers the higher level. The classification level alone is not enough. Without that context, the marking is incomplete and downstream reviewers cannot determine whether the classification is valid or whether it can be downgraded when the document is revised.

This article walks through what the SCG actually requires, how compilation classification differs from single-source classification, and what goes wrong when a classifier stops at the level and skips the context. It's written for derivative classifiers, reviewers, and Original Classification Authorities (OCAs) who work with SCGs under the U.S. classification system, chiefly Executive Order 13526 and its implementing directive 32 CFR Part 2001.

Compilation Classification Differs From Single-Source Marking Because the Whole Exceeds the Parts

Compilation classification is the practice of assigning a higher classification to a document than any individual source document carries, because the aggregation of unclassified or lower-classified facts reveals something sensitive. A single memo citing five unclassified procurement figures is unclassified. A report that gathers the same five figures into one table and draws a comparison is a different document, and the SCG is where that distinction lives.

The relevant authority is Executive Order 13526, Section 1.7, which governs classification challenges and derivative classification, and its implementing regulation 32 CFR 2001.22, which defines derivative classification and the requirement to observe and respect original classification decisions. Compilation is a recognized basis for original classification under E.O. 13526 Section 1.4, and derivative classifiers inherit it when the SCG addresses compilation.

The first thing an SCG must do is tell the classifier that compilation is a classification basis at all. Not every SCG includes a compilation provision. When it doesn't, the classifier has no authority to classify by aggregation and should not invent one. When it does, the SCG will typically specify the trigger — a minimum number of source documents, a combination of specific categories, or a described analytical conclusion — that converts an aggregation into classified material.

A second distinction matters. Compilation classification is not the same as "classification by association" in casual use. The SCG should state the level the compilation carries separately from the level each source carries. If the SCG says source documents are Confidential but the compilation is Secret, the classifier has a defined jump. If the SCG is silent on the jump, the classifier has a gap that must be resolved with the OCA before marking.

The Specific Annotation the SCG Requires Beyond the Secret Level

The core answer is that the SCG must require a compilation annotation in the document's classification marking block, typically reading "Classification determined by compilation" or the SCG's own prescribed wording, along with a reference to the SCG provision authorizing it. The classifier adds this annotation in addition to the standard "Derived from" and "Declassify on" lines required by 32 CFR 2001.22(e).

That regulation requires every derivatively classified document to show the source of classification, the derivative classifier's identity and agency, and a declassification date. A compilation basis is a separate element. Without a compilation note, a reviewer reading the "Derived from" line sees only the source documents cited and may conclude the Secret marking is over-classification, because each source is lower.

The SCG should also tell the classifier whether the compilation annotation replaces or supplements the source citation. In most agency practice it supplements: the classifier cites the source documents and adds a line such as "Compilation of source documents listed at Tab A reveals [category]" or the SCG's prescribed equivalent. The classifier must follow the SCG's wording exactly, because the annotation becomes part of the record if the document is challenged.

A third element the SCG should specify is the downgrading and declassification instruction for the compilation. Compilation classifications often have a different decontrol trigger than the individual sources. If the source documents declassify on a date but the compilation's sensitivity derives from their coexistence, the SCG may set a longer duration or require the OCA to review. The classifier needs that instruction before marking "Declassify on."

Read the SCG's Compilation Provision Before You Mark Anything

Follow this sequence when the SCG in hand addresses compilation. Skipping straight to the Secret stamp is where derivative classification errors originate.

1: Locate the compilation section or annex in the SCG. It may be titled "Compilation," "Aggregation," or "Derivative Classification by Combination." 2: Confirm the compilation provision applies to the document type you are classifying. Some SCGs limit compilation classification to specific product lines, such as intelligence assessments or acquisition reports. 3: Identify the trigger threshold the SCG states — number of sources, specific categories, or analytical conclusion. 4: Confirm your document actually meets the trigger. A document that resembles a compilation but lacks the defined combination does not qualify. 5: Apply the classification level the SCG assigns to the compilation, not the level of any single source. 6: Add the SCG's prescribed compilation annotation to the classification block, alongside "Derived from," classifier identity, and "Declassify on." 7: Record the SCG provision reference in the document's classification record.

If the SCG is silent on compilation, stop and route the question to the OCA. Do not downgrade the document to the highest source level and do not classify it at the compilation level on your own judgment. If the SCG's trigger is ambiguous — for example, it says "multiple sources" without a number — the classifier should ask the OCA to define the threshold before marking.

Failure handling matters here. A misclassified compilation that later surfaces in a challenge can force a full review of every document the classifier touched. When in doubt, mark conservatively at the source level, flag the document for OCA review, and document the question. That's a slower path but a defensible one.

The "Derived From" Line Cannot Carry Compilation on Its Own

Many derivative classifiers assume the "Derived from" line handles everything. It doesn't. That line identifies the source authority — the SCG, the original classification decision, or a classified source document — and 32 CFR 2001.22(e) requires it. It does not describe why a document classified above its sources is classified at the higher level.

When the "Derived from" line cites only an unclassified source or a Confidential source, and the document is stamped Secret, the marking is internally inconsistent on its face. A reviewer, an inspector general, or a declassification analyst will flag it immediately. The compilation annotation is what closes that gap.

A useful test: cover the document's content and read only the classification block. A competent reviewer should be able to tell from the block alone whether the Secret marking is a source-derived level or a compilation level. If the block cannot answer that question, the annotation is missing.

The SCG should be explicit about where the annotation goes. In most agency formats it sits in the classification authority block beneath "Derived from" and above "Declassify on." Some agencies place it as a parenthetical after "Derived from." The classifier follows the SCG's format, not a personal preference.

What the SCG Must Say About Duration and Downgrading

Compilation classifications create duration problems that single-source classifications don't. The source documents may declassify on a fixed date, but the compilation's sensitivity depends on their combined existence. If the sources declassify independently over five years, the compilation may retain sensitivity longer than any single source.

The SCG should therefore specify the compilation's declassification instruction separately. Common approaches include a fixed date tied to the most sensitive source, an event-based trigger such as the conclusion of a program, or a requirement that the OCA review the compilation before decontrol. The classifier must apply whichever the SCG states and must not default to the source dates.

Downgrading works the same way. If the SCG allows a Confidential downgrade when one source is removed or a program ends, the classifier records that instruction in the block. If the SCG is silent, no downgrade instruction exists and the classifier marks the higher level with the OCA's default duration.

32 CFR 2001.22(f) requires a declassification date or event on derivatively classified documents, with a maximum of 25 years absent OCA approval for longer. The compilation SCG provision should produce an instruction that fits within that framework. A classifier who cannot derive a compliant duration from the SCG has a defective SCG provision and should raise it.

When the SCG Is Silent, the Classifier's Only Safe Move Is Escalation

A derivative classifier has no authority to create classification decisions. That rule comes from E.O. 13526 Section 1.7 and 32 CFR 2001.22, which limit derivative classifiers to carrying forward original decisions. Compilation is an original decision unless the SCG delegates it.

This is the most common failure case in compilation classification: a document contains an obvious aggregation sensitivity, the SCG says nothing, and the classifier marks it Secret on personal judgment. That's not derivative classification. It's unauthorized original classification, and it exposes both the classifier and the agency.

The correct move is escalation. Document the question, route it to the OCA through the classification management chain, and hold the document at the highest source level in the meantime. If the OCA determines compilation classification applies, the OCA issues or amends the SCG provision, and the classifier then marks accordingly.

Some agencies allow the OCA to issue a one-time classification decision for a specific document rather than amending the SCG. That's a valid path, but the classifier must have the decision in writing and cite it in the "Derived from" line. Verbal guidance is not sufficient for a classification record.

Challenge Reviews Test the Compilation Annotation First

When a document is challenged under E.O. 13526 Section 1.8, the reviewing authority looks at the classification block before the content. A compilation annotation that names the SCG provision and the trigger gives the reviewer a clear path. A block that shows only a Secret level and a lower-level source gives the reviewer an immediate reason to downgrade.

Agency inspectors general and the Information Security Oversight Office (ISOO) both examine compilation markings during compliance reviews. ISOO's annual reports to the President on classification activity note that improper compilation markings are a recurring finding, typically because the annotation is missing or the "Derived from" line cites sources that don't support the level. The annotation is the first line of defense.

The classifier's protection is documentation. If the SCG provision is cited, the trigger is described, and the annotation follows the prescribed format, the classifier has done the job. If a reviewer disagrees with the level, the disagreement is with the SCG or the OCA, not with the classifier's execution.

Challenges also surface duration problems. A reviewer who sees a Secret compilation with a "Declassify on" date tied to a Confidential source will question both the level and the date. The SCG's separate compilation duration instruction prevents that mismatch.

Compilation Marking Compared to Source-Derived Marking

The table below contrasts the two marking situations on the elements a reviewer checks. It's built from the requirements in 32 CFR 2001.22 and the standard agency classification block format.

The verdict on which situation is harder to mark correctly is not close. Compilation marking requires three decisions the source-derived case doesn't: whether the compilation provision applies, what level the SCG assigns, and what duration instruction governs. A classifier who treats compilation marking as source marking plus a stamp will produce a defective document.

Training and Records Keep Compilation Marking Defensible

Agencies that handle compilation classification well build it into derivative classifier training rather than leaving it to the SCG text alone. The training covers the trigger language, the annotation format, and the escalation path when the SCG is silent. ISOO's derivative classification training requirements under 32 CFR 2001.71 set the minimum, and agencies with compilation-heavy product lines add module content.

Records matter as much as training. The classifier's record of the SCG provision and trigger is what supports the marking if the document is challenged years later. A one-line note in the classification file referencing the SCG section and the aggregation logic is sufficient and takes under a minute.

Agencies also maintain SCG review cycles. A compilation provision that made sense when the SCG was written can become obsolete when source documents are declassified or programs end. The OCA's review should check compilation provisions alongside source entries, because a stale compilation trigger produces either over-classification or confusion.

For the individual classifier, the habit that pays off is reading the SCG's compilation section before starting any document that aggregates sources. Ten minutes of reading prevents a marking error that can take months to unwind.

FAQ

Does every SCG include a compilation provision?

No. Many SCGs address only single-source classification, and a classifier whose SCG lacks a compilation section has no derivative authority to classify by aggregation. In that case the classifier holds the document at the highest source level and routes the question to the OCA, who can issue a one-time decision or amend the SCG.

Can a classifier mark a document Secret by compilation without the OCA's involvement?

Only if the SCG itself authorizes compilation classification at that level. Derivative classifiers carry forward original decisions, and a compilation classification is an original decision unless the SCG delegates it. Marking above source levels on personal judgment is unauthorized original classification under E.O. 13526 Section 1.7.

What wording goes in the compilation annotation?

Agencies prescribe their own wording, typically a line such as "Classification determined by compilation" placed in the classification authority block, with a reference to the SCG provision. The classifier follows the SCG's exact wording rather than improvising, because the annotation becomes part of the record if the document is challenged.

Can I use the source documents' declassification dates for a compilation?

Usually not. Compilation sensitivity often outlasts individual source sensitivity, so the SCG should state a separate duration instruction or event. If the SCG is silent on compilation duration, the classifier asks the OCA rather than defaulting to the source dates, which can produce a mismatch a reviewer will flag.

Is compilation classification the same as classification by association?

No, though the terms are sometimes used interchangeably. Compilation classification is a defined basis tied to an SCG provision and a stated trigger. "Classification by association" is informal and carries no authority. A classifier who relies on the informal phrase without an SCG provision has no defensible basis for the marking.

What happens if a compilation annotation is missing from a challenged document?

The reviewing authority sees a document marked above its cited sources with no explanation, which is a standard ground for downgrade. The classification may still be valid, but the classifier or OCA must reconstruct the basis from records, and the document often gets downgraded during the review while the question is resolved.

How long should a classifier spend on the SCG compilation section?

Reading the compilation provision takes under ten minutes for a standard SCG. The cost of skipping it is a defective marking that can take months to correct and can trigger a review of every document the classifier handled. The time computation favors reading first, every time.