If a Derivative Classifier's Authorized Sources Do Not Provide Sufficient Guidance: What Is the Correct First Step?

The correct first step is to stop classifying and escalate the specific gap to the authority that owns the classification policy — typically the information owner or original classification authority (OCA) — through a formal derivative classification review, before any derivative document is marked or signed. You do not fill the gap with personal judgment, and you do not default to the highest or lowest classification level. You document exactly what guidance is missing, which source you consulted, and why it does not resolve the question, then route that record to the responsible authority for a written determination.

That rule comes from the derivative classifier's role itself. Under the U.S. classification system — the framework set by Executive Order 13526 and implemented in 32 CFR Part 2001 — a derivative classifier may only apply markings that are already established by an original classification authority, a properly marked source document, or a classification guide. The moment the authorized sources run out, the derivative classifier has no authority left to exercise. Escalation is not a courtesy; it is the boundary of the job.

Why Insufficient Guidance Halts the Derivative Classification Process

Derivative classification is a copying and carrying-forward function, not a judgment function. The classifier's authority is borrowed from the OCA who made the original determination. When the source document is silent on a paragraph you are incorporating, or a classification guide predates the program you are describing, nothing has been borrowed for that content — so there is nothing lawful to apply.

This is why the first step is escalation rather than research. Researching the underlying facts of a program can help you describe the gap, but it cannot manufacture classification authority. Only an OCA, or a person with delegated original classification authority in writing, can decide that previously unclassified or unaddressed information requires protection.

The distinction matters practically. A derivative classifier who guesses "Confidential" to be safe has created an unauthorized classification, which is itself a violation under 32 CFR 2001.13's prohibition on improper classification. A classifier who guesses "Unclassified" to keep the document moving has potentially disclosed protected information. Both errors trace back to the same mistake: acting without authority instead of escalating.

The First Step in Order: Identify, Document, and Route the Gap

Treat this as a sequence, not a single email. The order matters because a vague escalation ("the guide doesn't cover this") returns a vague answer, and you will be back where you started with a document still unmarked.

1: Pause marking. Do not apply any classification, dissemination control, or declassification instruction to the unresolved portion. Set the draft aside with the gap flagged inline, paragraph by paragraph. 2: Name the exact gap. Write one sentence per unresolved item: what the content is, which authorized source you checked, and what the source says or fails to say. "Paragraph 4.b describes the sensor's detection range; the program classification guide (rev. 3) addresses the sensor's existence but not its performance parameters." 3: Confirm you checked every authorized source you hold. That means the source document itself (front matter, portion markings, and any classification guide referenced in it), the governing classification guide for the program, and any agency-level marking handbook that covers format rather than substance. Record the title, revision, and date of each. 4: Route to the information owner or OCA with a deadline. Send the documented gap to the OCA named in the source document or guide, copying your security manager or classification management officer. State the date you need an answer to meet the document's suspense. 5: Record the determination in writing. When the answer comes back, keep it with the document's classification record. If the OCA says the content is unclassified, that written determination is now part of your authority for future documents with the same content.

Failure handling: if the OCA cannot be reached before the suspense, do not mark and release. Escalate to the security manager for a temporary holding instruction, and treat the document as uncontrolled until a written determination arrives. If two authorized sources conflict — say, a guide says Secret and a marked source document says Confidential — escalate the conflict the same way rather than picking the more restrictive marking, and note both citations in your escalation.

What Counts as an Authorized Source for a Derivative Classifier

You can only escalate credibly if you know what you were entitled to rely on. Under the U.S. system, derivative classifiers work from four categories of authority, and each has a different failure mode when it goes silent.

The fourth row trips people up. Marking handbooks and agency implementing directives tell you how to format a portion marking, where to place it, and which dissemination control codes exist. They are procedural documents. They do not grant classification authority and cannot fill a substantive gap. If your only remaining reference is a marking handbook, you have already exhausted your substantive sources.

Executive Order 13526, as amended, is the顶层 authority most U.S. agencies implement through their own directives — for the Department of Defense that is DoDM 5200.01 series, and for intelligence community elements it is ICD 503 and agency-specific guides. Naming the right implementing directive in your escalation helps the OCA answer faster, because they know exactly which framework you are working under.

What You Must Never Do While the Gap Is Open

The pressure to keep a document moving is real, and the shortcuts people take under that pressure are the ones that create incidents. Four behaviors belong on a hard no list.

Never apply a "conservative" marking you cannot trace to a source. Over-classification is not a safe default; it is improper classification, and it degrades the system by making every marking less trustworthy.

Never downgrade or leave unmarked by default because the source was silent. Silence is not a determination of unclassified status. It is the absence of a determination, which is precisely the condition you are escalating.

Never rely on an unofficial summary, a colleague's recollection, or a prior document's markings as your authority. A previously marked document is a source only for the content it actually covers, and only if its markings were properly derived in the first place. Copying someone else's guess does not create authority.

Never let the delay itself become the decision. A document held past suspense because the gap was never escalated is a failure of the process, and the person who held it owns that failure. Escalation with a documented record is the defensible path; silence is not.

How to Write the Escalation So the OCA Can Answer in One Pass

A well-built escalation gets a same-week answer. A poorly built one bounces back with "which paragraph?" and costs you the suspense. The difference is structure.

Start with the document: title, purpose, suspense date, and the classification guide or source document you are deriving from, with revision and date. Then list each gap as a numbered item with four fields — location, content description, source consulted, and the specific question. "Item 2, paragraph 4.b: detection range of the XR-7 sensor. Program guide rev. 3 covers sensor existence (Secret) but not performance parameters. Question: what level and duration apply to detection range?"

Close with what you need: a written determination per item, the authority's name and title, and the date. Copy your security manager and classification management officer so the record exists in more than one place. If the answer comes back verbal, ask for it in writing before you mark the document — a verbal determination that is later disputed leaves you holding an unmarked paragraph with no paper trail.

Edge case worth knowing: if the gap concerns foreign government information, restricted data, or intelligence sources and methods, the routing changes. Those categories have their own designated authorities, and the program guide may point to a specific office rather than the document's OCA. Check the guide's front matter before you send.

Who Owns the Answer Once the Gap Leaves Your Desk

The determination belongs to the authority, and so does the consequence. Once you have routed the gap and documented it, the classification decision is no longer yours to make or defend — it is the OCA's, and their written response is the record.

That shift matters for accountability. If the OCA determines the content is unclassified, you mark accordingly and cite their determination in the document's classification record. If they determine it is classified at a level the guide did not anticipate, they should also update the guide, because otherwise the next derivative classifier hits the same gap. Flag that in your escalation: "recommend guide update" is a legitimate ask and a useful one.

If the OCA is unavailable, the security manager holds the interim authority to direct a holding action, not to classify. That is an important limit — a security manager can tell you to stop and hold, but cannot substitute their judgment for the OCA's on classification substance unless they hold delegated original classification authority in writing.

Time and Cost of the Escalation Path Compared With Guessing

People skip escalation because it feels slow. In practice, the arithmetic usually favors it once you count the cost of being wrong.

A documented escalation of five gaps in a typical program guide takes roughly one to two hours to assemble — locating the guide, checking each paragraph, writing the itemized questions. A written determination typically returns within three to ten business days depending on the authority's availability. Compare that with the cost of a misclassification incident: a suspected unauthorized disclosure triggers a preliminary inquiry, and a formally reported incident under 32 CFR 2001.14 can consume weeks of security office time, plus re-review of every document the classifier touched while the gap was open.

The guess also has a compounding cost. Every document produced during the open window inherits the same unresolved content, so one bad assumption propagates across a program's entire document set. Escalation resolves the question once and closes it for future documents. The escalation path is the faster path over any horizon longer than a single deadline.

Common Mistakes That Turn a Small Gap Into an Incident

The pattern behind most derivative classification failures is a small gap handled informally and never documented. The classifier asks a colleague, gets a shrug and a "mark it Secret to be safe," and moves on. Three months later no one can say who made the call or why.

A second common mistake is treating a classification guide's silence as coverage. Guides are written for the programs that existed when they were issued. A new sensor, a new partner, or a new deployment concept often falls outside the guide's scope, and the guide will not announce its own obsolescence. Read the guide's applicability statement and effective date, and check whether the content you are marking is within the scope it claims.

A third is escalating to the wrong office. Sending the question to a general security mailbox instead of the named OCA adds a routing hop and often a week. Use the authority named in the source document or guide's front matter, and copy rather than redirect.

Finally, some classifiers escalate verbally and accept a verbal answer. The determination exists only in someone's memory, and when the document is later reviewed by an inspector general or a classification review, the record shows an unmarked paragraph and no authority. Put it in writing every time.

Maintaining a Written Record That Survives Review

The record you build during escalation is the same record that protects you during an audit. Keep it with the document's classification file, not in a personal folder.

A defensible record contains four items: the source documents you consulted with revision and date, the itemized gap list you sent, the authority's written determination, and the date each step occurred. If the determination changed a guide, note the guide update request and its tracking number if one was assigned. Reviewers do not expect derivative classifiers to have all the answers; they expect them to have a traceable path to the authority who did.

Over time, a classifier's escalation record becomes a working supplement to the program guide — a set of resolved questions that new classifiers can consult. That is a legitimate secondary benefit of doing the first step properly. It is not a substitute for the guide being updated, but it shortens the next person's escalation and reduces repeat questions to the OCA.

FAQ

Does "insufficient guidance" mean I should classify at the highest level to be safe? No. Defaulting to the highest level is improper classification under 32 CFR 2001.13, and it does not protect you in a review because there is still no authority behind the marking. The correct action is to escalate the specific gap and hold the marking until a written determination arrives. Over-classification is treated as an error, not a conservative virtue.

What if the classification guide is simply outdated rather than silent? An outdated guide is a coverage gap like any other. Check its effective date and applicability statement; if the content you are marking postdates the guide's scope, treat it as uncovered and escalate, and recommend a guide update in the same message. Do not extend an old guide's categories by analogy to new programs.

Can my security manager answer the classification question if the OCA is on leave? Only if the security manager holds delegated original classification authority in writing. Otherwise they can direct a holding action — stop work, hold the document — but cannot substitute a classification determination. Ask for the delegation in writing before accepting any substantive answer from them.

What happens if I mark the document and release it before the determination comes back? You have created either an unauthorized classification or an unauthorized disclosure, depending on which way you guessed, and both are reportable events. The document may need recall and re-review, and the incident may trigger a preliminary inquiry. Escalation with a documented hold is the only path that avoids both outcomes.

Is a previously marked document an authorized source for new content on the same topic? No. A marked document authorizes carrying forward the markings on the portions it actually contains, nothing more. New content on the same topic requires its own authority — typically the program guide or the OCA. Copying a prior document's marking level as a shortcut is a common source of derivative classification errors.

How long should an escalation take before I push it up the chain? If you have had no acknowledgment within two business days, escalate to the security manager and note the suspense date. If the suspense is within five business days and no determination has arrived, request a holding instruction in writing. Document each push so the delay is attributable to the routing, not to you.

What if two authorized sources give conflicting guidance? Escalate the conflict rather than resolving it yourself, and cite both sources with revision and date in the escalation. Do not automatically pick the more restrictive marking; the conflict itself is the question the OCA needs to settle. Resolving it in writing also flags the guide or source document that needs correction.