For DoD personnel, the document is DoD 5200.01 Volume 2, DoD Information Security Program: Marking of Classified Information, with the "Derivative Classification" chapter of the DoD Security Classification Guide serving as the day-to-day working reference. Executive Order 13526 sets the underlying rule: derivative classification can only restate or consolidate what an original classifier already decided. Anything new must go back to an original classification authority.
Where the Requirement Comes From: EO 13526, Part 2, Section 2.1
Section 2.1 of Executive Order 13526, signed December 29, 2009, defines derivative classification as incorporating, paraphrasing, restating, or generating information already classified, in a form that carries the same classification markings. The order names the sources a derivative classifier may work from: the source document, a security classification guide, and a properly marked derivative product. It also requires that every derivative be reviewed for accuracy by a subject matter expert, which explains why the training repeatedly tells you to compare your output against the source line by line. The order does not list any other lawful source, and that short list is the first thing to memorise.
The execution machinery sits in DoD Instruction 5200.01 and its companion volumes, which implement the order across the department. Volume 2 of the 5200.01 series is the marking volume, and it carries the derivative classification chapter that tells a DoD employee, contractor, or reservist how to convert a properly marked source into a new marked product. Volume 1 covers policy, Volume 3 covers safeguarding, and Volume 4 covers declassification. Knowing which volume does what saves time when a question comes up mid-task.
The third layer is the DoD Security Classification Guide, and this is where the phrase "basic guidance" from the query really lands. A SCG is a document issued by an original classification authority that lists what is classified, at what level, for how long, and why. When you derive, you work against the SCG or the source document, not against your own sense of what seems sensitive. The guide is the authority; you are the conduit.
Read the chain top to bottom and the rules make sense: the order authorises the practice, the instruction and volumes explain how to execute it, and the guide supplies the specific line items. A derivative classifier who understands the chain stops guessing at the margins, because every marginal question has a place in the chain where the answer either exists or must be escalated.
Definition Under the Order: Restating, Not Re-Deciding
Derivative classification means applying classification markings to material you produce that contains, paraphrases, or restates already-classified information, in a new form that requires the same protection. The consolidation angle matters as much as the restating angle: a briefing slide that pulls one line from three separate classified sources is derivative, and so is a compilation that adds no new judgment but reorganises classified content into a single product. The classification decision itself was made upstream, by an original classification authority, and it travels with the information wherever you take it.
The term gets confused with original classification, and that confusion is the most common source of training failures. Original classification is the initial determination that information needs protection and the assignment of a level and duration, and only a small number of officials hold that authority in writing. Derivative classification assumes that determination already exists. If you find yourself asking whether something should be classified, you have stepped out of derivative territory and into a question for the original classification authority.
Misuse of the term usually looks like an employee adding a new sensitive fact to a derivative product and giving it the same markings as its source, reasoning that the product is "derivative anyway." That is extension of classification, and it is not permitted. The DoD guide and the 5200.01 volume treat any added classified content as a new classification action that requires an original classification authority to be consulted, even when the addition seems minor. The distinction sounds bureaucratic until you watch it matter in an audit.
The rule has a clean test: if every classified fact in your product can be traced to a specific line, paragraph, or page in a source, you are deriving. If a fact cannot be traced, you are classifying, and you need to stop and ask.
The Five-Step Derivative Classification Process, in Order
The process below follows the sequence the DoD guide teaches. Work it in this order rather than reading ahead, because steps two through five depend on what step one produces.
1: Identify the source and confirm it carries classification markings. Pick up the source document, security classification guide, or marked derivative product. Check that it is marked at the appropriate level, because an unmarked copy of a classified document cannot serve as a derivative source. 2: Extract the classified facts and note their exact location. Copy the specific sentences, phrases, or data points you intend to use, and write down page, paragraph, and marking next to each. This location record becomes your evidence trail. 3: Determine the level from the source marking, not from your own judgment. If the source is Secret, your derivative carries that Secret line. When two sources carry different levels, the higher level governs the product. 4: Apply the correct markings and the source attribution line. Mark the product with the level, the reason for classification from the source, and the "Derived From" or "Classified By" attribution the guide specifies for the product format. 5: Submit for review and correct anything the reviewer flags before release. The review confirms accuracy and the markings. Anything returned must be fixed before the product leaves your hands.
Failure handling matters here. When a source is unmarked, stop and check with the source's originating office before using it; the unmarked copy may be a handling error, not an authorised release. When two sources conflict, mark at the higher level and document the conflict in your notes. When you cannot trace a fact to a source, remove it and notify the original classification authority for a determination.
Derivative versus Original Classification: One Unit of Effort Apart
The distinction below frames the cost of getting the boundary wrong. The comparison is not academic; it decides which process, timeline, and signature your product needs.
| Dimension | Derivative classification | Original classification |
|---|---|---|
| Who may perform it | Any authorised DoD employee, contractor, or reservist with training | Only officials holding written original classification authority |
| What it produces | Restatement of existing classified information in a new form | A new determination that information requires protection |
| Source of the level | The source document or security classification guide | The official's own reasoned judgment |
| Typical time per product | Hours to a few days, mostly annotation and review | Weeks, including rationale, duration, reasons, and records |
| Recurring requirement | Annual training and ongoing source review | Annual authority certification and declassification review |
| Evidence trail | Traceability record linking each fact to its source | Classification rationale explaining why the information is sensitive |
| Failure mode | Over-marking or under-marking a restated fact | A classification decision that cannot be defended on review |
| Where the rule lives | DoD 5200.01 Volume 2, EO 13526 Section 2.1 | Same executive order, delegation records, and DoD Instruction 5200.01 |
The table answers the question most people actually have, which is whether they can make a classification decision on their own. They cannot, and the two-hour derivative training exists partly to make that limitation explicit.
The "annual" row comes from DoD policy set in DoD Instruction 5200.01: derivative classifiers must complete derivative classification training before deriving and refresh it annually, with the training sourced by name in the policy. An office that lets that lapse is exposed at the next inspection, regardless of how careful the individual analysts have been.
Source Documents, Security Classification Guides, and the Attribution Line
EO 13526 names three lawful sources and the DoD guide enforces all three: the source document, a security classification guide, and a correctly marked derivative product. Each carries markings the derivative classifier must read, including the classification level, the reason for classification, and the declassification instruction. The "Classified By" or "Derived From" line at the bottom of a marked page is the attribution the next person down the line will rely on, and a missing attribution line breaks the chain for every product built on yours.
The SCG is the source with the most concrete structure, because it lists categories, levels, and reason codes rather than relying on narrative. When a guide lists a category at Confidential and a related category at Secret, the derivative classifier must pull the correct category from the guide, not the highest-numbered one. Working from the source document is messier, because the source may contain multiple levels on multiple pages. The annotation habit from the process steps pays off here.
One edge case comes up in contractor facilities, where a source marked with a "Classified By" line naming an original classification authority may not be available at the higher level for the contractor's program. The correct behaviour is to ask the contracting officer's security office for the applicable guide extract, not to infer the level. The policy anticipates this and routes the request through the security office rather than through the analyst.
Mark every product with the source attribution in the format the guide specifies, and keep a copy of the source-trace record with the product's working papers. The markings are not decoration; they are the mechanism the review step in the next section uses to verify the product.
The Review Step: What a Reviewer Actually Checks
The reviewer at step five of the process is checking three things in a fixed order: first, whether every classified fact is traceable to the source the product cites; second, whether the markings match the sources exactly; and third, whether anything in the product has been added that no source covers. The trace record makes the first check fast. Without it, the reviewer has to reconstruct your work, which usually means the product gets returned.
Unmarked or under-marked derivatives are the failure the process exists to catch, because the checklist in 5200.01 Volume 2 names over-classification, under-classification, and missing markings as reportable errors with correction timeframes. The reviewer is authorised to return a product for correction and to require the fix before release. In most commands, the reviewer is a trained derivative classifier with review duty, not the original classification authority, because the review tests the derivation, not the classification decision.
The reviewer is not authorised to expand the classification or make new determinations. If the reviewer believes the source level is wrong, the correct action is to notify the original classification authority, not to change the product's markings. This boundary matters because reviewers who "fix" levels in the review step create a paper trail that does not match the source, which can surface in an inspection.
A review that passes with no changes is still a pass, and the record should show who reviewed, when, and against which source. Keep that record with the product for as long as the product's retention schedule requires.
Training Requirements and Frequency Under DoD Instruction 5200.01
DoD Instruction 5200.01 requires derivative classification training before a person produces derivative products and refreshes it annually. The instruction and the 5200.01 volumes set the requirement, and each component implements it through its own training portal. For DoD civilians, uniformed personnel, and contractor employees working on DoD programs, the requirement travels with the role, not the grade, which is why a senior analyst who has never derived also needs the training before producing a derivative product.
The training content the query is asking about maps onto the guide's five-step process and the source hierarchy from EO 13526. Courses typically cover the order, the three lawful sources, the five-step process, the three common failures, and the deletion of old markings. The annual refresh requirement exists because the source documents change, and a derivative classifier who has not reviewed a guide in a year is one marking error away from an inspection finding.
The contractor case is the one most often mishandled. A contractor employee's training requirement is satisfied through the program's training, and the security office records completion. The requirement is not waived for someone who works briefly on a tasked effort. The security office, not the program manager, is the authority to ask about training status.
Keep the training record with the individual's file and schedule the refresh on the anniversary of completion. A lapse does not invalidate products already produced, but it does suspend the authority to derive until the refresh is complete.
Marking Conventions: Levels, Reason Codes, and Occupancy
The marking set on a derivative product has four parts: the classification level, the reason for classification from the source, the declassification instruction, and the attribution that names the source or original classification authority. The DoD guide specifies where each part goes on a page and page count, and the order of operations in the process steps follows that layout. The layout is not cosmetic, because a derivative that omits a part cannot be read by the next classifier with the same confidence as a fully marked source.
The level hierarchy is Confidential, Secret, and Top Secret, and the derivative classifier must use the source's level rather than a higher default. Over-marking is not a safe choice under the DoD guide; it inflates the protection burden and is a reportable error in the volume 2 checklist. The correct number to attach to any fact is the one the source carries.
Handling instructions are a separate question from the classification level. A derivative product inherits the handling caveats that apply to its source, including dissemination controls and special access requirements the source carries. The derivative classifier should not assume that removing a caveat from the product is permissible.
When a product draws on multiple sources, mark each portion at the level of the source that supports it, and mark the overall product at the higher level. The formal marking process in the guide's derivative section builds this out page by page.
Common Failure Cases That Reach an Audit
The first failure case is marking from memory. An analyst who remembers a source as Secret but pulls a Confidential source produces a product marked at the wrong level. The trace record fixes this, which is why the process places it at step two. A real inspection finding from DoD program security practice is the "copy-forward" error: a product is marked correct on page one and loses its markings on the pages where content was reformatted from tabular into prose.
The second failure case is deriving from an unmarked extract. Someone received a page from an originating office without markings and treated it as unclassified. The guide's rule for this case is to route the request through the originating office before any derivation happens. The page is not a lawful derivative source until it is properly marked.
The third case is the "kitchen-sink" derivative: an intelligence product that pulls from sources at three different levels and marks the whole product at the highest, losing the per-portion detail. The guide accepts the overall level but requires the per-portion marks. The audit finding is the missing per-portion detail rather than the overall level.
The fourth case is a training lapse combined with a source change. A classifier trained on the previous version of a guide produces a product against the updated guide, and the product is marked against a line item that has since been revised. The annual refresh exists exactly to close this gap. The security office tracks the guide revisions alongside the training records.
Reading the failure cases together, the common thread is paperwork that drifts from fact. The guide's process steps and the volume 2 checklist are both designed to catch that drift before a product leaves the office.
FAQ
Is the DoD Security Classification Guide a single document or a family of documents?
It is a family. Each original classification authority issues guides for its own program areas, and there is no single department-wide guide that covers every classified fact. The guide applicable to your product is the one issued by the authority for your program, and your command's security office can identify it.
How many hours of derivative classification training does the DoD require each year?
The required element is one training completion per year, delivered through the component's own course. Course duration varies by component and by whether the training is a self-paced module or a classroom session, so confirm the current course length with your component's training portal rather than relying on a fixed number.
What happens if I derive from a source that is later discovered to be unmarked?
Stop the product, notify your security office and the source's originating office, and preserve the working papers. The correction may require a re-marking of the product or a withdrawal if the source was not authorised for release. Do not try to fix the markings yourself without guidance from the security office.
Can I mark a derivative product with a level I believe is correct even if the source carries a lower level?
No. Derivative classification may not raise or lower the source's level. If you believe the source is under-marked, notify the original classification authority through your security office and continue with the source's level in the meantime. Doing anything else creates an unauthorised classification.
How does the DoD's derivative rule differ from the U.S. government's general marking rule?
It is the same rule. EO 13526 Section 2.1 applies across the executive branch, and DoD Instruction 5200.01 adds DoD-specific implementation through 5200.01 Volume 2. Other agencies have their own implementing instructions, so a product built under another agency's instruction should be re-checked against DoD's markings before it enters a DoD system.
What is the fastest way to lose a review on a derivative product?
Omitting the source attribution line. Without it, the reviewer cannot trace the product's facts back to the source without reconstructing the analyst's work, and the product gets returned even if every level is correct. The attribution line is the first thing the reviewer reads.
Does a product built from a properly marked derivative product need any further review?
Yes. A derivative product is a lawful source under EO 13526, but the product you build from it still must go through steps two through five, including the trace record and the review. A product derived from a derivative has the same obligation as a product derived from an original source, and the chain of attribution must reach back to an original classification authority.
What counts as a "new" fact for the purpose of the derivative rule?
A new fact is one whose content cannot be matched to a specific line, paragraph, or page in a lawful source. Adding a percentage, a date, a name, or a conclusion the source does not state is a new fact even if the surrounding material is restated verbatim. New facts require the original classification authority, not the derivative process.
This article is general educational information about DoD information security policy and is not a legal opinion, an official determination, or a substitute for your component's security office guidance. Classification questions about specific information must go to the original classification authority through your security office, and questions about personally identifiable or legally sensitive material should go to a qualified professional in your jurisdiction.