Ever tried to figure out what you actually need to do when you’re marking a document “derived” from classified material?
It feels like a maze of acronyms, footnotes, and “must‑haves” that never end.
And then you hit the part that says “you need all of the following… except.”
That “except” is the trickiest bit, because it’s the one thing most people overlook until they’re already in trouble Worth keeping that in mind. Still holds up..
Below is the full rundown of derivative classification, what it demands, and—crucially—the one element that doesn’t belong on the checklist. Grab a coffee, and let’s untangle this together.
What Is Derivative Classification?
Derivative classification is the process of taking existing classified information and incorporating it into a new document, product, or briefing while preserving the original security level. In plain English: if you copy a secret paragraph into a PowerPoint, that slide becomes secret too, and you’re responsible for labeling it correctly.
It isn’t about creating new classified material from scratch; that’s original classification. Instead, you’re “deriving” the classification from something that’s already been marked. The key is that you must follow the rules laid out in the original source and the governing directives (think Executive Order 13526, the Intelligence Community Directive, or the Department of Defense Manual).
The Core Elements
- Source Material – The classified document you’re pulling from.
- Classification Markings – The original security level (Confidential, Secret, Top Secret, etc.).
- Derivation Statement – A brief note that tells the reader the info came from a classified source (e.g., “Derived from XYZ, Secret, 15 May 2023”).
If you get any of those wrong, you could be exposing classified info inadvertently—a big no‑no in any government or contractor environment.
Why It Matters / Why People Care
Because a single slip can cost a career, a contract, or even national security.
Imagine you’re a contractor drafting a briefing for a senior officer. You copy a paragraph from a secret report, forget to add the “Derived from” line, and hand it out. That's why suddenly, you’ve leaked classified material. On top of that, the officer shares it with a colleague who doesn’t have a secret clearance. But the fallout? Revoked clearance, fines, maybe even criminal charges Took long enough..
On the flip side, getting it right protects you, your organization, and the mission. It also builds trust—your supervisors know you can handle sensitive data without turning it into a headline Practical, not theoretical..
How It Works
Below is the step‑by‑step workflow most agencies expect you to follow. Follow it to the letter, and you’ll stay on the safe side It's one of those things that adds up..
1. Identify the Source
- Locate the original document – Make sure you have the latest version.
- Verify the classification level – Look at the banner, headings, and any caveats (e.g., “NOFORN,” “SCI”).
2. Determine What You Can Use
- Need‑to‑know – Only include information you are authorized to see.
- De‑classification guidance – Some sections may be marked for automatic de‑classification after a set date.
3. Create the Derivative Document
- Copy the text – Keep the original wording intact unless you’re paraphrasing (which still requires the same classification).
- Add your own analysis – Your commentary can be unclassified if it doesn’t reveal classified details.
4. Apply the Proper Markings
- Header and footer – Include the classification banner on every page.
- Portion markings – If only part of the document is classified, mark those sections (e.g., “//SECRET//”).
- Derivation statement – Usually placed in the footer or a “Classification Guide” section: “Derived from XYZ, Secret, 15 May 2023.”
5. Review and Approve
- Self‑review – Check for accidental inclusion of unmarked classified material.
- Supervisor sign‑off – Many agencies require a higher‑level review before distribution.
6. Distribute Securely
- Approved channels only – Use encrypted email, secure file transfer, or classified networks.
- Limit recipients – Only those with the appropriate clearance and need‑to‑know.
Common Mistakes / What Most People Get Wrong
-
Assuming “Unmarked” Means Unclassified
A blank page doesn’t magically become public. If it’s derived from a classified source, it inherits the classification whether you mark it or not. -
Skipping the Derivation Statement
That little line is a legal safety net. Without it, auditors can’t trace the origin, and you look like you’re trying to hide something. -
Mixing Classification Levels in One Document
You can have both secret and unclassified sections, but you must clearly separate them with portion markings. Blending them leads to “over‑classification” or accidental leaks. -
Relying on Memory for Dates
Classification expiration dates are precise. If you guess, you might keep something classified longer than required—or worse, release it too early. -
Thinking “All‑Clear” After a Single Review
Peer review is great, but a second set of eyes (especially from a security officer) catches what you miss.
Practical Tips / What Actually Works
- Use a checklist – Keep a printed or digital one on your desk. Tick off source, markings, derivation, review, and distribution.
- Template it – Create a standard PowerPoint or Word template that already includes header/footer markings and a placeholder for the derivation line.
- Color‑code portions – In your draft, highlight classified sections in red. It’s a visual cue that you can’t afford to miss.
- Set calendar reminders – For any de‑classification dates, put a reminder in your calendar a month before they expire.
- Ask when in doubt – It’s better to get a quick clarification from a security manager than to gamble on an assumption.
FAQ
Q: Do I need a derivation statement if I only paraphrase the classified info?
A: Yes. Paraphrasing still counts as derivative work, so you must include the “Derived from” line and apply the same classification.
Q: Can I remove a classification banner if the document is only partially classified?
A: Only if you use proper portion markings to show which parts are still classified. The unclassified sections can be banner‑free, but the classified portions must stay marked And it works..
Q: What does “except” refer to in the “required to have all the following except” rule?
A: The “except” typically points to the derivation statement—some older guidance mistakenly listed it as optional. Modern directives make it mandatory, so the only thing not required is a formal “classification authority” signature on derivative documents (the authority’s sign‑off is only needed for original classification) Easy to understand, harder to ignore..
Q: If I’m a contractor, do I need a security clearance to do derivative classification?
A: Absolutely. You must hold a clearance at the level of the source material and be granted the “need‑to‑know” for that specific information.
Q: How long do I keep derivative documents?
A: Follow the original document’s retention schedule. If it’s marked “Retain 5 years,” that rule applies to the derivative copy as well, unless a higher authority orders otherwise.
Derivative classification can feel like a bureaucratic minefield, but once you internalize the core steps and remember the one thing you don’t need—a formal signature from the original classification authority—you’ll deal with it with confidence.
So next time you open a secret report and start copying, pause, check your checklist, and add that tiny “Derived from” line. It’s a small habit that saves a lot of headaches later. Happy (and secure) writing!
Advanced Tips for Large‑Scale Projects
When you’re dealing with multi‑page briefings, multi‑disciplinary teams, or a rolling series of updates, the basic checklist can become unwieldy. Below are a few proven strategies that keep the derivative‑classification process both compliant and efficient Worth keeping that in mind..
| Situation | Recommended Workflow | Why It Works |
|---|---|---|
| Multiple source documents (e.Open a master “source‑log” spreadsheet. <br>2. Log each source with its classification, origin, and de‑classification date. Practically speaking, | Guarantees continuity of the provenance record across revisions, satisfying both audit and archival requirements. Pull source metadata from a secure API that returns the classification, source ID, and expiry date. For each revision, add a version‑control note (e.g.Only modify the derivation line if the source material changes; otherwise, retain the original line unchanged. In the final product, insert a single “Derived from” line that references the log entry (e.Agree on a common marking convention before any drafting begins. , several classified memos feeding a single PowerPoint) | 1. Run a final “sanity‑check” script that flags any missing or mismatched markings before the file is saved to a controlled folder. Practically speaking, conduct a “joint review” where each agency’s security officer signs off on the final markings. g.Here's the thing — |
| Automated document generation (e. Plus, <br>2. Because of that, , “Rev 2 – added FY23 budget figures”). <br>3. Practically speaking, create a “baseline” document that contains the original derivation statement. Which means g. , script‑driven PDFs) | 1. <br>3. Still, <br>3. Plus, <br>2. On the flip side, | |
| Iterative updates (e. | Prevents “mixed‑marking” errors that can lead to inadvertent over‑release or under‑protection. Think about it: <br>2. g.Because of that, <br>3. So , weekly status reports) | 1. So |
| Cross‑agency collaboration (e. g.That's why embed the classification banner and derivation line as variables in the script. , “Derived from sources #1‑3, see attached log”). Use a shared, read‑only folder that enforces automatic banner insertion via a macro. g.Which means | Keeps the derivation statement concise while preserving a traceable audit trail. Still, , DoD + DOE partners) | 1. |
The “One‑Line” Derivation Statement – A Quick Template
Most organizations accept a compact format that satisfies all three required elements (source, classification, and de‑classification date). Here’s a ready‑to‑copy line you can drop into the header or footer of any derivative product:
Derived from: [Original Document Title] (Classified at [TOP SECRET/SECRET/CONFIDENTIAL] – Source: [Agency/Org], Doc‑No. [###], De‑classify on [MM/DD/YYYY]).
Example:
Derived from: Joint Strategic Assessment – Cyber Threat Landscape (Classified at SECRET – Source: USCYBERCOM, Doc‑No. 2023‑045, De‑classify on 12/31/2029).
If you are pulling from multiple sources, simply separate them with a semicolon:
Derived from: Joint Strategic Assessment – Cyber Threat Landscape (SECRET – USCYBERCOM, 2023‑045, 12/31/2029); Intel Summary – Pacific Theater (CONFIDENTIAL – DIA, 2024‑019, 06/30/2027) It's one of those things that adds up..
Common Pitfalls and How to Avoid Them
| Pitfall | Symptom | Fix |
|---|---|---|
| Missing “Derived from” line | Review flag: “No derivation statement found.Still, ” | Upgrade the banner to match the highest classification among all sources. |
| Incorrect classification level | Banner shows “CONFIDENTIAL” while source is “SECRET. | |
| Portion markings omitted | Unmarked paragraphs contain classified content. That said, | Use the “highlight‑and‑apply” feature in your template to insert [S], [C], or [U] tags as appropriate. Even so, ” |
| Distribution to unauthorized personnel | Email sent to a list that includes non‑cleared recipients. | |
| Expired de‑classification date | Automated tool warns “De‑class date past.In practice, ” | Add the line immediately; if you’re unsure of the exact source, consult the originating author before finalizing. |
Quick‑Reference Checklist (One‑Page PDF)
Most security offices provide a printable “Derivative Classification Cheat Sheet.” If yours does not, create one using the following layout:
- Source Identification – Title, Doc‑No., Agency, Classification, De‑class date.
- Markings – Banner, header/footer, portion markings.
- Derivation Statement – Insert line (see template).
- Review – Peer‑review, security‑office sign‑off (if required).
- Distribution – Verify need‑to‑know, update distribution list.
- Retention – Apply original document’s retention schedule.
Print, laminate, and keep it at every workstation where classified material is handled. The visual cue alone reduces the odds of a slip‑up dramatically Simple, but easy to overlook. That's the whole idea..
Closing Thoughts
Derivative classification isn’t a bureaucratic afterthought; it’s the mechanism that preserves the integrity of the entire classification system while allowing the intelligence community to communicate efficiently. By treating the process as a structured, repeatable workflow—complete with checklists, templates, and automated safeguards—you turn a potential compliance nightmare into a routine part of daily work.
This is where a lot of people lose the thread.
Remember the three pillars:
- Know the source – Always have a documented, current reference.
- Mark it correctly – Banner, header/footer, and portion markings must mirror the source’s highest classification.
- State the derivation – The concise “Derived from” line ties everything together and satisfies the statutory requirement.
When in doubt, pause, consult the source log, and ask a security officer. A few extra seconds now prevent a costly breach later Not complicated — just consistent. Took long enough..
With these practices embedded in your routine, you’ll produce clear, compliant, and secure derivative documents—every time Worth keeping that in mind..
