Ever spent an hour staring at a document, sweating over which classification marking to put at the top of the page? You've got a piece of information that's Secret, but you're pasting it into a report that's Confidential. You start wondering if you need three different banners or if one "highest" marking covers the whole thing.
It's a stressful spot to be in. One wrong mark and you're either over-classifying a document—which wastes everyone's time—or worse, you're under-classifying it and risking a security violation The details matter here..
Here's the thing: commingled document marking isn't as intuitive as the manuals make it sound. If you've ever felt like the rules are written in a different language, you aren't alone Most people skip this — try not to..
What Is Commingled Document Marking
Look, in plain English, a commingled document is just a file that contains information from different classification levels or different handling caveats. It's a "mixed bag."
Imagine you're writing a briefing. Most of the text is unclassified. But then you drop in one paragraph that is Secret. Now, the entire document is "commingled." You can't just mark the one paragraph and call it a day. The whole thing has to be handled according to the most restrictive piece of information inside it The details matter here..
The Concept of the "Highest Level"
The golden rule of commingled marking is that the overall classification of the document is determined by the highest level of classification present. If you have Unclassified, Confidential, and Secret all in one file, the banner is Secret Worth keeping that in mind..
It doesn't matter if 99% of the page is public knowledge. That one Secret sentence dictates how the document is stored, who can see it, and how it's transported. In real terms, this is where most people get tripped up. They think about the "average" level of the document. In security, there is no average. There is only the ceiling.
Worth pausing on this one.
Handling Caveats and Dissemination Controls
It's not just about the levels like Secret or Top Secret. You also have to deal with caveats—those extra labels like NOFORN (No Foreign Nationals) or ORCON (Originator Controlled) And it works..
When you commingle these, you have to account for every restriction that applies to any part of the document. If one paragraph is Secret//NOFORN and another is Secret//REL TO USA, FVEY, the overall banner has to reflect the most restrictive set of controls. If you miss one, you've just accidentally shared restricted data with someone who shouldn't see it Less friction, more output..
Why It Matters / Why People Care
Why do we obsess over this? Because in the world of information security, a banner is a warning sign. It's the "Danger: High Voltage" sign of the intelligence world Not complicated — just consistent..
When a security officer or a recipient looks at the top of a page, they shouldn't have to hunt through the text to figure out how to handle the paper. They need to know instantly. If the banner says Confidential but there's a Secret paragraph buried on page twelve, that's a spill.
Not obvious, but once you see it — you'll see it everywhere.
Real talk: spills are a nightmare. They lead to lockdowns, hardware wipes, and a lot of uncomfortable conversations with your supervisor. Getting the marking right the first time isn't just about following a manual; it's about protecting the people and the assets the information describes.
When people get this wrong, it usually happens because of "classification creep." They get lazy and just mark everything Top Secret to be safe. But over-classification is its own kind of failure. Now, it slows down decision-making and creates unnecessary bottlenecks. The goal is precision.
This changes depending on context. Keep that in mind.
How to Mark a Commingled Document
Getting this right requires a systematic approach. You can't just wing it. You have to treat the document like a puzzle, identifying every piece before you put the frame around it.
Step 1: The Portion Marking Phase
Before you even touch the banner, you have to do portion marking. This is the most critical step. Every paragraph, every bullet point, and every title needs its own marking in parentheses at the start That's the whole idea..
(U) This is an unclassified sentence. (S) This is a secret sentence. (C) This is a confidential sentence.
By marking every single portion, you create a map. Once the map is done, the banner becomes easy. In real terms, you just look for the highest marking used in any single portion. If you see an (S) anywhere, your banner is Secret.
Step 2: Determining the Overall Classification
Once you've portion-marked the whole thing, you determine the overall classification. This is the "ceiling" we talked about earlier.
If your document contains:
- 10 paragraphs of (U)
- 2 paragraphs of (C)
- 1 paragraph of (S)
Your overall classification is Secret. You place this at the top and bottom of every page.
Step 3: Adding the Dissemination Controls
Now you add the caveats. This is where it gets tricky. Worth adding: you have to look at every portion mark again. If any portion is marked NOFORN, then NOFORN must appear in the overall banner The details matter here..
If you have one part that is REL TO USA, FVEY and another that is NOFORN, the NOFORN wins because it's more restrictive. The banner should reflect the most restrictive control that applies to any part of the document Simple, but easy to overlook..
Step 4: The Final Banner Layout
The banner should be centered, in all caps, and clearly visible. A typical commingled banner looks like this:
SECRET//NOFORN
(Note: I'm using a simplified example here, but the logic remains the same regardless of the specific agency's formatting rules).
You put this at the top and bottom of every single page. If the document is long, you might also need a classification block on the cover page that explains exactly why the document is marked the way it is and who the original classification authority (OCA) was.
Common Mistakes / What Most People Get Wrong
I've seen a lot of people struggle with this, and it usually boils down to a few common errors.
The "Majority Rule" Fallacy
The biggest mistake is thinking that if most of the document is Unclassified, the banner should be Unclassified. In practice, i can't stress this enough: the most restrictive piece of data wins. One sentence of Secret data makes the entire document Secret. Period.
Forgetting the Bottom Banner
It sounds silly, but people forget the bottom of the page. In a physical folder, if a page flips or a corner gets torn, that bottom banner is the only thing saving you from a security violation. If the top is missing and the bottom is missing, the document is effectively unmarked.
Misunderstanding "REL TO" (Release To)
People often confuse "Release To" markings with general classification. That's why they think that because a document is Secret//REL TO USA, FVEY, they can just mark it Secret. But "REL TO" is a specific instruction. Because of that, if you strip that away, you're changing the rules of who can see the document. In a commingled environment, you must maintain the most restrictive release instruction.
Ignoring the OCA
Many people forget to include the "Classified By" and "Declassify On" lines. A banner without a declassification date is a red flag for auditors. Practically speaking, you can't just mark something Secret and leave it there forever. Everything has a shelf life Turns out it matters..
Practical Tips / What Actually Works
If you want to stop stressing about this, change your workflow. Here is what actually works in practice.
First, write your draft in a "clean" environment without worrying about banners. Worth adding: just focus on the content. Once the content is finalized, go back and do a "marking pass." This is where you go through and add the (U), (C), and (S) marks. If you try to do both at once, you'll miss things And that's really what it comes down to..
Second, use a checklist. 3. That's why did I mark every single paragraph? Consider this: it sounds basic, but a simple three-point check saves lives:
- Does the banner match the highest portion mark? Day to day, 2. Did I include all necessary caveats?
Third, when in doubt, ask the Security Manager. Honestly, it's better to look "slow" for five minutes while asking a question than to spend five hours filling out a security violation report because you guessed wrong Simple, but easy to overlook. Took long enough..
Lastly, be consistent. If you use S for Secret in one place, don't use SEC in another. On top of that, stick to the standard. Consistency makes it easier for the person reviewing your work to spot errors.
FAQ
What happens if I find a mistake after the document is sent?
You have to report it immediately. This is called a "spillage" or "over-classification" depending on the direction of the error. Contact your security officer. Trying to hide a marking error usually makes the punishment worse.
Can I mark a document as "Unclassified" if it contains "Controlled Unclassified Information" (CUI)?
No. CUI has its own specific marking requirements. While it's not "Classified" in the traditional sense, it still requires a banner (usually CUI) and specific handling. You can't just call it "Unclassified" and ignore the CUI requirements.
Do I need a banner on every page or just the first page?
Every page. Every single one. If a page falls out of a binder, it must be identifiable on its own. If it doesn't have a banner, it's an unmarked classified document, which is a major security breach Easy to understand, harder to ignore. That alone is useful..
What if the document is a mix of different agencies' markings?
Follow the rule of the most restrictive marking. If Agency A marks it Secret and Agency B marks it Top Secret, the document is Top Secret. You should also include both agencies' caveats in the banner, separated by slashes Simple, but easy to overlook..
At the end of the day, marking a commingled document is just about being meticulous. On the flip side, it's not about being a genius; it's about being a perfectionist. Practically speaking, take your time, mark your portions first, and always default to the most restrictive level. It's the only way to be sure The details matter here. And it works..
