Ever spent an hour staring at a document, sweating over which classification marking to put at the top of the page? Because of that, you've got a piece of information that's Secret, but you're pasting it into a report that's Confidential. You start wondering if you need three different banners or if one "highest" marking covers the whole thing.
It's a stressful spot to be in. One wrong mark and you're either over-classifying a document—which wastes everyone's time—or worse, you're under-classifying it and risking a security violation Worth knowing..
Here's the thing: commingled document marking isn't as intuitive as the manuals make it sound. If you've ever felt like the rules are written in a different language, you aren't alone.
What Is Commingled Document Marking
Look, in plain English, a commingled document is just a file that contains information from different classification levels or different handling caveats. It's a "mixed bag."
Imagine you're writing a briefing. But then you drop in one paragraph that is Secret. Now, the entire document is "commingled.Most of the text is unclassified. " You can't just mark the one paragraph and call it a day. The whole thing has to be handled according to the most restrictive piece of information inside it The details matter here. And it works..
And yeah — that's actually more nuanced than it sounds.
The Concept of the "Highest Level"
The golden rule of commingled marking is that the overall classification of the document is determined by the highest level of classification present. If you have Unclassified, Confidential, and Secret all in one file, the banner is Secret.
It doesn't matter if 99% of the page is public knowledge. They think about the "average" level of the document. In security, there is no average. Now, this is where most people get tripped up. That one Secret sentence dictates how the document is stored, who can see it, and how it's transported. There is only the ceiling.
Handling Caveats and Dissemination Controls
It's not just about the levels like Secret or Top Secret. You also have to deal with caveats—those extra labels like NOFORN (No Foreign Nationals) or ORCON (Originator Controlled) Less friction, more output..
When you commingle these, you have to account for every restriction that applies to any part of the document. On the flip side, if one paragraph is Secret//NOFORN and another is Secret//REL TO USA, FVEY, the overall banner has to reflect the most restrictive set of controls. If you miss one, you've just accidentally shared restricted data with someone who shouldn't see it Small thing, real impact..
Why It Matters / Why People Care
Why do we obsess over this? Plus, because in the world of information security, a banner is a warning sign. It's the "Danger: High Voltage" sign of the intelligence world Not complicated — just consistent..
When a security officer or a recipient looks at the top of a page, they shouldn't have to hunt through the text to figure out how to handle the paper. They need to know instantly. If the banner says Confidential but there's a Secret paragraph buried on page twelve, that's a spill.
Real talk: spills are a nightmare. They lead to lockdowns, hardware wipes, and a lot of uncomfortable conversations with your supervisor. Getting the marking right the first time isn't just about following a manual; it's about protecting the people and the assets the information describes And that's really what it comes down to..
When people get this wrong, it usually happens because of "classification creep." They get lazy and just mark everything Top Secret to be safe. But over-classification is its own kind of failure. Which means it slows down decision-making and creates unnecessary bottlenecks. The goal is precision.
How to Mark a Commingled Document
Getting this right requires a systematic approach. You can't just wing it. You have to treat the document like a puzzle, identifying every piece before you put the frame around it Took long enough..
Step 1: The Portion Marking Phase
Before you even touch the banner, you have to do portion marking. Plus, this is the most critical step. Every paragraph, every bullet point, and every title needs its own marking in parentheses at the start.
(U) This is an unclassified sentence. And (S) This is a secret sentence. (C) This is a confidential sentence.
By marking every single portion, you create a map. In practice, once the map is done, the banner becomes easy. You just look for the highest marking used in any single portion. If you see an (S) anywhere, your banner is Secret That alone is useful..
Step 2: Determining the Overall Classification
Once you've portion-marked the whole thing, you determine the overall classification. This is the "ceiling" we talked about earlier.
If your document contains:
- 10 paragraphs of (U)
- 2 paragraphs of (C)
- 1 paragraph of (S)
Your overall classification is Secret. You place this at the top and bottom of every page Simple as that..
Step 3: Adding the Dissemination Controls
Now you add the caveats. This is where it gets tricky. You have to look at every portion mark again. If any portion is marked NOFORN, then NOFORN must appear in the overall banner Less friction, more output..
If you have one part that is REL TO USA, FVEY and another that is NOFORN, the NOFORN wins because it's more restrictive. The banner should reflect the most restrictive control that applies to any part of the document.
Step 4: The Final Banner Layout
The banner should be centered, in all caps, and clearly visible. A typical commingled banner looks like this:
SECRET//NOFORN
(Note: I'm using a simplified example here, but the logic remains the same regardless of the specific agency's formatting rules) Surprisingly effective..
You put this at the top and bottom of every single page. If the document is long, you might also need a classification block on the cover page that explains exactly why the document is marked the way it is and who the original classification authority (OCA) was Not complicated — just consistent..
Common Mistakes / What Most People Get Wrong
I've seen a lot of people struggle with this, and it usually boils down to a few common errors And that's really what it comes down to..
The "Majority Rule" Fallacy
The biggest mistake is thinking that if most of the document is Unclassified, the banner should be Unclassified. I can't stress this enough: the most restrictive piece of data wins. One sentence of Secret data makes the entire document Secret. Period Small thing, real impact..
Forgetting the Bottom Banner
It sounds silly, but people forget the bottom of the page. Day to day, in a physical folder, if a page flips or a corner gets torn, that bottom banner is the only thing saving you from a security violation. If the top is missing and the bottom is missing, the document is effectively unmarked Surprisingly effective..
Misunderstanding "REL TO" (Release To)
People often confuse "Release To" markings with general classification. And they think that because a document is Secret//REL TO USA, FVEY, they can just mark it Secret. But "REL TO" is a specific instruction. If you strip that away, you're changing the rules of who can see the document. In a commingled environment, you must maintain the most restrictive release instruction Practical, not theoretical..
Ignoring the OCA
Many people forget to include the "Classified By" and "Declassify On" lines. A banner without a declassification date is a red flag for auditors. Plus, you can't just mark something Secret and leave it there forever. Everything has a shelf life That's the part that actually makes a difference..
Practical Tips / What Actually Works
If you want to stop stressing about this, change your workflow. Here is what actually works in practice.
First, write your draft in a "clean" environment without worrying about banners. " This is where you go through and add the (U), (C), and (S) marks. Just focus on the content. Once the content is finalized, go back and do a "marking pass.If you try to do both at once, you'll miss things It's one of those things that adds up..
Second, use a checklist. It sounds basic, but a simple three-point check saves lives:
- Still, did I mark every single paragraph? 2. Does the banner match the highest portion mark? In practice, 3. Did I include all necessary caveats?
Third, when in doubt, ask the Security Manager. Honestly, it's better to look "slow" for five minutes while asking a question than to spend five hours filling out a security violation report because you guessed wrong.
Lastly, be consistent. Worth adding: if you use S for Secret in one place, don't use SEC in another. Because of that, stick to the standard. Consistency makes it easier for the person reviewing your work to spot errors Worth knowing..
FAQ
What happens if I find a mistake after the document is sent?
You have to report it immediately. This is called a "spillage" or "over-classification" depending on the direction of the error. Contact your security officer. Trying to hide a marking error usually makes the punishment worse No workaround needed..
Can I mark a document as "Unclassified" if it contains "Controlled Unclassified Information" (CUI)?
No. CUI has its own specific marking requirements. While it's not "Classified" in the traditional sense, it still requires a banner (usually CUI) and specific handling. You can't just call it "Unclassified" and ignore the CUI requirements.
Do I need a banner on every page or just the first page?
Every page. Every single one. If a page falls out of a binder, it must be identifiable on its own. If it doesn't have a banner, it's an unmarked classified document, which is a major security breach.
What if the document is a mix of different agencies' markings?
Follow the rule of the most restrictive marking. If Agency A marks it Secret and Agency B marks it Top Secret, the document is Top Secret. You should also include both agencies' caveats in the banner, separated by slashes The details matter here..
At the end of the day, marking a commingled document is just about being meticulous. It's not about being a genius; it's about being a perfectionist. Take your time, mark your portions first, and always default to the most restrictive level. It's the only way to be sure.
