Information Security

Confidential, Secret, and Top Secret. Confidential — unauthorized disclosure could cause damage. Secret — unauthorized disclosure could cause serious damage. Top Secret — unauthorized disclosure could cause exceptionally grave damage to national security.

Derivative classification is the incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Most classification actions are derivative.

Only officials designated in writing by the President, Vice President, or agency heads who have been delegated Original Classification Authority (OCA). There are three levels of OCA: Top Secret (agency heads and designated officials), Secret, and Confidential.

Standard Form 86, Questionnaire for National Security Positions. It is the form used to conduct background investigations for personnel who require access to classified information or hold sensitive positions. It covers personal history, employment, finances, foreign contacts, and other security-relevant information.

Confidential, Secret, and Top Secret. Confidential clearances require a Tier 1 (T1) investigation, Secret requires a Tier 3 (T3) investigation, and Top Secret requires a Tier 5 (T5) Single Scope Background Investigation (SSBI).

Under the traditional periodic reinvestigation model, Top Secret clearances required reinvestigation every 5 years. However, DoD is transitioning to Continuous Vetting (CV), which provides ongoing review rather than periodic reinvestigation.

Need-to-know means that a person must have a legitimate requirement for access to classified information in order to perform their official duties. Having a security clearance alone is NOT sufficient — the individual must also have a demonstrated need for the specific information.

Overall classification (top and bottom of each page), portion markings (each paragraph/section), classification authority block (who classified, source, declassification date/event), and any special handling caveats (NOFORN, REL TO, etc.).

NOFORN (Not Releasable to Foreign Nationals) means the information may not be released in any form to foreign governments, foreign nationals, or non-U.S. citizens. It is a dissemination control marking applied to classified and controlled unclassified information.

An SCG is a document issued by an OCA that identifies the elements of information regarding a specific program, plan, or system that must be classified, the level and duration of classification, and any special handling caveats. It is the primary source document for derivative classifiers.

A SCIF is an accredited area, room, group of rooms, building, or installation where Sensitive Compartmented Information (SCI) may be stored, used, discussed, and electronically processed. SCIFs must meet strict physical, technical, and personnel security standards.

Open storage (storing classified material outside a GSA-approved container) requires the room to meet specific construction standards, access controls, intrusion detection systems, and continuous monitoring. Open storage of Top Secret requires the most stringent standards and is rarely authorized.

Classified documents must be destroyed using approved methods that prevent reconstruction: cross-cut shredding (NSA/CSS-approved shredders for TS), burning, pulping, or using approved disintegrators. Destruction must be witnessed by two cleared individuals for Top Secret, and records of destruction maintained.

Protect the material from unauthorized access, do not read it if you lack need-to-know, and immediately report the potential security incident to your security manager or the facility security officer. Do not leave the material unattended.

A security incident is any event that involves the loss, compromise, or suspected compromise of classified information, or any violation of security policy or procedures. Security incidents include spillages, unauthorized disclosures, and loss of classified materials.

A spillage occurs when classified data is introduced onto an unclassified information system, or when higher-classified data is placed on a lower-classified system. Spillages must be reported immediately and the contaminated system must be handled by qualified personnel.

Couriers must have proper clearance and need-to-know, use double-wrapping (opaque inner wrapper with classification markings, plain outer wrapper), maintain constant physical possession, have authorization documentation, and never leave material unattended. Classified may not be carried on commercial aircraft without specific authorization.

Personnel with security clearances must report foreign travel to their security office BEFORE the trip. They must receive a foreign travel briefing covering espionage threats, contact reporting requirements, prohibited electronics, and debriefing requirements upon return. Unofficial foreign contacts of security concern must also be reported.

CUI is information that requires safeguarding or dissemination controls pursuant to law, regulation, or government-wide policy, but is not classified. It replaced various agency-specific markings like FOUO (For Official Use Only), SBU, and LES. CUI is governed by 32 CFR Part 2002.

CUI documents are marked with 'CUI' or 'CONTROLLED' banner at top and bottom, CUI designation indicator, and applicable category. Portions are marked with '(CUI)' prefix. Some categories have specific markings like CUI//SP-PRVCY for privacy-related CUI.

The DoD Information Security Program ensures information critical to national security is properly classified, safeguarded, and declassified. It balances the need to protect information with the public's right to access government information, per Executive Order 13526 and DoDM 5200.01.

EO 13526 (signed by President Obama in 2009) is the governing executive order for the classification and protection of national security information. It establishes the framework for classification levels, OCA, classification duration, declassification, and the Information Security Oversight Office (ISOO).

Under EO 13526, classified records that are 25 years or older and have permanent historical value must be automatically declassified unless they fall under specific exemptions. Agencies must review the information and can only maintain classification if disclosure would still cause identifiable damage to national security.

SAPs are programs established for specific classes of classified information that impose safeguarding and access requirements exceeding those normally required. They require additional vetting beyond a Top Secret clearance. Access is strictly limited and controlled. There are acknowledged and unacknowledged SAPs.

TPI requires that at least two authorized persons are present when accessing specific categories of classified material (most commonly nuclear weapons-related). It ensures no single individual has the opportunity to handle the material without observation.

An end-of-day security check ensures all classified materials are properly secured, safes/containers are locked, classified waste is disposed of properly, computer screens display no classified information, and the SF-701 (Activity Security Checklist) and SF-702 (Security Container Check Sheet) are completed.

SF-701, Activity Security Checklist, is used to record end-of-day security checks in areas where classified materials are used. Personnel verify that classified is secured, waste is destroyed, security containers are locked, and all security requirements are met before closing.

SF-702, Security Container Check Sheet, is attached to each safe or security container holding classified material. It records the date, time, and initials of the person opening, closing, and checking the container. It provides an audit trail of container access.

SF-703, Top Secret Cover Sheet, is placed on top of Top Secret documents when they are removed from storage. It alerts handlers to the classification level and prevents inadvertent exposure. SF-704 (Secret, red) and SF-705 (Confidential, blue) serve the same purpose for lower levels.

Per Executive Order 13587, the DoD insider threat program identifies, deters, and mitigates threats from personnel who misuse their authorized access to classified information. It combines counterintelligence, security, information assurance, and human resources to detect potential threats.

Indicators include unexplained wealth, unusual foreign travel or contacts, attempts to access information beyond need-to-know, disgruntlement, violations of security procedures, working unusual hours without explanation, and unauthorized removal of classified materials.

Any authorized holder of classified information who believes the information is improperly classified may challenge the classification. Challenges should first be raised with the OCA through the security manager. If unresolved, they can be forwarded to the Interagency Security Classification Appeals Panel (ISCAP).

DD Form 254, DoD Contract Security Classification Specification, identifies the security classification requirements for a classified contract. It specifies the classification levels, special access requirements, and security guidance that the contractor must follow.

DCSA (formerly DSS) is the DoD agency responsible for conducting background investigations, managing the National Industrial Security Program, providing security education, and administering Continuous Vetting. It oversees cleared contractor facilities.

Immediately report the contact to your security manager, counterintelligence office, or the FBI. Do not attempt to investigate on your own. Document the details: who, what, when, where, and how. Foreign intelligence services actively target cleared personnel.

Penalties can include administrative sanctions (loss of clearance, removal from position, termination), criminal prosecution under 18 USC 793-798 (Espionage Act) with penalties up to life imprisonment or death for espionage, and civil liability.

CV is the process of reviewing the background of an individual who has been determined eligible for access to classified information at any time during the period of eligibility. It replaces periodic reinvestigations with ongoing automated checks of relevant databases to identify potential risks.

1) Determine if the information is classified by checking authorized sources (SCGs, classified source documents, DD-254). 2) Determine the level and duration of classification. 3) Determine the appropriate portion and overall markings. 4) Apply all required classification markings.

The classification authority block appears on the first page of a classified document. For derivative classification it must include: 'Classified By:' (name/title of derivative classifier), 'Derived From:' (source document or SCG), and 'Declassify On:' (date, event, or exemption).

An initial security briefing educates personnel about their responsibilities for protecting classified information before access is granted. A debriefing reminds personnel of their continuing obligations (including non-disclosure agreements, SF-312) when access is terminated or clearance is revoked.

SF-312, Classified Information Nondisclosure Agreement, is signed by individuals before they are granted access to classified information. It is a legally binding agreement acknowledging the trust placed in the individual and their obligation never to disclose classified information to unauthorized persons.

Personnel with access to classified information who intend to publish or disclose information about their work (books, articles, speeches, social media) must submit the material for pre-publication security review to ensure no classified information is disclosed. This obligation continues after leaving government service.