You ever get handed a stack of classified files and told, "Go ahead, mark the new one based on these"? Sounds simple. It isn't.
The question of which of the following are authorized sources for derivative classification trips up more people than you'd think. And it matters, because getting it wrong doesn't just make you look careless — it can blow the protection right off information that someone's life might depend on.
What Is Derivative Classification
Let's skip the textbook talk. Derivative classification is what you're doing when you take already-classified info and use it to make something new — a briefing, a report, a slide deck — and you stamp that new thing with a classification level based on the source Worth keeping that in mind..
You're not originating the classification. You're deriving it. The original call was made by someone with the authority to do that. Your job is to carry it forward correctly Still holds up..
So when people ask which of the following are authorized sources for derivative classification, they're really asking: what am I allowed to lean on when I'm deciding how to mark this new thing?
The Official Authorized Sources
Here's the short version. So under U. S.
- A classification guide issued by a classifying authority
- A previously classified source document, marked with its classification
- A source that's been classified by an original classification authority and is properly identified
- Direct guidance from an original classification authority
That's it. Those are the lanes. If it's not one of those, you're not authorized to use it as the basis for a derivative determination.
What Doesn't Count
A rumor from a coworker. Even so, a Reddit thread. Plus, a news article. That's why a memo someone says is "probably secret" but isn't marked. None of that is an authorized source.
I know it sounds simple — but it's easy to miss when you're under deadline pressure and someone hands you a sticky note that says "just use the same level as last time."
Why It Matters
Why does this matter? Because most people skip the "authorized" part and just copy whatever label was on the last file It's one of those things that adds up. Worth knowing..
In practice, derivative classification is where the system actually lives. Original classification happens rarely, by a small number of people. Everything else — the daily flood of reports, cables, presentations — is derivative.
If you pull from an unauthorized source, you might over-classify, which wastes resources and hides info that should be public. Or worse, you under-classify, and now something sensitive is walking out the door unprotected The details matter here..
Turns out, a lot of leaks aren't dramatic spy stuff. They're quiet mistakes made by someone who thought they knew which sources were authorized — but didn't.
Real-World Fallout
A friend in government once told me about a contractor who built a training packet using a news clip and an unmarked email. The underlying data was from a classified assessment. So naturally, " It wasn't. Marked the whole thing "Unclassified.The contractor used an unauthorized source and didn't realize it.
That's how careers end. Not with a bang, but with a poorly sourced footnote That's the part that actually makes a difference..
How It Works
Okay, so how do you actually do this without losing your mind? Here's the grounded version Turns out it matters..
Step One: Identify Your Source
Before you mark anything, you need to know what you're basing it on. A marked source document? In practice, is it a classification guide? A directive from an original classification authority?
If you can't point to one of those, stop. You don't have an authorized source for derivative classification yet Which is the point..
Step Two: Extract the Relevant Classification
Read the source. Which means find the part that maps to what you're writing. The classification guide will usually tell you exactly what's Confidential, Secret, or Top Secret, and why.
A source document will carry its own markings — usually at the top, bottom, and on each page. You carry those forward.
Step Three: Apply It to the New Material
You don't get creative here. If the guide says a specific data point is Secret, your new document containing that point is Secret. You mark it, you cite the source, and you move on Less friction, more output..
Here's what most people miss: you also have to carry forward the reason lines. The little codes like (U) or (S) with the applicable exemption. That's not busywork. It's the trail that shows you used an authorized source.
Step Four: Document Your Derivation
If you're create a derivative document, you should identify the source you used. Not the whole library — just the authorized source that supported the classification call.
This is where audits happen. Years later, someone may ask: which of the following are authorized sources for derivative classification did you rely on? You need to be able to answer that with a specific guide or document, not "I think it was from the shared drive.
Step Five: Challenge Unmarked Inputs
If someone gives you info and says "this is classified but I lost the marking," that's a problem. Here's the thing — you cannot use it as an authorized source. Send it back. Ask for the original classification authority's call or a proper guide It's one of those things that adds up..
Look, it's awkward. But it's less awkward than explaining a spill to your inspector general.
Common Mistakes
Honestly, this is the part most guides get wrong — they list the rules and skip the human errors.
One big one: treating a previously classified document as authorized when it's been declassified but not relabeled. If the marking says "Declassified," it's not your source for a new Secret product Not complicated — just consistent. And it works..
Another: using a derivative document as the source for another derivative. Chain of custody matters. That's why you can do that — but only if it properly cites its own authorized source. If the link breaks, you're unauthorized Practical, not theoretical..
And the classic: assuming "everyone knows this is classified" counts. It doesn't. The system runs on markings and guides, not vibes.
The "Casual Verbal Okay" Trap
A supervisor says, "Yeah, just mark it Secret like the other one.And " That's not an authorized source. A verbal okay isn't a classification guide. Get it in writing, or get the actual document Nothing fancy..
Over-Reliance on Software
Some tools auto-suggest markings. So the guide or document is. Fine as a helper. But the software isn't the authorized source. You are.
Practical Tips
Here's what actually works if you do this for a living.
Keep a bookmark folder of current classification guides you're cleared for. When in doubt, open the guide, not the group chat.
If you're new, ask to see three examples of properly derived docs from your shop. Notice how they cite sources. Mimic that.
Write the source ID on your notes before you write the product. Future you will thank you at audit time.
And if you're ever in a room where someone says "we don't have the guide but just use the same level," say no. Politely. Firmly. That's how you stay clean It's one of those things that adds up..
Build a Personal Check List
Mine looks like this:
- Source marked or guided? On top of that, yes/no
- Original authority identifiable? Because of that, yes/no
- Reason lines carried? Yes/no
- Citation included?
If any no, I don't ship Not complicated — just consistent..
FAQ
Which of the following are authorized sources for derivative classification? The authorized sources are: a current classification guide, a properly marked previously classified document, information classified by an original classification authority, and direct guidance from such an authority The details matter here..
Can I use a Wikipedia article as a source for derivative classification? No. Unauthorized. Public articles aren't valid bases for assigning or carrying classification.
Is a derivative document an authorized source by itself? Only if it clearly cites the authorized original source (guide or originally classified material). You're relying on the chain, not the derivative alone Took long enough..
What if my classification guide is expired? Then it's not a current authorized source. You need a refreshed guide or direction from an original classification authority before you derive Less friction, more output..
Do I need special training to do derivative classification? Yes. Typically you must be trained and authorized in your organization's security program before handling or creating classified derivative material.
The system isn't built to trip you up. In real terms, it's built so that a year from now, someone can trace exactly why a page is marked the way it is. Stick to the authorized sources, cite them like your job depends on it — because it does — and the rest gets a lot less scary.
