Classification

32 C.F.R. Part ..., Subpart B
in effectEffective: 2024-07-01

32 C.F.R. § 2001.10 Classification standards.

Identifying or describing damage to the national security. Section 1.1(a) of the Order specifies the conditions that must be met when making classification decisions. Section 1.4 specifies that information shall not be considered for classification unless its unauthorized disclosure could reasonably be expected to cause identifiable or describable damage to the national security. There is no requirement, at the time of the decision, for the original classification authority to prepare a written description of such damage. However, the original classification authority must be able to support the decision in writing, including identifying or describing the damage, should the classification decision become the subject of a challenge or access demand pursuant to the Order or law.

32 C.F.R. § 2001.11 Original classification authority.

(a) General. Agencies shall establish a training program for original classifiers in accordance with subpart G of this part. (b) Requests for original classification authority. Agencies not possessing such authority shall forward requests to the Director of ISOO. The agency head must make the request and shall provide a specific justification of the need for this authority. The Director of ISOO shall forward the request, along with the Director's recommendation, to the President through the National Security Advisor within 30 days. Agencies wishing to increase their assigned level of original classification authority shall forward requests in accordance with the procedures of this paragraph. (c) Reporting delegations of original classification authority. All delegations of original classification authority shall be reported to the Director of ISOO. This can be accomplished by an initial submission followed by updates on a frequency determined by the senior agency official, but at least annually.

32 C.F.R. § 2001.12 Duration of classification.

(a) Determining duration of classification for information originally classified under the Order—(1) Establishing duration of classification. Except for information that should clearly and demonstrably be expected to reveal the identity of a confidential human source or a human intelligence source or key design concepts of weapons of mass destruction, an original classification authority shall follow the sequence listed in paragraphs (a)(1)(i), (ii), and (iii) of this section when determining the duration of classification for information originally classified under this Order. (i) The original classification authority shall attempt to determine a date or event that is less than 10 years from the date of original classification and which coincides with the lapse of the information's national security sensitivity, and shall assign such date or event as the declassification instruction. (ii) If unable to determine a date or event of less than 10 years, the original classification authority shall ordinarily assign a declassification date that is 10 years from the date of the original classification decision. (iii) If unable to determine a date or event of 10 years, the original classification authority shall assign a declassification date not to exceed 25 years from the date of the original classification decision. (2) Duration of classification of special categories of information. The only exceptions to the sequence in paragraph (a)(1) of this section are as follows: (i) If an original classification authority is classifying information that should clearly and demonstrably be expected to reveal the identity of a confidential human source or a human intelligence source, the duration shall be up to 75 years and shall be designated with the following marking, “50X1-HUM;” or (ii) If an original classification authority is classifying information that should clearly and demonstrably be expected to reveal key design concepts of weapons of mass destruction, the duration shall be up to 75 years and shall be designated with the following marking, “50X2-WMD.” (b) Extending duration of classification for information classified under the Order. Extensions of classification are not automatic. If an original classification authority with jurisdiction over the information does not extend the classification of information assigned a date or event for declassification, the information is automatically declassified upon the occurrence of the date or event. (1) If the date or event assigned by the original classification authority has not passed, an original classification authority with jurisdiction over the information may extend the classification duration of such information for a period not to exceed 25 years from the date of origin of the record. (2) If the date or event assigned by the original classification authority has passed, an original classification authority with jurisdiction over the information may reclassify the information in accordance with the Order and this Directive only if it meets the standards for classification under sections 1.1 and 1.5 of the Order as well as section 3.3 of the Order, if appropriate. (3) In all cases, when extending the duration of classification, the original classification authority must: (i) Be an original classification authority with jurisdiction over the information; (ii) Ensure that the information continues to meet the standards for classification under the Order; and (iii) Make reasonable attempts to notify all known holders of the information. (c) Duration of information classified under prior orders—(1) Specific date or event. Unless declassified earlier, information marked with a specific date or event for declassification under a prior order is automatically declassified upon that date or event. If the specific date or event has not passed, an original classification authority with jurisdiction over the information may extend the duration in accordance with the requirements of paragraph (b) of this section. If the date or event assigned by the original classification authority has passed, an original classification authority with jurisdiction over the information may only reclassify information in accordance with the standards and procedures under the Order and this Directive. If the information is contained in records determined to be permanently valuable, and the prescribed date or event will take place more than 25 years from the date of origin of the document, the declassification of the information will instead be subject to section 3.3 of the Order. (2) Indefinite duration of classification. For information marked with X1, X2, X3, X4, X5, X6, X7, or X8; “Originating Agency's Determination Required” or its acronym “OADR,” “Manual Review” or its acronym “MR;” “DCI Only;” “DNI Only;” and any other marking indicating an indefinite duration of classification under a prior order; or in those cases where a document is missing a required declassification instruction or the instruction is not complete: (i) A declassification authority, as defined in section 3.1(b) of the Order, may declassify it; (ii) An original classification authority with jurisdiction over the information may re-mark the information to establish a duration of classification of no more than 25 years from the date of origin of the document, consistent with the requirements for information originally classified under the Order, as provided in paragraph (a) of this section; or (iii) Unless declassified earlier, such information contained in records determined to be permanently valuable shall remain classified for 25 years from the date of its origin, at which time it will be subject to section 3.3 of the Order. (3) Release of imagery acquired by space-based intelligence reconnaissance systems. The duration of classification of imagery as defined in E.O. 12951, Release of Imagery Acquired by Space-Based Intelligence Reconnaissance Systems, that is otherwise marked with an indefinite duration, such as “DCI Only” or “DNI Only,” shall be established by the Director of National Intelligence in accordance with E.O. 12951 and consistent with E.O. 13526. Any such information shall be remarked in accordance with instructions prescribed by the Director of National Intelligence.

32 C.F.R. § 2001.13 Classification prohibitions and limitations.

(a) Declassification without proper authority. Classified information that has been declassified without proper authority, as determined by an original classification authority with jurisdiction over the information, remains classified and administrative action shall be taken to restore markings and controls, as appropriate. All such determinations shall be reported to the senior agency official who shall promptly provide a written report to the Director of ISOO. (1) If the information at issue is in records in the physical and legal custody of the National Archives and Records Administration (NARA) and has been made available to the public, the original classification authority with jurisdiction over the information shall, as part of determining whether the restoration of markings and controls is appropriate, consider whether the removal of the information from public purview will significantly mitigate the harm to national security or otherwise draw undue attention to the information at issue. Written notification, classified when appropriate under the Order, shall be made to the Archivist, which shall include a description of the record(s) at issue, the elements of information that are classified, the duration of classification, and the specific authority for continued classification. If the information at issue is more than 25 years of age and the Archivist does not agree with the decision, the information shall nonetheless be temporarily withdrawn from public access and shall be referred to the Director of ISOO for resolution in collaboration with affected parties. (b) Reclassification after declassification and release to the public under proper authority. In making the decision to reclassify information that has been declassified and released to the public under proper authority, the agency head must approve, in writing, a determination on a document-by-document basis that the reclassification is required to prevent significant and demonstrable damage to the national security. As part of making such a determination, the following shall apply: (1) The information must be reasonably recoverable without bringing undue attention to the information which means that: (i) Most individual recipients or holders are known and can be contacted and all instances of the information to be reclassified will not be more widely disseminated; (ii) If the information has been made available to the public via a means such as Government archives or reading room, consideration is given to length of time the record has been available to the public, the extent to which the record has been accessed for research, and the extent to which the record and/or classified information at issue has been copied, referenced, or publicized; and (iii) If the information has been made available to the public via electronic means such as the internet, consideration is given as to the number of times the information was accessed, the form of access, and whether the information at issue has been copied, referenced, or publicized. (2) If the reclassification concerns a record in the physical custody of NARA and has been available for public use, reclassification requires notification to the Archivist and approval by the Director of ISOO. (3) Any recipients or holders of the reclassified information who have current security clearances shall be appropriately briefed about their continuing legal obligations and responsibilities to protect this information from unauthorized disclosure. The recipients or holders who do not have security clearances shall, to the extent practicable, be appropriately briefed about the reclassification of the information that they have had access to, their obligation not to disclose the information, and be requested to sign an acknowledgement of this briefing. (4) The reclassified information must be appropriately marked in accordance with section 2001.24(l) and safeguarded. The markings should include the authority for and the date of the reclassification action. (5) Once the reclassification action has occurred, it must be reported to the National Security Advisor and to the Director of ISOO by the agency head or senior agency official within 30 days. The notification must include details concerning paragraphs (b)(1) and (3) of this section. (c) Classification by compilation. A determination that information is classified through the compilation of unclassified information is a derivative classification action based upon existing original classification guidance. If the compilation of unclassified information reveals a new aspect of information that meets the criteria for classification, it shall be referred to an original classification authority with jurisdiction over the information to make an original classification decision.

32 C.F.R. § 2001.14 Classification challenges.

(a) Challenging classification. Authorized holders, including authorized holders outside the classifying agency, who want to challenge the classification status of information shall present such challenges to an original classification authority with jurisdiction over the information. An authorized holder is any individual who has been granted access to specific classified information in accordance with the provisions of the Order to include the special conditions set forth in section 4.1(h) of the Order. A formal challenge under this provision must be in writing, but need not be any more specific than to question why information is or is not classified, or is classified at a certain level. (b) Agency procedures. (1) Because the Order encourages authorized holders to challenge classification as a means for promoting proper and thoughtful classification actions, agencies shall ensure that no retribution is taken against any authorized holders bringing such a challenge in good faith. (2) Agencies shall establish a system for processing, tracking and recording formal classification challenges made by authorized holders. Agencies shall consider classification challenges separately from Freedom of Information Act or other access requests, and shall not process such challenges in turn with pending access requests. (3) The agency shall provide an initial written response to a challenge within 60 days. If the agency is unable to respond to the challenge within 60 days, the agency must acknowledge the challenge in writing, and provide a date by which the agency will respond. The acknowledgment must include a statement that if no agency response is received within 120 days, the challenger has the right to forward the challenge to the Interagency Security Classification Appeals Panel (Panel) for a decision. The challenger may also forward the challenge to the Panel if an agency has not responded to an internal appeal within 90 days of the agency's receipt of the appeal. Agency responses to those challenges it denies shall include the challenger's appeal rights to the Panel. (4) Whenever an agency receives a classification challenge to information that has been the subject of a challenge within the past two years, or that is the subject of pending litigation, the agency is not required to process the challenge beyond informing the challenger of this fact and of the challenger's appeal rights, if any. (c) Additional considerations. (1) Challengers and agencies shall attempt to keep all challenges, appeals and responses unclassified. However, classified information contained in a challenge, an agency response, or an appeal shall be handled and protected in accordance with the Order and this Directive. Information being challenged for classification shall remain classified unless and until a final decision is made to declassify it. (2) The classification challenge provision is not intended to prevent an authorized holder from informally questioning the classification status of particular information. Such informal inquiries should be encouraged as a means of holding down the number of formal challenges and to ensure the integrity of the classification process.

32 C.F.R. § 2001.15 Classification guides.

(a) Preparation of classification guides. Originators of classification guides are encouraged to consult users of guides for input when developing or updating guides. When possible, originators of classification guides are encouraged to communicate within their agencies and with other agencies that are developing guidelines for similar activities to ensure the consistency and uniformity of classification decisions. Each agency shall maintain a list of its classification guides in use. (b) General content of classification guides. Classification guides shall, at a minimum: (1) Identify the subject matter of the classification guide; (2) Identify the original classification authority by name and position, or personal identifier; (3) Identify an agency point-of-contact or points-of-contact for questions regarding the classification guide; (4) Provide the date of issuance or last review; (5) State precisely the elements of information to be protected; (6) State which classification level applies to each element of information, and, when useful, specify the elements of information that are unclassified; (7) State, when applicable, special handling caveats; (8) State a concise reason for classification which, at a minimum, cites the applicable classification category or categories in section 1.4 of the Order; and (9) Prescribe a specific date or event for declassification, the marking “50X1-HUM” or “50X2-WMD” as appropriate, or one or more of the exemption codes listed in 2001.26(a)(2), provided that: (i) The exemption has been approved by the Panel under section 3.3(j) of the Order; (ii) The Panel is notified of the intent to take such actions for specific information in advance of approval and the information remains in active use; and (iii) The exemption code is accompanied with a declassification date or event that has been approved by the Panel. (c) Dissemination of classification guides. Classification guides shall be disseminated as necessary to ensure the proper and uniform derivative classification of information. (d) Reviewing and updating classification guides. (1) Agencies shall incorporate original classification decisions into classification guides as soon as practicable. (2) Originators of classification guides are encouraged to consult the users of guides and other subject matter experts when reviewing or updating guides. Also, users of classification guides are encouraged to notify the originator of the guide when they acquire information that suggests the need for change in the instructions contained in the guide.

32 C.F.R. § 2001.16 Fundamental classification guidance review.

(a) Performance of fundamental classification guidance reviews. An initial fundamental classification guidance review shall be completed by every agency with original classification authority and which authors security classification guides no later than June 27, 2012. Agencies shall conduct fundamental classification guidance reviews on a periodic basis thereafter. The frequency of the reviews shall be determined by each agency considering factors such as the number of classification guides and the volume and type of information they cover. However, a review shall be conducted at least once every five years. (b) Coverage of reviews. At a minimum, the fundamental classification guidance review shall focus on: (1) Evaluation of content. (i) Determining if the guidance conforms to current operational and technical circumstances; and (ii) Determining if the guidance meets the standards for classification under section 1.4 of the Order and an assessment of likely damage under section 1.2 of the Order; and (2) Evaluation of use: (i) Determining if the dissemination and availability of the guidance is appropriate, timely, and effective; and (ii) An examination of recent classification decisions that focuses on ensuring that classification decisions reflect the intent of the guidance as to what is classified, the appropriate level, the duration, and associated markings. (c) Participation in reviews. The agency head or senior agency official shall direct the conduct of a fundamental classification guidance review and shall ensure the appropriate agency subject matter experts participate to obtain the broadest possible range of perspectives. To the extent practicable, input should also be obtained from external subject matter experts and external users of the reviewing agency's classification guidance and decisions. (d) Reports on results. Agency heads shall provide a detailed report summarizing the results of each classification guidance review to ISOO and release an unclassified version to the public except when the existence of the guide or program is itself classified.

Starting a business? Corpus forms LLCs in all 50 states and DC.