by National Archives and Records Administration

“ Except in extraordinary circumstances, each agency shall ensure that each employee who is granted access to classified information and who leaves the service of the agency receives a termination briefing. ”

“ Each department or agency shall establish and maintain a formal security education and training program which provides for initial training, refresher training, specialized training, and termination briefings. This subpart establishes fundamental security education and training standards for original classification authorities, derivative classifiers, declassification authorities, security managers, classification management officers, security specialists, and all other personnel whose duties significantly involve the creation or handling of classified information. ”

“ Annual refresher training should reinforce the policies, principles and procedures covered in initial and specialized training. Annual refresher training should also address identification and handling of other agency-originated information and foreign government information, as well as the threat and the techniques employed by foreign intelligence activities attempting to obtain classified information, and advise personnel of penalties for engaging in espionage activities. Annual refresher training should also address issues or concerns identified during agency self-inspections. ”

“ When a document is classified derivatively either from a source document (s) or a classification guide that contains one of the following declassification instructions, ``Originating Agency's Determination Required, ́ ́ ``OADR, ́ ́ or ``Manual Review, ́ ́ ``MR, ́ ́ or any of the exemption markings X1, X2, X3, X4, X5, X6, X7, and X8, the derivative classifier shall calculate a date that is 25 years from the date of the source document when determining a derivative document's date or event to be placed in the ``Declassify On ́ ́ line. ”

“ Equity refers to information: (1) Originally classified by or under the control of an agency; (2) In the possession of the receiving agency in the event of transfer of function; or (3) In the possession of a successor agency for an agency that has ceased to exist. (h) Exempted means nomenclature and markings indicating information has been determined to fall within an enumerated exemption from automatic declassification under the Order. (i) Facility means an activity of an agency authorized by appropriate authority to conduct classified operations or to perform classified work. ”

“ Risk management principles means the principles applied for assessing threats and vulnerabilities and implementing security countermeasures while maximizing the sharing of information to achieve an acceptable level of risk at an acceptable cost. (s) Security-in-depth means a determination by the agency head that a facility's security program consists of layered and complementary security controls sufficient to deter and detect unauthorized entry and movement within the facility. ”

“ An agency head or senior agency official must consult with the Director of ISOO on any decision to delay automatic declassification of newly discovered records no later than 90 days, from the discovery of the records. The notification shall identify the records, their volume, the anticipated date for declassification, and the circumstances of the discovery. An agency may be granted up to three years from the date of discovery to make a declassification, exemption, or referral determination. ”

“ Except as provided in this paragraph, agencies shall process mandatory declassification review requests for classified records containing foreign government information in accordance with this section. The declassifying agency is the agency that initially received or classified the information. When foreign government information is being considered for declassification, the declassifying agency shall determine whether the information is subject to a treaty or international agreement that does not permit automatic or unilateral declassification. ”

“ Agency heads shall establish appropriate procedures to conduct an inquiry/ investigation of a loss, possible compromise or unauthorized disclosure of classified information, in order to implement appropriate corrective actions, which may include disciplinary sanctions, and to ascertain the degree of damage to national security. ”

“ A working paper is defined as documents or materials, regardless of the media, which are expected to be revised prior to the preparation of a finished product for dissemination or retention. Working papers containing classified information shall be dated when created, marked with the highest classification of any information contained in them, protected at that level, and if otherwise appropriate, destroyed when no longer needed. ”

“ Users developing a document based on query results from a database must properly mark the document in accordance with Sec. 2001.22. If there is doubt about the correct markings, users should contact the database originating agency for guidance. (f) Marking classified bulletin board postings and blogs. (1) A blog, an abbreviation of the term ``web log, ́ ́ is a Web site consisting of a series of entries, often commentary, description of events, or other material such as graphics or video, created by the same individual as in a journal or by many individuals. ”

“ A dynamic page contains electronic information derived from a changeable source or ad hoc query, such as a relational database. The classification levels of information returned may vary depending upon the specific request. (2) If there is a mechanism for determining the actual classification markings for dynamic documents, the appropriate classification markings shall be applied to and displayed on the document. If such a mechanism does not exist, the default should be the highest level of information in the database and a warning shall be applied at the top of each page of the document. ”

“ Agency heads or any designee may prescribe special provisions for the dissemination, transmission, safeguarding, and destruction of classified information during certain emergency situations. (b) In emergency situations, in which there is an imminent threat to life or in defense of the homeland, agency heads or designees may authorize the disclosure of classified information to an individual or individuals who are otherwise not routinely eligible for access under the following conditions: (1) Limit the amount of classified information disclosed to the absolute minimum to achieve the purpose ”

“ Reproduction shall be accomplished by authorized persons knowledgeable of the procedures for classified reproduction; (2) Unless restricted by the originating agency, Top Secret, Secret, and Confidential information may be reproduced to the extent required by operational needs, or to facilitate review for declassification ”

“ The SF 701 provides a systematic means to make a thorough end-of-day security inspection for a particular work area and to allow for employee accountability in the event that irregularities are discovered. If an agency determines, as part of its risk management strategy, that an activity security checklist is required, the SF 701 will be used. Completion, storage, and disposition of SF 701 will be in accordance with each agency's security regulations. ”

“ Whenever an agency receives a classification challenge to information that has been the subject of a challenge within the past two years, or that is the subject of pending litigation, the agency is not required to process the challenge beyond informing the challenger of this fact and of the challenger's appeal rights, if any. ”

“ When adequate to achieve equivalency, these standards may be less restrictive than the safeguarding standards that ordinarily apply to U.S. Confidential information. If the foreign protection requirement is lower than the protection required for U.S. Confidential information, the following requirements shall be met: (1) Documents may retain their original foreign markings if the responsible agency determines that these markings are adequate to meet the purposes served by U.S. classification markings. ”

“ For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation. (2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA- approved container having a built-in combination lock or in a non-GSA- approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. ”

“ Administrative control measures which may include records of internal distribution, access, generation, inventory, reproduction, and disposition of classified information shall be required when technical, physical and personnel control measures are insufficient to deter and detect access by unauthorized persons. ”

“ When alternative measures are used for other than temporary, unique situations, the alternative measures shall be documented and provided to the Director of ISOO. Upon request, the description shall be provided to any other agency with which classified information or secure facilities are shared. In all cases, the alternative measures shall provide protection sufficient to reasonably deter and detect loss or unauthorized disclosure. Risk management factors considered will include sensitivity, value, and crucial nature of the information ”

“ Authorized persons who have access to classified information are responsible for: (a) Protecting it from persons without authorized access to that information, to include securing it in approved equipment or facilities whenever it is not under the direct control of an authorized person; (b) Meeting safeguarding requirements prescribed by the agency head ”

“ Federal record includes all books, papers, maps, photographs, machine-readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of data in them. ”

“ Employee means a person, other than the President and Vice President, employed by, detailed or assigned to, an agency, including members of the Armed Forces; an expert or consultant to an agency; an industrial or commercial contractor, licensee, certificate holder, or grantee of an agency, including all subcontractors; a personal services contractor; or any other category of person who acts for or on behalf of an agency as determined by the appropriate agency head. ”

“ The use of technology that prevents, discourages, or detects the unauthorized reproduction of classified information is encouraged. (c) Forms. The use of standard forms prescribed in Subpart H of this part is mandatory for all agencies that create and/or handle national security information. (d) Redaction-- (1) Policies and procedures. Classified information may be subject to loss, compromise, or unauthorized disclosure if it is not correctly redacted. Agencies shall establish policies and procedures for the redaction of classified information from documents intended for release. ”

“ Whenever a combination has been subject to possible unauthorized disclosure. (2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10- 20-30 for combination padlocks. (d) Key operated locks. When special circumstances exist, an agency head may approve the use of key operated locks for the storage of Secret and Confidential information. ”

“ When users modify existing entries which alter the classification level of the content or add new content, they shall change the required markings to reflect the classification markings for the resulting information. Systems shall provide a means to log the identity of each user, the changes made, and the time and date of each change. ”

“ When forwarding or replying to an e-mail, individuals shall ensure that, in addition to the markings required for the content of the reply or forward e-mail itself, the markings shall reflect the overall classification and declassification instructions for the entire string of e-mails and attachments. ”

“ Examples include, but are not limited to, use of perimeter fences, employee and visitor access controls, use of an Intrusion Detection System (IDS) , random guard patrols throughout the facility during nonworking hours, closed circuit video monitoring or other safeguards that mitigate the vulnerability of open storage areas without alarms and security storage cabinets during nonworking hours. (t) Supplemental controls means prescribed procedures or systems that provide security control measures designed to augment the physical protection of classified information. ”