An Employee Has the Proper Clearance and Expertise to Perform a Derivative Classification Task but They Missed Their Mandatory Annual Training: What Is the Status of This Employee?

That employee is not authorized to perform derivative classification at the moment the annual training lapses, regardless of clearance level or subject-matter expertise. Under the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117, and the security training requirements that flow from Executive Order 13526, derivative classification authority hinges on three things standing together: clearance eligibility, the required training, and a signed SF 312 Nondisclosure Agreement. The training requirement is annual and non-waivable under normal circumstances, so a missed cycle suspends derivative classification authority until the training is completed and documented. Clearance and expertise alone do not carry the employee past that gate.

What Governing Rules Set Derivative Classification Training Requirements

The controlling documents are Executive Order 13526, its implementing directive (32 CFR Part 2001, issued by the Information Security Oversight Office), and for cleared contractors, NISPOM at 32 CFR Part 117. These establish that derivative classifiers must receive training before being authorized to classify and then annually thereafter. The ISOO directive specifies that the agency or contractor must maintain records of the training and that derivative classification authority is tied to current, documented training status.

NISPOM Section 117.13 addresses derivative classification and requires contractors to establish a training program for derivative classifiers. The training must cover classification marking, the proper application of classification guides, and the sanctions for improper classification. The manual also requires annual refresher training. An employee who has not completed the annual refresher within the required 12-month cycle is out of compliance with the program requirement.

The Cleared Contractor's classification guide authorization is another floor. Even a cleared employee with an engineering degree and 20 years of experience cannot derive classified markings from a classification guide unless the contractor's derivative classification program has trained and documented that employee. Expertise is a soft qualification; the training record is the hard one.

Sanctions reinforce this. E.O. 13526 and the ISOO directive both describe administrative, civil, and potentially criminal consequences for improper classification, including negligent derivative classification. An untrained employee making derivative markings is exposed to those sanctions because the training record is the first thing an inspector reviews when a misclassification is found.

Whether Clearance Alone Authorizes Derivative Classification Work

Clearance is a necessary condition, not a sufficient one. A Top Secret clearance gives an employee eligibility to access classified information at that level, but it does not grant authority to create new classified markings. That authority is separately conferred through the derivative classification training program and, for original classifiers, through an explicit delegation in writing from the agency or contractor.

Think of it as three keys. The clearance unlocks the door to the classified space. The signed SF 312 unlocks the obligation to protect what's inside. The training record is the only key that unlocks the pen. Remove any one key and the employee cannot legally make a derivative classification decision, even if the other two remain valid.

NISPOM's personnel security section requires the SF 312 to be executed before access, and the derivative classification program requirements sit in a separate section. Inspectors from the Defense Counterintelligence and Security Agency (DCSA) review training rosters and SF 312s as separate line items during a security vulnerability assessment. An employee whose training lapsed shows up as a finding even if the SF 312 and clearance remain active.

The practical translation is blunt. The employee's clearance status is "active." The employee's derivative classification authority status is "suspended pending training." Those are different columns in the security office's tracking system, and only the second column controls whether the employee can sign off on a new classified document.

What Actually Happens to the Employee's Status When Training Lapses

The employee's status becomes "not authorized to perform derivative classification" the day the annual training expires. In most contractor programs, the training record has an expiration date stamped 12 months after completion. If the employee does not complete the refresher by that date, the security office should update the tracking system to reflect lapsed authority. Some programs build a 30-day grace window into their internal schedule, but the underlying requirement is annual, so a grace period is an administrative convenience, not a legal extension.

The employee does not necessarily lose access to classified information on day one. Access and derivative classification authority are distinct. However, several contractor programs temporarily restrict access to classified material pending training completion as a precaution, because working with classified material without current training raises the risk of mishandling. The specific posture depends on the contractor's insider threat program and the facility security officer's judgment.

If the employee performs a derivative classification task after the lapse, the resulting markings may be improper. That creates a classification discrepancy that must be reported under NISPOM's self-inspection and reporting requirements. Reporting is mandatory for certain categories of improper classification, and repeat occurrences can trigger DCSA involvement or contract-level corrective action.

The employee is not typically terminated for a single missed training cycle. The common outcome is a documented counseling, a training completion within a short window, and a note in the security file. Termination appears when the lapse is repeated, when the employee concealed it and continued classifying, or when the missed training is part of a broader pattern of noncompliance.

Step-by-Step: Restoring Derivative Classification Authority After a Missed Cycle

The restoration path is administrative and usually takes under a week if the training is available on demand. The facility security officer or contractor program security officer owns the sequence.

1: Confirm the lapse in the training tracking system and note the exact expiration date so the finding is documented accurately. 2: Suspend the employee's derivative classification authority in the tracking system and notify the employee and their supervisor in writing. 3: If the contractor program requires it, temporarily restrict access to classified material until training is complete. 4: Enroll the employee in the next available derivative classification refresher, which for many contractors is delivered through the Defense Acquisition University or an internal equivalent. 5: Verify completion by obtaining the certificate or training record and filing it in the employee's security file. 6: Reinstate derivative classification authority in the tracking system with the new completion date and a 12-month expiration. 7: If any improper markings were created during the lapse, initiate a classification review and report through the contractor's reporting channel.

Failure handling matters more than the happy path. If the employee cannot complete training within the window set by the FSO, the FSO should escalate to the contractor's security leadership and consider whether the employee's classified work must be reassigned. If a misclassification is discovered during the lapse period, the contractor must follow NISPOM reporting requirements and coordinate with the contracting agency's security office before closing the finding.

Comparing Three Remediation Paths for a Lapsed Derivative Classifier

Contractors typically choose among three remediation paths, and the right one depends on the size of the lapse, the employee's role, and whether any incorrect markings were produced.

The standard path is the default and is almost always appropriate for a single 12-month miss with no downstream effect. The counseling path adds a documented warning and is common when DCSA or the contracting agency has flagged the employee's file. The suspension path is reserved for cases where the employee's untrained work product actually entered a classified document distribution.

The cost asymmetry is real. A standard refresher costs the contractor the equivalent of a few hours of the employee's time. A suspension path can consume weeks of an employee's availability on a classified contract, which for a cleared engineer billing at a loaded rate can represent tens of thousands of dollars in unrecoverable cost. The cheap path is almost always cheaper, and the reason lapses happen is usually scheduling neglect, not employee intent.

A caution on the table above: the timelines reflect typical contractor practice, not a fixed DCSA standard. Contractors should confirm actual timelines in their own security program documentation. The underlying training requirement itself — annual — is fixed by the governing directive.

Which Records Prove Training Status During a DCSA Review

The training certificate alone is not sufficient. DCSA security vulnerability assessments look for a training record that ties the certificate to the specific employee, the date of completion, the training content, and the employee's position requiring derivative classification authority. A certificate with no name, or a course completion email with no syllabus reference, is weak evidence and often results in a finding.

The stronger evidence set includes the training completion record in the contractor's learning management system, the employee's signed acknowledgment of the derivative classification responsibilities, the current SF 312, and the security office's tracking entry showing current authority. Inspectors want to see these four elements aligned. If one element is missing or expired, the finding is written even if the others are current.

Contractors who use DAU's derivative classification course should keep the certificate and the corresponding registration record. DAU certificates show the course title, the date, and the learner's name, but the contractor's own tracking record is what proves the employee's authority was current on any given date. A training certificate without the corresponding authority entry in the tracking system is treated as an unclosed loop.

For audits that reach back multiple years, the contractor should retain the prior training records for at least the period covered by the contract, which is typically six years under FAR record retention requirements. Gaps in the historical record are treated as gaps in compliance, even when current training is up to date.

Where the Common "Train Now, Fix Later" Assumption Breaks Down

The "we'll catch it at the next cycle" approach fails when the lapse occurs during a period when the employee is creating marked documents. If the employee produces derivative markings between the lapse date and the remediation date, those markings are technically improper regardless of whether the information was correctly classified. The error is procedural, and procedural errors can trigger reporting.

A second failure mode appears when the employee's lapse crosses a contract transition. If the employee is transferred to a new contract during the lapse period, the new contract's security office inherits the finding, and the transfer may be delayed or the employee's role adjusted. Contract transitions are exactly when security offices compare records, so the lapse surfaces.

A third failure appears when the lapse coincides with a program security review. Contractors sometimes discover a lapse only when DCSA asks for training records. By that point, the employee may have gone months without current authority while continuing to perform derivative classification. The fix is still the same, but the finding is more serious because the contractor's own tracking failed.

The reliable countermeasure is automated expiration tracking with a 60-day advance alert. When the alert fires, the employee's supervisor and the security office both receive it. Contractors who use calendar-based manual tracking are the ones who end up writing the findings above. The employee is rarely the root cause; the tracking system usually is.

How "Expertise" Interacts With Training in Practice

Subject-matter expertise is genuinely valuable in derivative classification, but it does not substitute for training. The reason is that training is not primarily about technical content. It is about the marking rules, the classification guide application, the handling of compilation and aggregation, and the reporting obligations when something goes wrong. An employee can be the world's leading expert on a system and still format a classified marking incorrectly.

The ISOO directive treats training as the mechanism that ensures the derivative classifier applies classification guides consistently across the workforce. An untrained expert introduces inconsistency, and inconsistency is the enemy of a defensible classification program. Inspectors cannot audit expertise, but they can audit a certificate.

There is a narrow exception worth naming. Some agencies have specific policies for senior officials and original classifiers that include separate training requirements, and some allow on-the-job qualification programs with extended training intervals under agency-specific approval. These are exceptions, not defaults, and they apply through written agency policy, not through an informal judgment that the employee's expertise suffices. Contractors should not assume any exception applies without a documented approval in the security file.

Contractors sometimes try to argue that a highly experienced employee should be allowed to work during a lapse because the risk of misclassification is low. That argument does not survive audit. The finding is written the same way whether the employee has 2 years or 20 years of experience.

How Long the Lapse Can Last Before It Escalates

A lapse under 30 days is typically handled through the standard refresher path with documented counseling only if the contractor's program requires it. Lapses between 30 and 90 days commonly attract a formal counseling entry and a supervisor notification. Lapses over 90 days are usually treated as a program-level finding, especially if the employee continued to perform derivative classification during the lapse.

These bands are consistent with common contractor practice but are not fixed by directive. Contractors should set their own thresholds in documented program guidance and follow them. The directive sets the annual requirement, but the escalation ladder is an internal management tool.

If the lapse reaches a full training cycle, which is to say the employee misses the annual refresher and then misses the following one, the contractor may need to treat it as an access determination issue rather than a training issue. At that point, the employee's continued access to classified material without current derivative classification training becomes a broader program question for the FSO and contracting agency.

The most useful single number here is the day the training expires. Contractors who record and monitor that date, rather than the date of completion, catch every lapse before it becomes a finding. The completion date tells you what happened; the expiration date tells you what's coming.

FAQ

Can an employee with an active Top Secret clearance still classify documents if their annual training lapsed last month?

No. An active clearance is one of the required conditions, not the only one. The annual derivative classification training is a separate requirement under NISPOM and the ISOO implementing directive, and a lapse suspends derivative classification authority even with an active TS. The employee may still have access to classified material in a read-only capacity, depending on the contractor's policy.

Does the employee need to be removed from the classified workspace while the training is being completed?

Not automatically, but many contractors restrict access to classified material during the lapse as a precaution. The directive ties access and derivative classification authority to distinct requirements, so removal is a contractor policy decision rather than a mandated step. The FSO should document the decision either way.

What happens if the employee created classified markings during the lapse period?

The markings are treated as improper regardless of whether the underlying classification was correct. The contractor must initiate a classification review and report through the required channel under NISPOM. The employee's training remediation should proceed in parallel, but the reporting obligation is separate and cannot be waived by completing training.

Is there any grace period on the annual training requirement?

No legal grace period exists in the governing directive. Many contractors build a 30-day administrative window into their internal schedules to complete overdue training before formal action, but that window does not extend derivative classification authority. Employees should not rely on internal grace periods for compliance.

How much does a typical derivative classification lapse cost a cleared contractor?

A standard refresher and reinstatement costs a few hours of employee time and no external course fee where the contractor uses DAU-hosted training. A suspension path that removes a cleared engineer from a classified contract for 15-30 business days can cost tens of thousands of dollars in unrecoverable loaded labor. The cost asymmetry strongly favors early tracking.

Can a contractor's security officer simply waive the training for an experienced employee?

No waiver is available under the standard directive for a cleared contractor employee. Waivers require written agency policy and documented approval in the security file. Verbal or informal waivers are not recognized during DCSA assessments and will produce a finding.

Does the annual training requirement differ for government employees and contractor employees?

The underlying requirement is annual for both, but the specific training content and delivery mechanism differ. Government employees typically receive training through their agency's security office, while contractor employees often use DAU courses or contractor-hosted equivalents. Both must keep documented completion records that align with the derivative classification authority entry.

This article is general educational information about federal security training and derivative classification requirements, not a legal opinion or a substitute for guidance from your facility security officer, contracting agency, or qualified counsel. Specific requirements vary by agency and contract, so confirm your program's rules with your security office and the governing agency. If you face immediate security-related risk or a suspected mishandling incident, contact your facility security officer and the appropriate agency security office right away.