Who Bears the Principal Responsibility for the Quality and Accuracy of a Derivative Classification Action: The Original Classification Authority

The original classification authority (OCA) bears principal responsibility for the quality and accuracy of a derivative classification action. That holds even though a different person — the derivative classifier — physically applies the markings. Under Executive Order 13526 and its implementing directive, 32 CFR Part 2001, the OCA owns the underlying determination, and derivative classifiers inherit accountability only for applying it faithfully. The boundary matters: get it wrong and you either blame the wrong desk or miss the real failure point.

How Executive Order 13526 Assigns the Duty Up the Chain

The responsibility chain starts with the OCA, and the regulation is explicit about it. Section 1.7 of E.O. 13526 requires that classification be carried out by trained personnel and limits original classification to officials with the authority to do so. Section 2.1 then defines derivative classification as the act of incorporating, paraphrasing, restating, or generating material already classified. The distinction is load-bearing: derivative classifiers don't create the classification decision, they reproduce one.

32 CFR 2001.21, the Information Security Oversight Office's implementing directive, adds the quality requirement. It states that original classification authorities are responsible for ensuring classified information is accurately and properly classified, and that derivative classifiers must apply the markings consistently with the source. The regulation names two roles and assigns the heavier burden to the one that generated the determination.

Here's the part most summaries skip. The directive also requires that classified information be reviewed for continued classification, and that review obligation sits with the OCA or the agency that owns the information — not with whoever copied it into a briefing slide. If a derivative document inherits a bad classification, the inherited error traces back to the source.

Practically, that means an OCA who marks a document SECRET//NOFORN without a supportable rationale has created a defect that could propagate through dozens of derivative products. The derivative classifier who copies that marking is following the rule. The OCA who wrote it broke it. That asymmetry is the whole answer in one sentence.

Where the Derivative Classifier's Accountability Actually Stops

The derivative classifier isn't off the hook, and anyone who claims otherwise has read half the regulation. Under 32 CFR 2001.22, derivative classifiers must be trained, must have access to the source documents, and must apply the classification markings, duration, and declassification instructions from the source. They carry responsibility for the accuracy of the transfer.

That transfer duty is narrower than it sounds and wider than people assume. A derivative classifier who misreads a portion marking, drops a caveat like NOFORN, or assigns a declassification date that contradicts the source has committed a derivative classification error. That's their failure. But a derivative classifier who accurately copies a marking that was wrong at the source has not created the underlying defect.

The training requirements reinforce the split. E.O. 13526 Section 1.3 and 32 CFR 2001.71 require derivative classifier training before anyone performs the function, with refresher training annually. That training teaches how to read and apply source markings — not how to independently re-adjudicate whether the information should have been classified. The curriculum tells you where the line sits.

There's a real failure case worth knowing. Inspectors general and the Information Security Oversight Office have repeatedly found derivative documents carrying classification levels higher than their sources, a practice sometimes called "over-classification by derivation." The classifier who inflated the marking owns that error. The OCA who set an ambiguous source marking shares it. Investigators routinely split findings this way rather than assigning blame to a single desk.

The Four-Part Breakdown of Responsibility Across a Classification Chain

Responsibility isn't binary. In practice it splits across four roles, and knowing which one failed tells you how to fix the problem. The table below is the comparison most guidance documents don't build.

The top row carries the most weight, and the regulation says so. OCAs are appointed in writing, are limited in number, and must have a demonstrable need to classify at the level they hold — 32 CFR 2001.11 spells out those conditions. The appointment process exists precisely because the role carries final responsibility.

Look at the third row for a moment. Supervisory review is where most real-world errors get caught before they escape, and it's also where most agencies under-resource. A marked product that passes a reviewer who doesn't check caveats against the source is a derivative error that the reviewer failed to stop, even though the OCA still owns the underlying determination.

The bottom row matters for systemic questions. If an agency's derivative classifiers are untrained or its OCAs are classifying without written justification, ISOO's oversight findings land with the Senior Agency Official. That's a program failure, not an individual error, and it's the level at which policy fixes usually get made.

A Worked Example: Tracing a Marking Error Back to Its Source

Walk through a realistic scenario and the accountability split becomes concrete. An intelligence analyst derives a briefing slide from a source document marked SECRET//NOFORN. The analyst copies SECRET but drops the NOFORN caveat, and the slide gets shared with a coalition partner. That's a spill.

Who's responsible? The analyst, first — the transfer duty required reproducing the caveat, and 32 CFR 2001.22 makes the derivative classifier responsible for accurate application. The reviewing supervisor second, if the product went through review and the caveat gap was missed. The OCA's exposure depends on whether the source marking itself was clear and properly documented.

Now change one fact. Suppose the source document's portion marking was ambiguous — say the NOFORN appeared in a header but not on the specific paragraph the analyst excerpted. Now the OCA shares more of the blame, because 32 CFR 2001.23 requires portion marking that is clear and consistent. The analyst still made an error, but the ambiguity in the source created the conditions for it.

That distinction shows up in real investigations. When the Department of Defense IG examines classification spills, findings typically separate the individual marking error from any source-document deficiency, and remediation follows each finding separately. Training fixes the individual error. Correcting the source marking fixes the systemic one.

Time matters too. Classified information must be reviewed for declassification at the interval specified in the marking, and derivative documents must carry that instruction forward — 32 CFR 2001.25 covers duration and declassification instructions. A derivative document that drops the declassification date becomes a document that may never get reviewed. That's still a transfer error, but its consequence is a permanent oversight gap.

Why "The Person Who Pushed the Button" Is the Wrong Answer

The most common misconception I encounter is that the person who actually applied the markings is fully responsible. It's intuitive — they touched the document — and it's wrong under the governing framework. The derivative classifier's role is mechanical by design: read the source, reproduce the marking.

The reason is structural. Derivative classifiers are, by regulation, not authorized to make original classification determinations. They cannot decide that a paragraph does or doesn't warrant SECRET. If they were fully responsible for accuracy of the underlying judgment, the framework would be asking untrained personnel to second-guess OCAs — the opposite of how E.O. 13526 structures authority.

The confusion often comes from whistleblower and spill-investigation contexts, where the individual who mishandled material is the visible actor. Investigators do name that person in findings. But naming someone in a finding isn't the same as assigning principal responsibility for the classification action itself, and the two get conflated in hallway retellings.

Here's a cleaner way to hold the distinction. A derivative classifier is accountable for what they can control: reading the source, applying all markings, checking caveats, and flagging inconsistencies to a supervisor. An OCA is accountable for what only they can control: whether the information warranted classification in the first place and whether the marking accurately expresses that judgment. Overlap exists at the margins, and the margins are where most disputes live.

What the Interagency Security Classification Appeals Panel and ISOO Oversight Reveal

The oversight machinery tells you where the framework actually places weight. The Interagency Security Classification Appeals Panel (ISCAP), established under E.O. 13526 Section 5.3, hears appeals from requesters challenging classification decisions and from classifiers challenging agency determinations. Its caseload skews toward original classification decisions, because those are the decisions with appealable stakes.

ISOO's annual reports to the President track classification activity, including the number of original classification decisions and derivative classification decisions. The ratio is instructive: original decisions number in the tens of thousands annually, while derivative decisions run into the millions. That volume explains why the framework pushes quality control upstream — inspecting millions of derivative actions individually is impossible, so the regulation invests responsibility at the point where the determination originates.

ISOO oversight inspections, described in 32 CFR 2001.70, examine agency programs against the directive's requirements. When inspectors find systemic deficiencies, findings cite the agency program and its senior official. When they find individual document errors, findings cite the classification action. Both appear in the same report, but the remediation paths differ — and that difference is the framework telling you which level owns which problem.

For anyone building an internal training program, the ISOO findings are the best free curriculum. The recurring themes — missing portion markings, unsupported original determinations, lapsed derivative training — map directly onto the four-part responsibility table above. Agencies that fix those three tend to stop appearing in the findings.

How the Rule Shifts for Legacy Documents and Declassification Review

The standard answer assumes a live document with a living OCA. Legacy documents change the picture, and this edge case is where the framework gets tested hardest. When a document was classified decades ago and its original classifier is long retired, who bears responsibility for accuracy?

The answer is the agency, acting through the OCA function rather than a specific individual. E.O. 13526 Section 3.3 requires that classified information be reviewed for declassification, and agencies must conduct systematic review under 32 CFR 2001.30. The reviewing agency official effectively inherits the OCA's responsibility for accuracy during the review — if the original determination can't be justified, the reviewer declassifies.

Derivative classifiers working with legacy documents carry a specific and often overlooked duty. Under 32 CFR 2001.22, when a source document lacks clear markings or its classification basis can't be determined, the derivative classifier must consult the OCA or the agency's classification guide rather than guessing. Guessing is the failure mode. A derivative classifier who applies a marking based on vibes has committed an error the regulation specifically warns against.

Automatic declassification under Section 3.3 adds a timing dimension. Documents more than 25 years old are subject to automatic declassification unless exempted, and derivative documents must carry forward the correct declassification instruction. A derivative product that drops a 25-year instruction becomes a document that escapes the automatic review entirely. That's a small marking omission with a large consequence.

Common Misapplications That Trigger Findings and How to Prevent Them

Most derivative classification failures fall into a handful of patterns, and each maps to a prevention step. Knowing the patterns is more useful than memorizing the regulation, because the patterns are what inspectors look for.

1: Dropped portion markings. The classifier applies an overall marking but leaves individual paragraphs unmarked. Fix: implement a two-person review where the second reviewer checks every paragraph against the source. 2: Caveat omission. NOFORN, FOUO (legacy), or other dissemination controls get lost in the transfer. Fix: build caveats into the template so they can't be omitted. 3: Lost declassification instruction. The date or event drops off, and the document never gets reviewed. Fix: require the declassification line as a mandatory field before any product clears review. 4: Unauthorized classification level inflation. The classifier applies a higher level "to be safe." Fix: require source citation for every marking and treat unsupported elevation as an error. 5: Derivative classification without current training. The classifier's annual refresher lapsed. Fix: gate system access on training currency.

The failure-handling close for each: when an error is found after release, the agency's security office conducts a spill assessment under 32 CFR 2001.60, determines whether the error caused a compromise, and documents corrective action. Repeat errors by the same desk trigger retraining. Repeat errors across a program trigger an inspection.

The pattern worth flagging: several of these failures trace back to ambiguous source markings. When the OCA's original document is unclear, derivative errors spike. That's why the framework keeps pointing responsibility upstream.

Frequently Asked Questions

Does the derivative classifier ever bear full responsibility? Yes, in a defined category of cases: when the source is clear and the classifier still misapplies it. A classifier who drops a clearly stated caveat owns 100% of that error. The OCA's responsibility exists in parallel, not as a shield. Investigations assign the transfer error to the classifier and the underlying determination to the OCA, and both findings stand.

What happens if the original classification authority is unavailable? The agency's designated successor or the classification guide governs. Under 32 CFR 2001.22, derivative classifiers consult the agency classification guide when source documents are unclear. A guide isn't a substitute for the OCA's judgment on a novel question, but for routine derivations it carries the same authority. Document the guide reference in the product's classification record.

Is a derivative classification action a legal act with individual liability? It can carry administrative consequences — findings, retraining, loss of access — and, in extreme cases involving knowing mishandling, legal exposure under espionage and related statutes. Routine accuracy errors are administrative matters handled through the agency security program. Consult the agency's general counsel for questions about individual liability in specific cases.

How long does a derivative classification last? It lasts as long as the source document's classification instruction specifies, carried forward exactly. If the source says declassify in 10 years, the derivative says 10 years. There's no independent duration for a derivative product. The error to avoid is dropping the instruction, which makes the product effectively permanent.

What's the difference between derivative classification and declassification review? Derivative classification reproduces an existing determination; declassification review re-examines it. The reviewer performing declassification review acts with the authority of the OCA function and can change or remove the classification. A derivative classifier cannot. Mixing the two roles in one person's duties is a structural risk worth managing separately.

Who investigates a disputed derivative classification action? The agency's inspector general or security office handles document-level errors; ISOO handles program-level oversight and can refer matters to the agency head. ISCAP hears appeals of classification decisions themselves. The investigating body depends on whether the dispute is about a document, a program, or a determination.

Does an OCA's error absolve the derivative classifier who copied it? No, but it changes the finding. A classifier who faithfully reproduced a flawed source marking is found to have made no transfer error; the finding lands on the OCA. A classifier who noticed the flaw and copied it anyway has a harder position, because the regulation requires flagging inconsistencies. The duty to flag is the classifier's, not the OCA's.

This article is general educational information about classification policy, not a legal opinion or a substitute for agency-specific guidance. Classification rules, training requirements, and investigative procedures vary by agency and jurisdiction, and some classified-program matters carry individual legal exposure. Consult your agency's classification management office or a qualified attorney for advice on a specific document or dispute. If you encounter classified material outside a secure environment, contact your local security office immediately rather than handling it yourself.