Learn How Derivative Classifiers Should Identify Themselves

Posted on

Many cleared defense contractors provide non-technical services, and others conduct derivative classification. Derivative classification, in general terms, includes paraphrasing, incorporating, restating or regenerating classified information into a new form. Since contractors are not performing original classification, most of their work would involve using classified sources to create new classified products.

Here’s the important part, no training; no work. Properly executed National Industrial Security Program Operating Manual (NISPOM) training and documentation is the difference between performing on classified work and not being able to meet contractual requirements. Cleared contractors must train employees to properly address derivative classification responsibilities.

The NISPOM outlines requirements for derivative classification training. Where the original classification authority receives training on the classification decisions annually, NISPOM requires derivative classification training once every two years. According to the NISPOM, derivative classifiers train… in the proper application of the derivative classification principles, with an emphasis on avoiding over-classification, at least once every 2 years. According to the Defense Security Services (DSS), contractors must train their cleared employees by December 31, 2013. Those without this training are not authorized to do the work.

One such training task ensures that the authorized employees apply proper markings to their products. Not only are classification markings required, but so is documenting who is actually performing the derivative classification. According to NISPOM paragraph 4-102, authorized cleared employees who make derivative classification decisions are responsible for identifying themselves on the documents where they make those decisions. Identification instills discipline, control and accountability of derivative classification decisions. Remember, the enterprise trains and designates authorized cleared employees as derivative classifiers.

Proper identification occurs when authorized derivative classifiers apply their names and titles on the derived items. However, contractors can substitute using their names with some type of personal identifier that cross references an authorized name. The use of the personal identifier is usually allowed unless the government customer states otherwise. Trained and authorized derivative classifiers, facility security officers and staff can read the requirements from the Statement of Work, DD Form 254, or other security and contracts documentation. When in doubt, they can seek clarification and raise personal identifier requirements through program channels.

When a contractor uses the alternative identifier, the organization should develop a designator that aligns with a person’s name and function. If the government customer or anyone authorized to view the classified information has any questions, the list easily identifies the creator. The contractor maintains this list for at least the as long as the cleared employee is with the business organization.

The contractor should consult the NISPOM for all training requirements and put a plan in place to develop and deliver the derivative classification training. After conducting the training, the contractor should document the event and include the training topic and the by name attendance list. The DSS will inspect training compliance during their inspection cycle.