When a derivative classifier marks a new document, the classified by line must identify the classifier by name or personal identifier, the derivative classification authority under which the mark is made, the source or guide used, and the date of classification. For controlled unclassified information, the line also carries the CUI category and limited dissemination controls. For classified national security information, it carries the classification level, caveats, and declassification instructions. The line is the accountability record: it names who derived the marking, from what authority, and when.
What "derivative classification" actually means
Derivative classification is the act of incorporating, paraphrasing, restating, or generating information already marked as classified so the new material carries the same classification. It is distinct from original classification, where an official with original classification authority decides for the first time that information needs protection. A derivative classifier does not decide the level. The classifier applies an existing determination to new content.
The classified by line exists because derivative classification is delegated, distributed work. Hundreds of people across an agency may derive markings from a single original classification decision. Without a line recording who did it and under what authority, no one can trace a leaked or misclassified document back to its source marking.
The mechanism matters: each derivatively marked document is a downstream copy of an upstream decision. The line is the chain-of-custody tag. Remove it and the document cannot be audited, corrected, or declassified on schedule.
What the classified by line must contain
Federal rules split the required content by regime. For classified national security information under Executive Order 13526, section 2.1(d), derivatively marked documents must show the derivative classifier's name and position, or a personal identifier, plus the agency and office of origin. This is commonly rendered on a "Classified by:" line with the name and position, and a "Derived from:" line pointing to the source document, classification guide, or original classification decision.
For controlled unclassified information under 32 CFR Part 2002, the marking framework requires a CUI designation indicator with three parts: the CUI category or subcategory, the limited dissemination controls, and the agency designation indicator, which names the agency and the point of contact. The point of contact is the office that can answer questions about the marking, which functions as the "classified by" trace for CUI.
The practical checklist for a derivative classifier marking new material:
Classifier identity: name and position, or a personal identifier, not just a job title. Source authority: the source document date and classification, a classification guide with the applicable paragraph, or the original classification decision. Classification level being applied: Confidential, Secret, or Top Secret, with caveats and dissemination controls. Declassification instructions: a date or event, a duration, or a code, unless the source explicitly exempts categories from automatic declassification. CUI designation indicator, where CUI applies: category, dissemination controls, and agency point of contact. Date of the derivative classification action, which anchors the declassification clock.
Red flags that a classified by line is defective:
A missing office or agency, so the classifier cannot be located for a challenge. "Derived from" points to a document with no date, making the source unverifiable. Declassification date absent without an exemption code. A name without position, so accountability cannot be established after personnel changes. CUI category listed without the dissemination control. Classification level inconsistent with the cited source.
Quantified context: how much content the line governs
Scale explains why the line is not bureaucratic decoration. The U.S. classification system produces enormous derivative-marking volume relative to original decisions. Original classification authorities are a small, formally designated group; derivative classifiers are far more numerous. The Information Security Oversight Office's annual reports to the President have documented tens of millions of derivative classification decisions per year across executive branch agencies, against original classification decisions numbering in the low thousands. That ratio, roughly thousands of derivative actions per original decision, means the classified by line is the dominant accountability mechanism in the system.
That ratio has a direct consequence: a single error in an original classification guide propagates into every document derived from it. The line is what makes recall and correction possible. Agencies can locate all derivatives by source when a guide is amended.
CUI volume is larger still, because CUI covers categories far broader than national defense, spanning privacy, law enforcement, critical infrastructure, and export-controlled technical data. The line's design intent is the same at every scale: one accountable party, one authority, one date.
Timeline: how the line's obligations run
| Stage | What happens | Line implication |
|---|---|---|
| Original decision | OCA classifies source or issues a guide | Authority created; guide paragraph identified |
| Derivative marking | Classifier applies the source to new content | Name, position, office, source, date recorded |
| Document issuance | Marking reviewed or spot-checked | Line visible on face of document |
| Challenge or audit | Agency questions the marking | Line identifies who to contact and what to check |
| Source amendment | Guide or source changes | Derivatives located by source and corrected |
| Declassification date | Scheduled review point | Date on line triggers review |
| Transfer to archives | Permanent records reviewed | Line supports declassification decisions |
The declassification clock is the reason the date field is mandatory in most cases. The line's date and duration drive when the document becomes eligible for release, so an incomplete date field effectively stops the clock.
Edge cases and the professional caveat
The counterintuitive detail: the classifier's name on the line is not a statement that the classifier personally decided the information is classified. It certifies that the classifier correctly applied an existing determination. If the underlying source is wrong, the derivative classifier is generally not the party who made the error, but the line still points to them for the correction trail.
Edge cases complicate the line. Documents derived from multiple sources must cite each source's authority, which can produce a long "Derived from" entry. Compilation documents, where unrelated classified items are assembled, may carry multiple classification lines per portion. Portion marking is the mechanism for mixed documents: each paragraph or section is marked, and the overall document adopts the highest level. When portions derive from different guides, the classified by line must reconcile them.
Foreign government information and information under international agreements carry separate rules, often prohibiting disclosure of the source. In those cases the line may cite an agreement rather than a specific document. Atomic energy information under the Atomic Energy Act follows a separate statutory regime with its own marking rules, so a derivative classifier must apply the correct regime's line before applying the national security format.
CUI offers a real alternative: the designation indicator replaces the national-security classified by line, but only when the information is not classified. Mixing the two frameworks on one document is a common error and creates an unverifiable mark.
Common misconceptions
Misconception one: the classified by line states the classifier's opinion. It does not. It records the authority applied.
Misconception two: a job title alone suffices. Rules require name plus position or a personal identifier; a title does not identify an individual accountable party.
Misconception three: the line is the same for CUI and classified information. The two regimes have different required fields. Applying an EO 13526 style line to CUI, or the reverse, creates a defective mark.
Misconception four: the date is optional. It anchors the declassification review and is a required field in the national security framework unless a specific exemption applies.
Misconception five: the line can be added after review. The marking must be applied at the time of derivative classification, on the face of the document, not reconstructed later.
Practical actions for the classifier
Before applying the line, identify the exact authority: a source document with its date and classification, a classification guide with the paragraph number, or the original decision. Record the source precisely enough that another person could verify it without asking you.
Apply the fields in order: identity with position, agency and office, source with date, classification level with caveats, declassification instructions, and date of action. Where CUI applies, substitute the designation indicator and include the category, dissemination controls, and agency point of contact.
Run a self-check: could an auditor reach the cited authority without contacting you? If not, the line is incomplete. Consult the agency's derivative classification guide when the source is ambiguous; do not improvise the level. If two sources conflict on classification level, apply the higher level and document both sources on the line, then escalate to the classification office.
Threshold: any document where the "Derived from" entry cannot be traced to a dated, identified authority within one review cycle should be treated as unverified and corrected before issuance.
Limits of this guidance
This article describes the structure of marking requirements, not agency-specific procedures, which vary and are updated periodically. The controlling documents are the current executive order, its implementing directive, and the CUI federal regulation; agencies issue their own guidance that may add fields. Where a document involves the Atomic Energy Act, foreign government information, or an international agreement, the applicable regime overrides the general format.
Nothing here authorizes a derivative classifier to apply a level not supported by a cited authority. Verification against the current governing directive and the agency classification guide is required in every case.