Classification Authority

Go up to Terms and Definitions

A Classification Authority is a person, role, organization, or governing body authorized to assign, approve, modify, downgrade, declassify, or otherwise govern a Security Classification.

The authority derives its power from an identified legal, regulatory, contractual, organizational, or policy source.

A Classification Authority can be responsible for:

• Establishing classification guidance
• Assigning a Security Classification
• Approving derivative classification rules
• Identifying classification markings
• Defining classification duration
• Defining downgrading conditions
• Defining declassification conditions
• Defining compartments
• Defining handling caveats
• Defining dissemination restrictions
• Resolving classification conflicts
• Reviewing classification decisions
• Authorizing corrections to classification records
• Identifying the authority responsible for each classification decision

A Classification Authority can govern the classification of:

• Information
• Documents
• Data
• Messages
• Artifacts
• Machine Images
• Infrastructure Baselines
• Configuration records
• Deployment records
• Evidence
• Metadata
• Aggregated information

A Classification Authority can also define or approve the Information Handling Rules associated with a Security Classification.

The Classification Authority does not necessarily administer the system, Security Domain, or Infrastructure Environment containing the classified information. Operational administration and classification authority represent distinct responsibilities.

Within the Crucible architecture, classification records can identify:

• The Security Classification
• The Classification Authority
• The source of the authority
• The classification decision date
• The classification rationale
• The classification duration
• The required markings
• The Information Handling Rules
• The downgrading or declassification conditions
• The associated Provenance
• The associated Traceability

person, role, organization, or governing body authorized to assign or govern a Security Classification

• Executive Order 13526, Classified National Security Information
• 32 CFR Part 2001, Classified National Security Information
• Dido Solutions, Crucible architecture and requirements terminology

A Classification Authority differs from an authorization authority responsible for approving an information system or environment for operation.

• A Classification Authority governs classification decisions
• A system authorization authority accepts or rejects operational risk for a system or environment

The same person or organization can perform both roles only when the governing authority explicitly assigns both responsibilities.

An Original Classification Authority can make an original determination that information requires classification.

A Derivative Classifier applies existing classification guidance to new information or materials. A Derivative Classifier does not independently create a new classification basis.

For non-classified controlled information, a governing authority can perform an analogous designation role without becoming a Classification Authority for classified information.

A Classification Authority determines that an Infrastructure Baseline contains information classified as Secret.

The classification record identifies:

• Secret as the Security Classification
• The Classification Authority
• The classification guidance
• The classified portions of the Infrastructure Baseline
• The required markings
• The permitted Security Domains
• The Information Handling Rules
• The review and declassification conditions