Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:c:classification_authority [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1
+++ public:99_annexes:annex-b-terms-and-definitions:c:classification_authority [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
+====== Classification Authority ======
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+===== Discussion =====
+A Classification Authority is a person, role, organization, or governing body authorized to assign, approve, modify, downgrade, declassify, or otherwise govern a [[public:99_annexes:annex-b-terms-and-definitions:s:security_classification|Security Classification]].
+The authority derives its power from an identified legal, regulatory, contractual, organizational, or policy source.
+A Classification Authority can be responsible for:
+  * Establishing classification guidance
+  * Assigning a Security Classification
+  * Approving derivative classification rules
+  * Identifying classification markings
+  * Defining classification duration
+  * Defining downgrading conditions
+  * Defining declassification conditions
+  * Defining compartments
+  * Defining handling caveats
+  * Defining dissemination restrictions
+  * Resolving classification conflicts
+  * Reviewing classification decisions
+  * Authorizing corrections to classification records
+  * Identifying the authority responsible for each classification decision
+A Classification Authority can govern the classification of:
+  * Information
+  * Documents
+  * Data
+  * Messages
+  * Artifacts
+  * Machine Images
+  * Infrastructure Baselines
+  * Configuration records
+  * Deployment records
+  * Evidence
+  * Metadata
+  * Aggregated information
+A Classification Authority can also define or approve the [[public:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]] associated with a Security Classification.
+The Classification Authority does not necessarily administer the system, Security Domain, or Infrastructure Environment containing the classified information. Operational administration and classification authority represent distinct responsibilities.
+Within the Crucible architecture, classification records can identify:
+  * The Security Classification
+  * The Classification Authority
+  * The source of the authority
+  * The classification decision date
+  * The classification rationale
+  * The classification duration
+  * The required markings
+  * The Information Handling Rules
+  * The downgrading or declassification conditions
+  * The associated Provenance
+  * The associated Traceability
+===== Definition =====
+//person, role, organization, or governing body authorized to assign or govern a Security Classification//
+===== Source =====
+  * [[https://www.archives.gov/isoo/policy-documents/cnsi-eo.html|Executive Order 13526, Classified National Security Information]]
+  * [[https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2001|32 CFR Part 2001, Classified National Security Information]]
+  * Dido Solutions, Crucible architecture and requirements terminology
+===== Note =====
+A Classification Authority differs from an authorization authority responsible for approving an information system or environment for operation.
+  * A Classification Authority governs classification decisions
+  * A system authorization authority accepts or rejects operational risk for a system or environment
+The same person or organization can perform both roles only when the governing authority explicitly assigns both responsibilities.
+An Original Classification Authority can make an original determination that information requires classification.
+A Derivative Classifier applies existing classification guidance to new information or materials. A Derivative Classifier does not independently create a new classification basis.
+For non-classified controlled information, a governing authority can perform an analogous designation role without becoming a Classification Authority for classified information.
+===== Example =====
+A Classification Authority determines that an Infrastructure Baseline contains information classified as Secret.
+The classification record identifies:
+  * Secret as the Security Classification
+  * The Classification Authority
+  * The classification guidance
+  * The classified portions of the Infrastructure Baseline
+  * The required markings
+  * The permitted Security Domains
+  * The Information Handling Rules
+  * The review and declassification conditions
+----
+<WRAP centeralign>
+© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
+</WRAP>