You find that listing in a derivative classification guide, often called a classification guide or security classification guide (SCG). It is the authoritative source document that names each information element, states why each is classified, and specifies its downgrading and declassification instructions. Derivative classifiers must use it rather than making independent classification judgments.
Derivative classification is the act of incorporating, paraphrasing, restating, or generating information already classified by an original classification authority (OCA). The derivative classifier does not decide that something is secret. The original classifier already made that decision, and the guide is where that decision is documented element by element. This article explains what the guide contains, how it works inside an agency's classification system, where the traps are, and what a practitioner should do at the desk.
The mechanism: how a classification guide encodes original decisions
An OCA makes an original classification decision and records it in a guide. Each entry in the guide typically contains four things: a description of the information element, the level of classification, the reason for classification, and the declassification or downgrading instruction. The reason is usually expressed as a reference to one or more categories of classified information, and in US practice those categories are defined in Executive Order 13526, as amended, and its predecessor orders. The declassification instruction is either a specific date, an event, or an exemption code that carries a later review date.
The derivative classifier reads the source document, identifies which guide entries apply, and then marks the derivative product consistently with those entries. The classifier also adds a "classified by" block naming the source document, the guide, and the declassification date. That block is the audit trail. If the derivative product later needs review, the reviewer can trace every marking back to a guide entry and then back to the original classifier who authorized it.
The deeper point is that the guide converts a judgment into an instruction. An original classifier exercises discretion once. Everyone downstream applies that discretion as a rule. This is why guides must be written precisely and why derivative classifiers cannot "improve" on them. If a guide entry says a vulnerability assessment is confidential with a ten-year declassification date, the derivative product carries confidential and ten years, even if the analyst believes the material is harmless.
Quantified context: timeframes, review cycles, and volume
Classification guides are not permanent. Under the current US executive order framework, classified information is subject to declassification after 25 years unless a specific exemption applies, and guides must reflect that. Most guides carry a review requirement, commonly every five years, so that original classifiers confirm or revise their decisions. A guide that has gone unreviewed past its cycle is a red flag, because the underlying judgments may no longer be valid.
The practical scale is large. A single agency may maintain dozens of guides covering different program areas, and a large defense program can have a guide with hundreds of individual entries. The derivative classifier works at the level of a paragraph, deciding for each sentence whether an entry applies. A document of 40 pages may involve dozens of element-level decisions, and a misapplied entry on page 31 creates a spillage that must be reported and remediated.
The declassification side has its own numbers. Declassification dates can run from a few years to 25 years, and exemptions can extend review out to 50 years, 75 years, or beyond for especially sensitive categories such as certain intelligence sources and weapons design information. The guide does not simply say "secret." It says secret until a date, and that date is the operative instruction.
Where the listing lives in practice
The guide itself is normally a controlled, classified or unclassified document held by the originating agency's classification management office and distributed to the activities that need it. The listing is inside the guide, usually organized by topic with a tabular structure. A typical entry looks like this: element description, level, reason, downgrade instruction, declassification instruction, and the OCA's authority. Some agencies publish their guidance in electronic systems that auto-apply the markings, and some use paper guides with manual marking.
That structure matters because the question asks where to find the listing. The answer is not a single public database. There is no universal public listing of every element and its instructions, because the guides themselves are often classified. What exists publicly is the framework, principally Executive Order 13526 and its implementing directives, which define the categories and the marking obligations. The element-level listing is agency-specific and access-controlled.
Edge cases and the professional caveat
The counterintuitive detail is that a derivative classifier can be held accountable for a marking the guide did not clearly require. If the guide is ambiguous and the classifier resolves the ambiguity in the direction of less protection, the classifier bears the risk. The guide's silence is not permission. When an information element is not addressed, the correct move is to consult the classification management office before marking, not to guess.
Several edge cases recur:
Multiple source documents with conflicting instructions: the most restrictive applicable instruction governs until the classification office reconciles the conflict. Guide entries that describe an element in general terms that do not quite match the paragraph in hand. Declassification dates expressed as events rather than dates, which require the classifier to determine when the event occurred. Foreign government information, which carries its own marking rules and may not follow the US guide at all. Compilation effects, where individually unclassified items become classified when aggregated.
Red-flag warnings for practitioners:
Do not mark a derivative product from memory of the guide. Do not carry forward a marking from an old document without checking the current guide. Do not treat an expired guide as still authoritative. Do not assume that an unmarked source document is unclassified.
Comparison: guide types and their roles
| Source type | What it lists | Who issues it | Typical use |
|---|---|---|---|
| Security classification guide (SCG) | Element-level level, reason, downgrade, declassification | Original classification authority | Primary source for derivative marking |
| Executive order framework | Categories of classifiable information and marking rules | President, with implementing directives | Legal basis the guide must follow |
| Agency marking handbook | Procedures and formats | Agency classification management office | How to apply markings correctly |
| Source document markings | The marking actually applied to a source | Original or prior derivative classifier | Clue, not authority, for derivative work |
| Declassification database | Records already reviewed and released | Agency declassification office | Historical research, not current marking |
| Automated marking system | Rules encoded from guides | Agency IT and classification office | Consistency at scale, still needs human check |
The table shows the hierarchy. The guide is the operative authority for element-level decisions. Everything else either frames the guide (the executive order), implements the guide's format (the handbook), or reflects a past application of the guide (source markings and databases).
Timeline: how a classification decision becomes a marking
| Stage | What happens | Who acts |
|---|---|---|
| Original decision | OCA determines information is classifiable | Original classification authority |
| Guide entry drafted | Element, level, reason, downgrade, declassification recorded | OCA with classification office |
| Guide approved and distributed | Controlled release to needing activities | Classification management office |
| Guide review cycle | Entries confirmed or revised, commonly every five years | OCA and classification office |
| Derivative classification | Classifier applies guide entries to a new product | Derivative classifier |
| Marking and audit block | Classified-by block names source and declassification date | Derivative classifier |
| Declassification review | Information reviewed at date or event | Declassification office |
| Release or extension | Information declassified or exemption applied | Declassification authority |
The timeline clarifies a frequent confusion. The declassification date on a derivative product is not invented by the derivative classifier. It is copied from the guide entry that authorized the marking.
Practical actions at the desk
The workflow is repeatable, and following it reduces both spillage and over-classification. First, obtain the current version of the applicable guide and confirm its review date is within cycle. Second, read the source document and build a list of candidate elements before marking anything. Third, match each candidate to a guide entry and record the entry identifier. Fourth, apply the level and the declassification instruction exactly as written, and complete the classified-by block. Fifth, route ambiguous or unaddressed elements to the classification management office rather than resolving them alone.
Thresholds worth remembering: the 25-year declassification default, the common five-year guide review cycle, and the requirement that every derivative product carry a traceable classified-by block. If a product has no traceable block, it is not properly marked regardless of how accurate the level appears.
One plain-language way to hold the whole system in mind: the original classifier writes the rulebook, the guide is the rulebook, and the derivative classifier is the person applying the rulebook page by page.
Misconceptions and limitations
A common misconception is that the derivative classifier is making a classification decision. The classifier is applying someone else's decision, which is why the guide, not personal judgment, controls. A second misconception is that publicly available frameworks such as the executive order are the listing. They define categories and rules but do not enumerate an agency's specific elements. A third is that a source document's markings are authoritative for a new derivative product. They are evidence of a prior application and may be outdated or wrong.
The limitations are real. Guides can lag behind program changes. Event-based declassification instructions can be hard to apply when the triggering event is not documented. Compilation effects are poorly captured by element-level entries. And access controls mean that a practitioner may need to request the guide through the classification management office rather than finding it on a shared drive. None of these limitations removes the obligation to consult the governing guide before marking.
The reliable answer to the original question is therefore specific: the listing of information elements, their classification reasons, and their downgrading and declassification instructions lives in the derivative classification guide issued by the original classification authority, and the classifier's job is to apply it exactly and traceably.
This article is general educational information about classification practice, not a legal opinion or an authoritative marking determination for any specific document. Classification rules vary by agency and jurisdiction, and the controlling guide and your local classification management office govern any actual marking decision. Consult a qualified classification or security professional before marking or releasing material.