[Code of Federal Regulations]

[Title 32, Volume 6]

[Revised as of July 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 32CFR2001.61]



[Page 491-493]

 

                        TITLE 32-NATIONAL DEFENSE

 

CHAPTER XX--INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND 

                         RECORDS ADMINISTRATION

 

PART 2001_CLASSIFIED NATIONAL SECURITY INFORMATION--Table of Contents

 

                       Subpart E_Self-Inspections

 

Sec.  2001.61  Coverage [5.4(d)(4)].



    (a) General. These standards are not all-inclusive. Each agency may 

expand upon the coverage according to program and policy needs. Each 

self-inspection of an agency activity need not include all the elements 

covered in this section. Agencies without original classification 

authority need not include in their self-inspections those elements of 

coverage pertaining to original classification.

    (b) Elements of coverage. (1) Original classification. (i) Evaluate 

original classification authority's general understanding of the process 

of original classification, including the:

    (A) Applicable standards for classification;

    (B) Levels of classification and the damage criteria associated with 

each; and

    (C) Required classification markings.

    (ii) Determine if delegations of original classification authority 

conform with the requirements of the Order, including whether:

    (A) Delegations are limited to the minimum required to administer 

the program;

    (B) Designated original classification authorities have a 

demonstrable and continuing need to exercise this authority;

    (C) Delegations are in writing and identify the official by name or 

position title; and

    (D) New requests for delegation of classification authority are 

justified.

    (iii) Assess original classification authority's familiarity with 

the duration of classification requirements, including:

    (A) Assigning a specific date or event for declassification that is 

less than 10 years when possible;

    (B) Establishing ordinarily a 10 year duration of classification 

when an earlier date or event cannot be determined; and



[[Page 492]]



    (C) Limiting extensions of classification for specific information 

not to exceed 25 years for permanently valuable records or providing a 

25 year exemption.

    (iv) Conduct a review of a sample of classified information 

generated by the inspected activity to determine the propriety of 

classification and the application of proper and full markings.

    (v) Evaluate classifiers' actions to comply with the standards 

specified in Sec.  2001.15 and Sec.  2001.32 of this part, relating to 

classification and declassification guides, respectively.

    (vi) Verify observance with the prohibitions on classification and 

limitations on reclassification.

    (vii)Assess whether the agency's classification challenges program 

meets the requirements of the Order and this part.

    (2) Derivative classification. Assess the general familiarity of 

individuals who classify derivatively with the:

    (i) Conditions for derivative classification;

    (ii) Requirement to consult with the originator of the information 

when questions concerning classification arise;

    (iii) Proper use of classification guides; and

    (iv) Proper and complete application of classification markings to 

derivatively classified documents.

    (3) Declassification.

    (i) Verify whether the agency has established, to the extent 

practical, a system of records management to facilitate public release 

of declassified documents.

    (ii) Evaluate the status of the agency declassification program, 

including the requirement to:

    (A) Comply with the automatic declassification provisions regarding 

historically valuable records over 25 years old;

    (B) Declassify, when possible, historically valuable records prior 

to accession into the National Archives;

    (C) Provide the Archivist with adequate and current declassification 

guides;

    (D) Ascertain that the agency's mandatory review program conforms to 

established requirements; and

    (E) Determine whether responsible agency officials are cooperating 

with the ISOO Director to coordinate the linkage and effective 

utilization of existing agency databases of records that have been 

declassified and publicly released.

    (4) Safeguarding.

    (i) Monitor agency adherence to established safeguarding standards.

    (ii) 5.4(c) of the Order--Verify whether the agency has established 

to the extent practical a records system designed and maintained to 

optimize the safeguarding of classified information.

    (iii) Assess compliance with controls for access to classified 

information.

    (iv) Evaluate the effectiveness of the agency's program in detecting 

and processing security violations and preventing recurrences.

    (v) Assess compliance with the procedures for identifying, reporting 

and processing unauthorized disclosures of classified information.

    (vi) Evaluate the effectiveness of procedures to ensure that:

    (A) The originating agency exercises control over the classified 

information it generates;

    (B) Holders of classified information do not disclose information 

originated by another agency without that agency's authorization; and

    (C) Departing or transferred officials return all classified 

information in their possession to authorized agency personnel.

    (5) Security education and training. Evaluate the effectiveness of 

the agency's security education and training program in familiarizing 

appropriate personnel with classification procedures; and determine 

whether the program meets the standards specified in subpart F of this 

part.

    (6) Management and oversight.

    (i) Determine whether original classifiers have received prescribed 

training.

    (ii) Verify whether the agency's special access programs:

    (A) Adhere to specified criteria in the creation of these programs;

    (B) Are kept to a minimum;

    (C) Provide for the conduct of internal oversight; and



[[Page 493]]



    (D) Include an annual review of each program to determine whether it 

continues to meet the requirements of the Order.

    (iii) Assess whether:

    (A) Senior management demonstrates commitment to the success of the 

program, including providing the necessary resources for effective 

implementation;

    (B) Producers and users of classified information receive guidance 

with respect to security responsibilities and requirements;

    (C) Controls to prevent unauthorized access to classified 

information are effective;

    (D) Contingency plans are in place for safeguarding classified 

information used in or near hostile areas;

    (E) The performance contract or other system used to rate civilian 

or military personnel includes the management of classified information 

as a critical element or item to be evaluated in the rating of: Original 

classifiers; security managers; classification management officers; and 

security specialists; and other employees whose duties significantly 

involve the creation or handling of classified information; and

    (F) A method is in place for collecting information on the costs 

associated with the implementation of the Order.