Executive Order 12958, Classified National Security Information, as amended, specifies three incremental levels of classification— Confidential, Secret, and Top Secret—to safeguard information pertaining to the following: military plans, weapons systems, or operations; foreign government information; intelligence activities (including special activities), intelligence sources/methods, cryptology; foreign relations/activities of the United States, including confidential sources; scientific, technological, or economic matters relating to national security, which includes defense against transnational terrorism; United States government programs for safeguarding nuclear materials vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security, which includes defense against transnational terrorism; or weapons of mass destruction. The requisite level of protection is determined by assessing the damage to national security that could be expected if the information were compromised (see table 1). Executive Order 12958, as amended, prohibits classifying information so as to conceal violations of law, inefficiency, or administrative error; prevent embarrassment to a person, organization, or agency; restrain competition; or prevent or delay the release of information, which does not require protection in the interest of national security. Classification decisions can be either original or derivative. Original classification is the initial determination that information requires protection against unauthorized disclosure in the interest of national security. An original classification decision typically results in the creation of a security classification guide, which is used by derivative classifiers and identifies what information should be protected, at what level, and for how long. Derivative classification is the incorporation, paraphrasing, or generation of information in new form that is already classified, and marking it accordingly. In 2004, 1,059 senior-level officials in DOD were designated original classification authorities, and as such, they were the only individuals permitted to classify information in the first instance. But any of the more than 1.8 million DOD personnel who possess security clearances potentially have the authority to classify derivatively. According to DOD, less than 1 percent of the estimated 63.8 million classification decisions the department made during fiscal years 2000 through 2004 were original; however, ultimately, original classification decisions are the basis for 100 percent of derivative classification decisions. Executive Order 12958, as amended, assigns ISOO the responsibility for overseeing agencies’ compliance with the provisions of the Executive Order. In this capacity, ISOO (1) performs on-site inspections of agency information security operations, (2) conducts document reviews, (3) monitors security education and training programs, and (4) reports at least annually to the President on the degree to which federal agencies are complying with the Executive Order. ISOO also issued Classified National Security Information Directive No. 1 to implement the Executive Order. The Executive Order and the ISOO directive stipulate a number of specific responsibilities expected of federal agencies, including DOD. Examples of responsibilities are promulgating internal regulations; establishing and maintaining security education and self-inspection programs; conducting periodic declassification reviews; and committing sufficient resources to facilitate effective information security operations. The Executive Order and the ISOO directive also require classifiers to apply standard markings to classified information. For example, originally classified records must include the overall classification as well as portion or paragraph marking, a “Classified by” line to identify the original classifier, a reason for classification, and a “Declassify on” date line. Executive Order 12958, as amended, states that information shall be declassified when it no longer meets the standards for classification. The point at which information generally becomes declassified is set when the decision is made to classify, and it is either linked to the occurrence of an event, such as the completion of a mission, or to the passage of time. Classified records that are more than 25 years old and have permanent historical value are automatically declassified unless an exemption is granted because their contents could cause adverse national security repercussions. The Defense Security Service Academy is responsible for providing security training, education, and awareness to DOD components, DOD contractors, and employees of other federal agencies and selected foreign governments. The academy’s 2005 course catalog includes more than 40 courses in general security and in specific disciplines of information, information systems, personnel, and industrial security, and special access program security. These courses are free for DOD employees and are delivered by subject matter experts at the academy’s facilities in Linthicum, Maryland, and at student sites worldwide via mobile training teams. Some courses are available through video teleconferencing and the Internet. In fiscal year 2004, more than 16,000 students completed academy courses, continuing an upward trend over the past 4 years. According to ISOO, DOD is one of the most prolific classifiers (original and derivative combined) among federal government agencies. From fiscal year 2000 to fiscal year 2004, DOD and the Central Intelligence Agency had individual classification activity that were each more than all other federal agencies combined. In 3 of these 5 years, DOD’s classification activity was higher than that of the Central Intelligence Agency’s (see figure 1). During these same 5 years, DOD declassified more information than any other federal agency, and it was responsible for more than three-quarters of all declassification activity in the federal government. A lack of oversight and inconsistent implementation of DOD’s information security program are increasing the risk of misclassification. DOD’s information security program is decentralized to the DOD component level, and OUSD(I) involvement in, and oversight of, components’ information security programs is limited. Also, while some DOD components and subordinate commands appear to manage their programs effectively, we identified weaknesses in others’ training, self-inspections, and security classification guide management. As a result, we found that many of the organizations we reviewed do not fully satisfy federal and DOD classification management requirements, which contributes to an increased risk of misclassification. Specifically, most of the components and subordinate commands we examined did not establish procedures to ensure that personnel authorized to and actually performing classification actions are adequately trained to do so, did not conduct rigorous self- inspections, and did not take required actions to ensure that derivative classification decisions are based on current, readily available documentation. According to the ISOO Director, adequate training, self- inspections, and documentation are essential elements of a robust information security program and their absence can impede effective information sharing and possibly endanger national security. As required by Executive Order 12958, OUSD(I) issued a regulation in January 1997, Information Security Program, outlining DOD’s information security program. This regulation does not specifically identify oversight responsibilities for OUSD(I), but instead decentralizes the management of the information security program to the heads of DOD components. Consequently, according to the DOD regulation, each DOD component is responsible for establishing and maintaining security training, conducting self-inspections, and issuing documentation to implement OUSD(I) guidance and security classification guides. OUSD(I) exercises little oversight over how the components manage their programs. As a result, OUSD(I) does not directly monitor components’ compliance with federal and DOD training, self-inspection, and documentation requirements stipulated in Executive Order 12958, as amended; the ISOO directive; and the DOD regulation. For example, OUSD(I) does not require components to report on any aspects of the security management program. Also, OUSD(I) does not conduct or oversee self-inspections, nor does it confirm whether self-inspections have been performed or review self-inspection findings. At the time of our review, OUSD(I)’s involvement consisted of accompanying ISOO on periodic inspections of select DOD components and subordinate commands that are not under the four military services. Additionally the DOD implementing regulation does not describe what self-inspections should cover, such as the recommended standards in the ISOO directive. Based on our analysis, we believe that OUSD(I)’s decentralized approach, coupled with the lack of specificity in the department’s implementing regulation on what components must do to satisfy the Executive Order and ISOO directive self-inspection requirement, has resulted in wide variance in the quality of components’ information security programs. Because all cleared personnel have the authority to derivatively classify information, they are required to have annual refresher training, whether or not they engaged in derivative classification actions. All of the 19 DOD components and subordinate commands we reviewed offer initial and annual refresher training for their personnel who are involved with derivative classification activities, and most track attendance to ensure that the training is received, as required by the ISOO directive and the DOD regulation (see table 2). However, from our analysis of the components’ and subordinate commands’ initial and annual refresher training, we determined that only 11 of the 19 components and subordinate commands cover the fundamental classification principles cited in the ISOO directive, the DOD regulation, and specifically defined as the minimum training that classifiers must have in a November 2004 memorandum signed by the Under Secretary of Defense for Intelligence. That is, the training offered by 8 of the components and subordinate commands does not describe the basic markings that must appear on classified information, the difference between original and derivative classification, the criteria that must be met to classify information, and the process for determining the duration of classification. Consequently, this training will not provide DOD with assurance that it will reduce improper classification practices, as called for in the ISOO directive. We also noted that 14 of the DOD components and subordinate commands do not assess whether participants understand the course material by administering a proficiency test.