2. afi31-401.pdf

NOTICE: This publication is available digitally on the AFDPO WWW site at:

http://www.e-publishing.af.mil.

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

BY ORDER OF THE

SECRETARY OF THE AIR FORCE

AIR FORCE INSTRUCTION 31-401

1 NOVEMBER 2005

Security

INFORMATION SECURITY

PROGRAM MANAGEMENT

OPR: HQ USAF/XOS-FI (Mr. Danny Green) Certified by: HQ USAF/XO (Lt Gen Carrol H. Chandler)

Supersedes AFI 31-401, 1 November 2001 Pages: 87 Distribution: F

This publication implements Air Force Policy Directive (AFPD) 31-4, Information Security. It prescribes and explains how to manage and protect unclassified controlled information and classified information.

Use this instruction with Executive Order (EO) 12958, as amended, Classified National Security Informa-tion, 25 March 2003; Office of Management and Budget (OMB), Information Security Oversight Office (ISOO) Directive Number 1, Classified National Security Information, Executive Order 12829, National Industrial Security Program (NISP), DOD Manual 5220.22, National Industrial Security Program Oper-ating Manual, January 1995; and, Department of Defense (DOD) 5200.1-R, Information Security Pro-gram, 14 Jan 97, for the management of the Air Force Information Security Program. Additional references include DOD Instruction (DODI) 5240.11, Damage Assessments, 23 Dec 91; DOD Directive (DODD) 5210.83, Unclassified Controlled Nuclear Information (UCNI), 15 Nov 91; Air Force Policy Directive (AFPD) 31-4, Information Security. This instruction is applicable to contractors as prescribed in AFI 31-601, Industrial Security Program. All these references are listed at the end of each paragraph where applicable. This instruction is not to be used as a stand-alone document. HQ USAF/XOS-F is del-egated approval authority for revisions to this AFI.

SUMMARY OF REVISIONS

This document is substantially revised and must be completely reviewed. The revision updates the Table of Contents to remove Attachment 4, Department of the Air Force Executive Order (EO) 25 Year Automatic Declassification Plan, Attachment 7, Air Force Information Security Program Training Stan-dard, and Attachment 10, Air Force Original Classification Authority List, which were moved to web pages; deletes references to Director/Chief of Acquisition Security; defines the term staff agency chief (paragraph 1.3.5.); refines requirements for security managers (paragraph 1.3.5.1.); prohibits use of con-tractors as security managers (paragraph 1.3.5.2.); establishes the security manager as the organizational Joint Personnel Adjudication System (JPAS) manager (paragraph 1.3.6.10.); outlines procedures for information security program oversight (paragraph 1.4.); clarifies waiver process (paragraph 1.6.);

updates reporting requirements (paragraph 1.7.); updates form requirements (paragraph 1.10.); replaces http://www.e-publishing.af.mil

2 AFI31-401 1 NOVEMBER 2005

Chapter 2, Chapter 3, and Chapter 4 in their entirety to incorporate new guidance from EO 12958;

updates control measures (paragraph 5.1.); replaces references to ASCAS and Sentinel Key throughout Chapter 5; updates Non-Disclosure Agreement retention requirements (paragraph 5.3.); updates clear-ance eligibility verification process throughout Chapter 5; updates the Top Secret inventory process (paragraph 5.8.1.3.); prescribes the use of SF 702, Security Container Check Sheet (paragraph 5.9.1.3.);

prohibits dissemination of classified information at conferences and meetings not conducted on cleared U.S. Government or U.S. Government contractor locations (paragraph 5.13.1.); clarifies policy for alter-native safeguarding measures (paragraph 5.16.1.); updates standards for storage of classified information (paragraph 5.17.) and repair of damaged containers (paragraph 5.22.); adds new policy prescribing emer-gency authority for MAJCOM/FOA/DRU commanders to allow disclosure of classified information (paragraph 5.26.); updates process for destruction of classified material (paragraph 5.28.); details process for use of commercial overnight carriers to transport classified information in urgent cases (paragraph 6.3.2.); deletes AF Form 2595, Classified Protection Insertion Sheet; prescribes documentation of initial security orientation (paragraph 8.4.1.1.); moves the training standard to the web (paragraph 8.4.1.2.); pre-scribes NATO classified information training for all cleared Air Force personnel (paragraph 8.4.1.3.);

updates training for special requirements (Section 8C); prescribes documentation of non-disclosure agreement briefing and attestations in JPAS (paragraph 8.10.1.1.); prescribes documentation of NATO, CNWDI, and SIOP-ESI access authorization in JPAS (paragraph 8.10.2.); prescribes documentation of access termination in JPAS (paragraph 8.11.6.); deletes the requirement to coordinate DSS training through AF/XOS-FI; establishes requirement to report unauthorized public disclosure of classified infor-mation (paragraph 9.1.2.); updates glossary of references and supporting information (Attachment 1);

updates procedures for controlled unclassified information (Attachment 2); establishes reference for physical security design guidelines (Attachment 3); includes new format for classification/declassifica-tion guides (Attachment 7). The following documents are now located at the Air Force Security Forces Center (AFSFC) web site: List of Air Force Officials Authorized to Certify Access to Restricted Data, The 25-Year Declassification Plan, General Information Security Training Standards, and OCA Training.

Chapter 1— POLICY AND PROGRAM MANAGEMENT 7

1.1. Policy

1.2. Philosophy

1.3. Program Management

1.4. Oversight

1.5. Special Types of Information

1.6. Waivers

1.7. Reporting Requirements

1.8. Administrative Sanctions

1.9. Self-Inspection

Chapter 2— ORIGINAL AND DERIVATIVE CLASSIFICATION 13

2.1. Original Classification Authority (OCA)

2.2. Original Classification

AFI31-401 1 NOVEMBER 2005 3

2.3. Derivative Classification

2.4. Classification Prohibitions and Limitations

2.5. Classification Challenges

2.6. Security Classification/Declassification Guides

Chapter 3— DECLASSIFYING AND DOWNGRADING INFORMATION 18

3.1. Declassification and Downgrading Officials

3.2. Declassification

3.3. Exceptions

3.4. Automatic Declassification

3.5. Mandatory Review

3.6. Systematic Review for Declassification

3.7. Referrals

3.8. Public Release

3.9. Downgrading

Chapter 4— MARKINGS 21

4.1. General

4.2. Required Markings

4.3. Special Control and Similar Notices

4.4. NATO

4.5. Other Foreign Government Information (FGI)

4.6. Marking of Foreign Government and NATO Information In DOD Documents

4.7. Audio and Video Tapes

4.8. Removable Information Systems Storage Media

4.9. Sensitive Compartmented Information (SCI)

4.10. Authorized for Release To (REL TO) Markings

4.11. Classified Electronic Mail (E-Mail)

Chapter 5— SAFEGUARDING 28

Section 5A—Control Measures 28

5.1. General

Section 5B—Access 28

5.2. Granting Access to Classified Information

4 AFI31-401 1 NOVEMBER 2005

5.3. Nondisclosure Agreement (NdA)

5.4. Access by Persons Outside the Executive Branch

5.5. Access by Visitors

5.6. Preventing Public Release of Classified Information

5.7. Access to Information Originating in a Non-DOD Department or Agency

5.8. Administrative Controls

Section 5C—Safeguarding 35

5.9. Care During Working Hours

5.10. End-of-Day Security Checks

5.11. Residential Storage Arrangements

5.12. In-Transit Storage

5.13. Classified Meetings and Conferences

5.14. Protecting Classified Material on Aircraft

5.15. Information Processing Equipment

5.16. General Safeguarding Policy

5.17. Standards for Storage Equipment

5.18. Storage of Classified Information

5.19. Use of Key-Operated Locks

5.20. Procurement of New Storage Equipment

5.21. Equipment Designations and Combinations

5.22. Repair of Damaged Security Containers

5.23. Maintenance and Operating Inspections

5.24. Reproduction of Classified Material

5.25. Control Procedures

5.26. Emergency Authority

Section 5D—Disposition and Destruction of Classified Material 42

5.27. Retention of Classified Records

5.28. Disposition and Destruction of Classified Material

Chapter 6— TRANSMISSION AND TRANSPORTATION 44

Section 6A—Methods of Transmission or Transportation 44

6.1. General Policy

AFI31-401 1 NOVEMBER 2005 5

6.2. Transmission and Transporting Top Secret Information

6.3. Transmitting and Transporting Secret Information

6.4. Transmitting Confidential Information

6.5. Transmission of Classified Material to Foreign Governments

Section 6B—Preparation of Material for Transmission 46

6.6. Envelopes or Containers

Section 6C—Escort or Handcarrying of Classified Material 46

6.7. General Provisions

6.8. Documentation

Chapter 7— SPECIAL ACCESS PROGRAMS (SAPS) 48

7.1. Control and Administration

7.2. Code Words and Nicknames

Chapter 8— SECURITY EDUCATION AND TRAINING 49

Section 8A—Policy 49

8.1. General Policy

8.2. Methodology

8.3. Roles and Responsibilities

Section 8B—Initial Security Orientation 50

8.4. Cleared Personnel

8.5. Uncleared Personnel

Section 8C—Special Requirements 51

8.6. Original Classification Authorities (OCAs)

8.7. Derivative Classifiers, Security Personnel, and Others

8.8. Restricted Data (RD)/Formerly Restricted Data (FRD)

Section 8D—Continuing Security Education/Refresher Training 52

8.9. Continuing and Refresher Training

Section 8E—Access Briefings and Termination Debriefings 52

8.10. Access Briefings

8.11. Termination Debriefings

6 AFI31-401 1 NOVEMBER 2005

8.12. Refusal to Sign a Termination Statement

Section 8F—Program Oversight 54

8.13. General

Section 8G—Coordinating Requests for Formal Training 54

8.14. Coordinating Requests for Training

Chapter 9— ACTUAL OR POTENTIAL COMPROMISE OF CLASSIFIED

INFORMATION 55

9.1. Policy

9.2. Definitions

9.3. Information System (IS) Deviations

9.4. Sensitive Compartmented Information (SCI) Incidents

9.5. Special Access Program (SAP) Incidents

9.6. Classification

9.7. Public Release

9.8. Reporting and Notifications

9.9. Preliminary Inquiry

9.10. Damage Assessment

9.11. Formal Investigation

9.12. Management and Oversight

9.13. Unauthorized Absences

9.14. Forms Prescribed

Attachment 1— GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 61

Attachment 2— CONTROLLED UNCLASSIFIED INFORMATION 71

Attachment 3— PHYSICAL SECURITY STANDARDS 76

Attachment 4— TRANSMISSION TO FOREIGN GOVERNMENTS 77

Attachment 5— APPOINTMENT OF INQUIRY OFFICIAL MEMORANDUM 78

Attachment 6— PRELIMINARY INQUIRY OF SECURITY INCIDENT REPORT 79

Attachment 7— FORMAT FOR CLASSIFICATION/DECLASSIFICATION GUIDE 80

AFI31-401 1 NOVEMBER 2005 7

Chapter 1

POLICY AND PROGRAM MANAGEMENT

1.1. Policy. It is Air Force policy to identify, classify, downgrade, declassify, mark, protect, and destroy its classified information and material consistent with national policy. This general policy statement also applies to unclassified controlled information (Attachment 2) under the purview of relevant statutes, reg-ulations and directives [Reference DOD 5200.1-R, C1.1.]

1.2. Philosophy. Protecting information is critical to mission accomplishment. The goal of the Informa-tion Security Program is to efficiently and effectively protect Air Force information by delegating author-ity to the lowest levels possible; encouraging and advocating use of risk management principles; focusing on identifying and protecting only that information that requires protection; integrating security proce-dures into our business processes so that they become transparent; and, ensuring everyone understands their security roles and responsibilities.

1.3. Program Management. The strength of the Air Force Information Security Program is in its infra-structure. The infrastructure is important because it facilitates effective communication of our security policies and procedures to those performing the Air Force mission. With the support of commanders at all levels, this is accomplished predominantly through our Information Security Program Manager (ISPM) and security manager system. Both play an integral role in ensuring unit personnel know and understand their role in protecting classified information against unauthorized disclosure [Reference DOD 5200.1-R, C1.2.]

1.3.1. Senior Security Official. The Administrative Assistant to the Secretary of the Air Force (SAF/ AA) is designated the Air Force Senior Security Official responsible for ensuring implementation of the Information Security Program.

1.3.2. Air Force Program Manager. The Chief, Information Security Division (HQ USAF/XOS-FI) is responsible for policy, resource advocacy, and oversight of this program.

1.3.3. Commanders of Major Commands (MAJCOM), Field Operating Agencies (FOAs), Direct Reporting Units (DRUs), and Installations. These commanders are responsible for:

1.3.3.1. Establishing information security programs.

1.3.3.2. Identifying requirements.

1.3.3.3. Executing their programs to comply with this policy.

1.3.4. Information Security Program Managers (ISPM). The installation Chief of Security Forces or installation senior security forces official is designated the ISPM at each Air Force installation or site.

Air Force ISPMs:

1.3.4.1. Implement the Information Security Program, for the Information, Personnel, and Indus-trial Security Programs on behalf of the installation commander. Assist in the program/technology protection planning process as it relates to information, personnel and industrial security, to include direction on physical security requirements for the protection of assets during the various states, i.e., production, deployment, maintenance, test, or undergoing modifications.

8 AFI31-401 1 NOVEMBER 2005

1.3.4.2. Integrate on-base contractor operations into the installation’s Information Security Pro-gram in accordance with (IAW) AFI 31-601.

1.3.4.2.1. Review pre-award and/or draft solicitations and contract documents associated with classified contract efforts; security classification guides and Department of Defense (DD) Form 254 to ensure appropriate security clauses and/or language is contained therein which address the protection of sensitive government information and resources.

1.3.4.2.2. Serve as technical OPR for the development and preparation of the Visitor Group Security Agreement (VGSA) or other security agreements as determined necessary by the installation commander.

1.3.4.2.3. Conduct security oversight of on-base designated “cleared facilities” as determined by the installation commander.

1.3.4.3. Provide oversight within their jurisdiction.

1.3.4.4. Provide and monitor training as required by Chapter 8 of this AFI.

1.3.4.5. For organizations at the Wing level and below, conduct security manager meetings no less than semi-annually.

1.3.5. Unit Commanders or Equivalents, and Staff Agency Chiefs. NOTE: For the purpose of this instruction, staff agency chiefs are those individuals serving in 2-digit positions reporting to the com-mander or vice commander above the Wing level and 2 and 3 digit positions at Headquarters Air Force. These commanders or equivalents, and staff agency chiefs will:

1.3.5.1. Appoint a security manager to administer the unit’s information security program. Alter-nate security managers may be appointed as necessary. Commanders or equivalents, and staff agency chiefs should consider Air Expeditionary Force rotation cycles, TDY, training require-ments, and other assigned duties. Continuity should receive serious consideration in selection of security managers. Military security managers must have a favorable National Agency Check, local agency check, and credit check (NACLC); civilians a National Agency Check with written inquiries and credit check (ANACI), investigation or higher and eligibility for JPAS access before appointment. NOTE: Smaller organizations and staff agencies are encouraged to appoint primary and alternate security managers to serve multiple activities.

1.3.5.1.1. Contractors will not be appointed as primary or alternate security managers. How-ever, they can be required to provide other security program support, under Air Force direc-tion, such as, assisting the security manager, conducting end-of-day security checks, security training/briefings, etc.

1.3.5.2. Ensure security managers receive training required by Chapter 8.

1.3.5.3. Notify the ISPM in writing when either primary or alternate security managers are changed.

1.3.6. Security Managers:

1.3.6.1. Establish and manage the Information Security Program within their unit or staff agency.

1.3.6.2. Develop and update a unit security operating instruction.

1.3.6.3. Advise the unit commander or equivalents, and staff agency chief on security issues per-taining to the unit or staff agency.

AFI31-401 1 NOVEMBER 2005 9

1.3.6.4. Attend ISPM hosted security manager meetings.

1.3.6.5. Update and remind personnel of security policies and procedures.

1.3.6.6. Oversee the unit or staff agency information security self-inspection program.

1.3.6.7. Report security incidents immediately, but no later than by the end of the first duty day.

1.3.6.8. Assist the unit commander or equivalent, staff agency chief and ISPM in monitoring security incident investigations. Normally security managers will not conduct security incident inquiries.

1.3.6.9. Participate in security education training as defined in Chapter 8.

1.3.6.10. Manage the JPAS within their organization.

1.3.6.10.1. In-process and out-process all unit personnel.

1.3.6.10.2. Monitor and act on system notifications.

1.3.7. Supervisors:

1.3.7.1. Establish criteria, evaluate, and rate all Air Force employees on their performance of security responsibilities [Reference DOD 5200.1-R, C1.1.2.1.]

1.3.7.1.1. Military. See AFI 36-2406, Officer and Enlisted Evaluation Systems, paragraph 1.3.7.

1.3.7.1.2. Civilian. See AFI 36-1001, Managing the Civilian Performance Program, para-graph A3.2.8.

1.3.7.2. Provide and ensure training as directed in Chapter 8 of this AFI.

1.3.8. Foreign Disclosure. The Deputy Under Secretary of the Air Force, International Affairs, (SAF/ IA), 1080 Air Force Pentagon, Washington DC 20330-1080, oversees the release of all Air Force information to foreign governments, persons, and international organizations.

1.3.9. Historian. The Air Force Historian (HQ USAF/HO), 3 Brookley Avenue, Box 94, Bolling AFB DC 20032-5000, approves or disapproves historical researchers’ access to classified information.

[Reference DOD 5200.1-R, C6.2.2.4.]

1.4. Oversight. In addition to the reporting requirements of the Information Security Program (see para-graph 1.7.), the following will be implemented [Reference DOD 5200.1-R, C1.7.]

1.4.1. MAJCOMs will incorporate information security issues into Inspector General (IG) inspec-tions/reviews. In addition, MAJCOM security forces staff will conduct security oversight and assis-tance visits in the form of either an Information Security Program Review (ISPR) or Staff Assistance Visit (SAV) to subordinate ISPMs at least every 36 months. MAJCOM security forces staffs are encouraged to explore oversight options to minimize resource impact.

1.4.1.1. ISPR.

1.4.1.1.1. An ISPR is an assistance-oriented oversight visit for the information security pro-grams performed by an ISPM, or designated representative(s) on a subordinate ISPM or secu-rity manager. It is a non-rated review for policy and program effectiveness to benchmark

10 AFI31-401 1 NOVEMBER 2005

processes/products, identify problem areas and corrective actions. A key component of the ISPR is an assessment of the effectiveness of the information security training program.

1.4.1.1.2. Air Force on-base contractor visitor groups will be integrated into the host installa-tion’s Information Security Program unless the mission, operational requirements, autono-mous nature or other factors require them to establish and maintain their own security program as a cleared facility under the National Industrial Security Program Operating Manual (NIS-

POM).

1.4.1.1.3. The ISPM will provide the commander or equivalent, and staff agency chief the ISPR results in writing.

1.4.2. Base level ISPMs will conduct ISPRs on an annual basis. EXCEPTION: An extension to 18 months may be granted by the ISPM for units that have demonstrated highly effective, discrepancy free programs during the previous ISPR. ISPRs/SAVs may be conducted every two years for activities or units that do not store classified information.

1.4.3. Security Self-Inspections: Unit commanders or equivalents, and staff agency chiefs involved with processing or holding classified information ensure personnel conduct semiannual security self-inspections to evaluate information security program effectiveness. EXCEPTION: Activities with a small volume of classified material may work with the ISPM to develop an oversight schedule consistent with risk management principles.

1.4.3.1. Unit commanders or equivalents, and staff agency chiefs will appoint an individual, in writing, other than the unit security manager to conduct a semiannual security inspection.

1.4.3.2. A program review may satisfy the requirement for one of the semiannual self-inspections.

1.4.4. HQ USAF/XOS-FI will visit MAJCOMs to review their information security programs every 36 months.

1.5. Special Types of Information. [Reference DOD 5200.1-R, C1.3.]

1.5.1. Restricted Data (RD)/Formerly Restricted Data (FRD). [Reference DODD 5210.2 and DOD 5200.1-R, C1.3.1.]

1.5.1.1. General. RD is governed by DODD 5210.2, Access to and Dissemination of Restricted Data, 12 Jan 78. Air Force personnel will mark and safeguard RD according to DODD 5210.2. A list of Air Force Officials Authorized to Certify Access to RD is located on the AFSFC web site.

These officials are responsible for certifying access to RD using DoE Form 5631.20, Request for Visit or Access Approval (see paragraph 5.5.1.2.). They may delegate this authority to the level they deem necessary for operational efficiency. Officials delegated the authority will sign in the “For” block on behalf of the access granting official. Air Force personnel may obtain DoE Form

5631.20 from the DoE activity they are visiting or at the DoE Forms web site.

1.5.1.1.1. Activities must notify HQ USAF/XOS-FI through command ISPM channels of changes to the list of certifying officials as they occur. When doing so, they must also provide the position title, activity and office symbol of the affected authority. NOTE: When the change involves an activity name change, access-granting officials will sign forms authorizing access using the current activity name and a note that identifies the activity it superseded until the list of officials is updated.

AFI31-401 1 NOVEMBER 2005 11

1.5.1.1.2. HQ USAF/XOS-FI will periodically update a master list available at the AFSFC web site.

1.5.1.2. Critical Nuclear Weapon Design Information (CNWDI). RD that is particularly sensitive.

Access is limited to the minimum number of people who need it to do their job.

1.5.1.2.1. CNWDI Approving Officials. These officials are responsible for granting CNWDI access. This authority is assigned to division chiefs and above at all levels of command.

1.5.1.2.2. Granting Access. Approving officials will ensure access and briefings are docu-mented on AF Form 2583, Request for Personnel Security Action.

1.5.1.2.3. Protection. Air Force personnel will protect CNWDI in the same manner prescribed for collateral classified information. This includes limiting access to containers storing CNWDI to only those personnel who have been granted CNWDI access. [Reference DODD 5210.2, Paragraph 6]

1.5.2. North Atlantic Treaty Organization (NATO). [Reference DOD 5200.1-R, C1.3.4.]

1.5.2.1. HQ USAF/XOS-FI is responsible for overall development, approval, and implementation of NATO security policy within the Air Force.

1.5.2.2. HQ USAFE/A7F is responsible for developing and recommending NATO security policy for implementation within the Air Force.

1.5.3. For Official Use Only (FOUO). Unclassified information that is exempt from release under the Freedom of Information Act (FOIA) exemptions 2-9, may be designated “For Official Use Only.” No other material shall be considered FOUO. FOUO is not authorized as an anemic form of classification to protect national security interests. [Reference DOD Regulation 5400.7/AF Supplement, DOD Free-dom of Information Act Program, C4.1.1] The FOIA exemptions are detailed in DOD Regulation 5400.7/AF Supplement, Chapter 3.

1.5.4. Sensitive Compartmented Information (SCI). The Director of Intelligence, Surveillance and Reconnaissance (HQ USAF/XOI), 1480 Air Force Pentagon, Washington DC 20330-1480, is respon-sible for SCI policy. The provisions of this publication may not supersede the policies and guidance prescribed in the appropriate Director of Central Intelligence Directives governing the control, safe-guarding, and dissemination of SCI as promulgated by the Cognizant Security Authority (CSA) for intelligence security management. The CSA will, on behalf of the Senior Official of the Intelligence Community (SOIC), AF/XOI, ensure appropriate resolution of actual or perceived conflicts regarding SCI and the provisions of this publication.

1.5.5. Special Access Program (SAP) Information. The Director of Security, Counterintelligence and Special Program Oversight (SAF/AAZ), 1480 Air Force Pentagon, Washington DC 20330-1480, is responsible for SAP policy and oversight of all Air Force SAPs. Should the policies and guidance in this instruction and those issued by DoD and/or the Air Force SAP Central Office (AFSAPCO) con-flict, DoD and AFSAPCO policies and guidance will take precedence.

1.6. Waivers.

1.6.1. Commanders or equivalents, and staff agency chiefs send requests to waive provisions of DOD 5200.1-R, AFPD 31-4, or this AFI through command ISPM channels to HQ USAF/XOS-FI. FOAs

12 AFI31-401 1 NOVEMBER 2005

also coordinate their requests with their respective functional head at Headquarters Air Force (HAF) before submitting to HQ USAF/XOS-FI [Reference DOD 5200.1-R, C1.4.2.]

1.6.2. Requests for waivers shall contain sufficient information to permit a complete and thorough analysis to be made of the impact on national security should the waiver be approved.

1.6.3. Waivers or exceptions to Special Access Program (SAP) requirements are forwarded through appropriate program channels to SAF/AAZ, 1480 Air Force Pentagon, Washington DC 20330-1480.

1.7. Reporting Requirements. [Reference DOD 5200.1-R, C1.6.1.]

1.7.1. MAJCOM and DRU ISPMs will submit the SF Form 311, Agency Security Classification Pro-gram Data, report to HQ USAF/XOS-FI by 15 October of each year.

1.7.1.1. Organizations sample data for Part C, Original Classification Decisions, and Part D, Derivative Classification Decisions during a consecutive 2-week period each fiscal year quarter (Oct-Dec, Jan-Mar, Apr-Jun, and Jul-Sep). In the last quarter the 2-week period must be set early since the reports are required by 15 October. Interagency Report Control Number 0230-GSA-AN applies to this information collection requirement.

1.7.1.1.1. Count the number of classification decisions in finished products for dissemination or retention, regardless of the media.

1.7.1.1.2. Do not count reproductions or copies.

1.8. Administrative Sanctions.

1.8.1. Send reports through command ISPM channels to HQ USAF/XOS-FI when someone know-ingly, willfully, or negligently discloses classified information to unauthorized individuals as speci-fied in EO 12958, as amended [Reference DOD 5200.1-R, C1.5.]

1.8.2. Air Force commanders or equivalents and staff agency chiefs report unauthorized disclosures of classified information that violate criminal statutes to their servicing ISPM and Air Force Office of Special Investigations (AFOSI) offices [Reference DOD 5200.1-R, C1.5.]

1.8.3. Commanders or equivalents, and staff agency chiefs take and process administrative sanctions/ actions for civilian appropriated fund employees IAW AFI 36-704, Discipline and Adverse Actions, AFMAN 34-310, Nonappropriated Fund Personnel Program Management and Administration Pro-cedures, for nonappropriated fund employees, and IAW AFI 36-2907, Unfavorable Information File (UIF) Program, for military personnel. Contact the servicing civilian or military personnel flight office if assistance is needed. Commanders should consult their servicing legal office before taking action for serious violations.

1.9. Self-Inspection. See paragraph 1.4. of this AFI [Reference DOD 5200.1-R, C1.7.]

AFI31-401 1 NOVEMBER 2005 13

Chapter 2

ORIGINAL AND DERIVATIVE CLASSIFICATION

2.1. Original Classification Authority (OCA) [Reference DOD 5200.1-R, C2.2.]

2.1.1. The Secretary of the Air Force serves as the OCA and may further delegate this authority.

2.1.2. The process for delegating OCA authority is as follows:

2.1.2.1. Secretary of the Air Force delegates Top Secret, Secret, and Confidential authority.

2.1.2.2. SAF/AA delegates Secret and Confidential authority.

2.1.2.3. All requests for the delegation of OCA will be forwarded through command ISPM chan-nels to the Chief, Information Security Division, HQ USAF/XOS-FI, 1340 Air Force Pentagon, Washington, DC 20330-1340, for processing.

2.1.2.3.1. Address requests for original Top Secret authority to the Secretary of the Air Force.

2.1.2.3.2. Address requests for original Secret and Confidential authority to SAF/AA.

2.1.2.3.3. Only individuals in senior military or civilian positions (usually General Officer or Senior Executive Service level) at the first or second echelon of command carrying out a unique mission with responsibility for one of the eight subject areas prescribed by EO 12958, as amended, may be designated as an OCA.

2.1.2.3.4. OCA is assigned to a position, not a person. OCA will not be delegated other than identified in paragraphs 2.1.2.1. and 2.1.2.2. above. However, deputies, vice commanders, chiefs of staff and similar other subordinates of an OCA are empowered to act as an OCA when they assume the duty position of an OCA in an “acting” capacity and have certified in writing that they have been trained in OCA responsibilities and classification principles in addition to the basic security training on the proper safeguarding of classified information and the criminal, civil, and administrative sanctions that may be brought against an individual who fails to protect classified information from unauthorized disclosure before exercising this authority.

2.1.2.4. All requests will contain the full position title, functional office symbol, a detailed expla-nation of why the position requires OCA and an estimate of the annual use of the delegated author-ity.

2.1.3. HQ USAF/XOS-FI will maintain the master list of Air Force OCAs and post that list on the AFSFC web site. Periodically, HQ USAF/XOS-FI will request OCA validation from the MAJCOM/ FOA/DRU ISPMs.

2.1.3.1. Personnel will submit requests for changes or new requests through ISPM command channels as they occur.

2.1.3.2. See the AFSFC web site for OCA training requirements.

2.2. Original Classification. [Reference DOD 5200.1-R, Chapter 2 and Interim Information Security Guidance, April 16, 2004.]

14 AFI31-401 1 NOVEMBER 2005

2.2.1. Original classification is the initial decision that an item of information could be expected to cause damage to the national security if subjected to unauthorized disclosure, and that the interests of the national security are best served by applying the safeguards of the Information Security Program to protect it. This decision may be made only by persons who have been specifically delegated the authority to do so, have received training in the exercise of this authority, and have program responsi-bility or cognizance over the information [Reference: DOD 5200.1-R, C2.1.]

2.2.1.1. Before an original classification decision is made, it must be determined that classifica-tion guidance is not already available in the form of classification guides, plans or other memo-randa.

2.2.1.2. OCAs are accountable to the Secretary of Defense for their classification decisions.

2.2.1.3. In those rare situations where the OCAs’ decision must be rendered verbally due to the priorities of an on-going operation, written confirmation will be issued within seven days.

2.2.1.4. OCAs must notify users when there are changes to an original decision.

2.2.1.5. OCAs shall be prepared to present, as required, deposition and expert testimony in courts of law concerning classification of national security information and be prepared to defend and justify their original decisions.

2.2.2. Classification may be applied only to information that is owned by, produced by or for, or is under the control of the United States Government. Information may be considered for classification only if it concerns one of the categories specified in Section 1.4 of EO 12958, as amended.

2.3. Derivative Classification. The act of incorporating, paraphrasing, restating, or generating in a new form information that is already classified, and marking the newly developed material consistent with the markings of the source information. The source information ordinarily consists of a classified document or a classification guide issued by an OCA. Within DOD, all cleared personnel can perform derivative classification.

2.3.1. Originating Agency’s Determination Required (OADR). OADR is no longer an approved marking and should not be contained in any originally classified documents that have been created after October 14, 1995.

2.3.2. X1 through X8 are no longer approved markings and should not be contained in any originally classified documents that have been created on or after September 22, 2003.

2.3.3. When creating a derivatively classified document and using a source document that contains OADR or X1 through X8, the derivative classifier will place the following information in the Declas-sify On line:

DECLASSIFY ON: Source marked OADR (or X1 thru X8, whatever is applicable)

Date of source: 5 October 1993 (date of source document)

2.3.4. These documents will be subject to review for declassification 25 years after the date of the source document.

2.4. Classification Prohibitions and Limitations.

AFI31-401 1 NOVEMBER 2005 15

2.4.1. Under no circumstances shall information be classified in order to (1) conceal violation of law, inefficiency, or administrative error; (2) prevent embarrassment to a person, organization, or agency;

(3) restrain competition; or (4) prevent or delay the release of information that does not require protec-tion in the interest of the national security [Reference EO 12958, as amended, Section 1.7, DOD 5200.1-R, and Interim Information Security Guidance 16 April 2004.]

2.4.2. The OCA having jurisdiction over the subject matter determines if information requested under the FOIA or the mandatory declassification review (MDR) provisions of EO 12958, as amended, should be declassified [Reference DOD 5200.1-R, C2.4.3.5.]

2.5. Classification Challenges [Reference DOD 5200.1-R, C4.9.]

2.5.1. If holders of information have reason to believe that the information is improperly or unneces-sarily classified, they shall communicate that belief to their commander or equivalent, staff agency chief, security manager, or supervisor.

2.5.2. Send formal challenges to classification, in writing, to the OCA with jurisdiction over the infor-mation in question.

2.5.3. Challenges to reclassification decisions are sent through command ISPM channels to HQ

USAF/XOS-FI.

2.5.4. All classified information undergoing a challenge or a subsequent appeal will remain classified until a final resolution is reached.

2.6. Security Classification/Declassification Guides.

2.6.1. Required Elements. A security classification/declassification guide (see Attachment 7 for sample format) is the written record of an original classification decision and appropriate declassifica-tion instructions and should be issued as early as practical in the life cycle of the classified system, plan, program or project. It shall, at a minimum:

2.6.1.1. Identify the subject matter of the classification guide.

2.6.1.2. Identify the OCA by name or personal identifier, and position.

2.6.1.3. Identify an agency Point of Contact (POC) (name, office symbol, mailing address, orga-nizational e-mail address, DSN/commercial phone numbers) for questions regarding the classifi-cation guide.

2.6.1.4. Provide the date of issuance or last review.

2.6.1.5. State precisely the categories or elements of information to be declassified, to be down-graded, or not to be declassified.

2.6.1.6. State which classification level applies to each element of information, and, when useful, specify the elements of information that are unclassified (NOTE: only one level of classification will be annotated for each element of information.)

2.6.1.7. State a concise reason for classification which, at a minimum, cites the applicable classi-fication category or categories in Section 1.4 of EO 12958, as amended.

2.6.1.8. State, when applicable, special handling caveats.

2.6.1.9. Prescribe declassification instructions for each element of classified information.

16 AFI31-401 1 NOVEMBER 2005

2.6.1.10. Identify any related files series that have been exempted from automatic declassification pursuant to Section 3.3(c) of EO 12958, as amended.

2.6.1.11. To the extent a guide is used in conjunction with the automatic declassification provi-sions in Section 3.3 of EO 12958, as amended, state precisely the elements of information to be exempted from declassification to include:

2.6.1.11.1. The appropriate exemption category listed in section 3.3(b), and, when citing the exemption category listed in section 3.3(b)(9), specify the applicable statute, treaty or interna-tional agreement; and

2.6.1.11.2. A date or event for declassification IAW section 1.5.

2.6.2. OCA Responsibilities.

2.6.2.1. It is the responsibility of the OCA to publish classification/declassification guides to facilitate the proper and uniform derivative classification and declassification of their information.

NOTE: In some cases, OCAs may determine that publishing classification guidance in other forms is more effective, e.g., program protection plans, system protection guides, AFIs. In these cases, the applicable publication will be considered the guide and the publishing requirements in paragraph 3.3. still apply.

2.6.2.2. Each OCA will revise (IAW paragraph 2.6.2.4. below) their security classification guides to include an advisory statement in the Release of Information section:

2.6.2.2.1. Release of program data on the World Wide Web. Extreme care must be taken when considering information for release onto publicly accessible or unprotected World Wide Web sites. In addition to satisfying all of the aforementioned approval provisions, owners and/or releasers of information proposed for such release must ensure that it is not susceptible to com-pilation with other information to render sensitive or even classified data in the aggregate. The search and data mining capabilities of Web technology must be assessed from a risk manage-ment perspective. Information intended for publication on publicly accessible or unprotected web sites must be cleared for public release prior to publication according to AFI 35-101, Pub-lic Affairs Policy and Procedures. If there are any doubts, do not release the information.

2.6.2.3. All guides will be reviewed by the servicing Foreign Disclosure Office before final approval.

2.6.2.4. Classification/declassification security guides shall be reviewed and updated, as circum-stances require, but at least once every five years. NOTE: Due to the major changes implemented by EO 12958, as amended, all current Air Force classification/declassification guides will be reviewed no later than 31 December 2005, and every five years thereafter.

2.6.3. Publishing Requirements.

2.6.3.1. All guides which extend classification beyond 25 years must be approved by the Inter-agency Security Classification Appeals Panel (ISCAP). Once the OCA has signed the guide, the document will be sent to HQ USAF/XOS-FI who will forward it to the ISCAP for approval.

2.6.3.2. The OCA will report publication of or changes to security classification/ declassification guides to the Administrator, Defense Technical Information Center (DTIC) using DD Form 2024.

DTIC will require an electronic copy of the guide.

AFI31-401 1 NOVEMBER 2005 17

2.6.3.3. OCAs must also forward a hard copy of the applicable publication or change to:

2.6.3.3.1. HQ AFHRA/RSA, 600 Chennault Circle, Maxwell AFB AL 36112-6424.

2.6.3.3.2. SAF/PA, 1690 Air Force Pentagon, Washington, DC 20330-1690.

2.6.3.4. All guides (to include any changes) will also be forwarded electronically to AF/XOS-FI at AFXOS-FI.workflow@pentagon.af.mil and AFDO at AFDO.Workflow@pentagon.af.mil in PDF and Microsoft Word format.

2.6.4. Electronic Location of Guides. HQ USAF/XOS-FI will maintain the master list of all Air Force classification/declassification guides and will post all guides on the AF/XOS-FI SIPRNET web page.

Guides are also located on the DTIC web site. To access the DTIC web site you must have a DTIC account. The URL for this is http://www.dtic.mil/dtic/registration.

2.6.5. Nuclear Weapons Classification Policy. The DOD and the Department of Energy (DoE) issue joint security classification guidance for information relating to nuclear weapons. The Air Force issues security classification policy (AFI 31-407) for nuclear weapons surety information. Most of these products are classified and users will require the appropriate security clearance before accessing them. Users may obtain copies of Joint DOD/DoE classification guides through DTIC at a cost. Users forward requests for copies of the Air Force security classification policy to HQ USAF/XOS-FI (1340 Air Force Pentagon, Washington DC 20330-1340) through command ISPM channels. Requests must include the name, address, and phone number of the activity POC, and the POC’s level of access.

ISPMs will validate this information before submitting the requests to HQ USAF/XOS-FI. For all other Air Force or other agency guides, go direct to the originator. Users refer to DOD 5200.1-I, DOD Index of Security Classification Guides, to determine what other guides relating to nuclear weapons classification guidance are needed. DOD 5200.1-I can be obtained from DTIC.

mailto:AFXOS-FI.workflow@pentagon.af.mil mailto:AFDO.Workflow@pentagon.af.mil http://www.dtic.mil/dtic/registration

18 AFI31-401 1 NOVEMBER 2005

Chapter 3

DECLASSIFYING AND DOWNGRADING INFORMATION

3.1. Declassification and Downgrading Officials. Within the Air Force, only OCAs have the authority to declassify or downgrade classified information.

3.2. Declassification. Note: Exemptions identified in this chapter are found in ISSO Directive Number 1, Section 2001.21(3)(i).

3.2.1. Originally Classified Documents. The declassification decision determines the duration of pro-tection [Reference EO 12958, as amended, Section 1.6.(a)(4) and ISOO Directive Number 1, Section 2001.12.]. At the time an item of information is classified, original classifiers will determine which of the following four declassification instructions will be used, selecting whenever possible, the declas-sification instruction that will result in the shortest duration of classification.

3.2.1.1. A date or event less than 10 years from the date of the document; or, if unable to identify such a date or event;

3.2.1.2. A date 10 years from the date of the document; or

3.2.1.3. A date greater than 10 and less than 25 years from the date of the document; or

3.2.1.4. A date 25 years from the date of the document.

3.2.2. Derivatively Classified Documents. The “Declassify on” line must include one of the follow-ing:

3.2.2.1. The date or event up to 25 years, as noted on the source document; or

3.2.2.2. Source marked OADR, date of source (cannot be a date after October 1995); or

3.2.2.3. Source marked X1-X8, date of source (cannot be a date after September 2003); or

3.2.2.4. 25X1 through 25X9, and a specific date or event for declassification; or

3.2.2.5. 25X1-human (the only category that does not require a date or event follow it).

3.3. Exceptions. RD/FRD [Reference 10 CFR 1045.1 Subpart A]. Documents containing RD or FRD are excluded from automatic declassification and do not require a declassification date. RD must be reviewed by the DoE prior to release. DoE and DOD must jointly review documents containing FRD prior to release.

3.4. Automatic Declassification. IAW EO 12958, as amended, Section 3.3, all Air Force activities that possess classified information that is of permanent historical value and is 25 years old or older should have completed a declassification review of these documents by 31 Dec 2006.

3.4.1. The Air Force Declassification Office (AFDO) has published the Air Force Declassification Plan that provides the framework for Air Force compliance with Section 3.3 of EO 12958, as amended. It pertains to all classified Air Force records that are 25 years old or older as of 31 Decem-ber 2006, and have been determined under Federal law to have permanent historical value. The Air Force Declassification Plan is posted at the AFDO web site (http://www.afdo.hq.af.mil/Plan.htm).

It is critical that records management and information security personnel work together to ensure that http://www.afdo.hq.af.mil/Plan.htm

AFI31-401 1 NOVEMBER 2005 19

requirements of both are met on classified records that are going to be sent to the National Archives or Federal Records Center.

3.4.2. All classified records shall be automatically declassified on 31 December of the year that is 25 years from the date of its original classification, unless it falls in one of the exemption categories (25X) listed in Section 3.3(b) of EO 12958, as amended.

3.4.3. The 25X categories cannot be used unless the specific information has been approved through the ISCAP process. This is usually done in the form of a security classification/declassification guide.

(See paragraph 2.6. and Attachment 7.) The Air Force has an approved list of exemption categories (listed in the Air Force Declassification Plan); however, the specific item must still be annotated in the security classification/ declassification guide before it is used on derivatively marked documents. For original classification decisions, no 25X marking, other than “25X1-human,” is permitted on the “declassify on” line. All originally classified documents will contain either a date or event less than 10 years or a date from 10 to 25 years. The only exception is the marking “25X1-human.” This marking may be used when the disclosure of the information could be expected to reveal the identity of a con-fidential human source or human intelligence source. This is the only 25X marking that does not require a date or event for declassification to be cited with the 25X marking.

3.5. Mandatory Review.

3.5.1. Mandatory review requests must identify the information requested with enough specificity to allow for location of the records with a reasonable amount of effort.

3.5.2. Send all requests for MDR to 11 CS/SCSL (MDR), 1000 Air Force Pentagon, Washington DC 20330-1000.

3.5.3. Send appeals to MDR decisions through 11 CS/SCSL (MDR) to SAF/AA, the Air Force Appellate Authority for MDRs.

3.6. Systematic Review for Declassification. Activities will set up an annual schedule for conducting systematic declassification reviews for the following records:

3.6.1. Records of permanent historical value prior to their twenty-fifth birthday. These records will be reviewed and appropriate action taken by 31 Dec of the same year that is 25 years from the date of its original classification.

3.6.2. Other records. Activities will set up a reasonable schedule for conducting declassification reviews for all other classified records.

3.7. Referrals. A referral is information that is subject to the provisions of EO 12958, as amended, Sec-tion 3.3, Automatic Declassification, and ISOO Directive No. 1, Section 2001.34, and has been referred to, within, or outside the Air Force for review. AFDO is the focal point for processing Air Force referrals.

Detailed information regarding the referral process can be found in the Air Force Declassification Plan.

3.8. Public Release. When information is declassified, it is not releasable to the public until it has been approved for release through the security review process IAW AFI 35-101, Chapter 15. The same holds true for declassified or unclassified information that will be placed on an Internet site that can be accessed by the public.

20 AFI31-401 1 NOVEMBER 2005

3.9. Downgrading. Downgrading of information to a lower level of classification is appropriate when the information no longer requires protection at the originally assigned level, and can be properly pro-tected at a lower level. Any official who is authorized to classify or declassify the information and has authority over the information may downgrade information.

AFI31-401 1 NOVEMBER 2005 21

Chapter 4

MARKINGS

4.1. General. Air Force personnel who originally and derivatively classify information will mark those products according to DOD 5200.1-R and the ISOO Marking Booklet. Material other than ordinary paper documents, e.g., e-mail transmitted over a secure network, must have the same information either marked on it or made immediately available to holders by other means. [Reference DOD 5200.1-R, C5.1.]

4.2. Required Markings. Classified documents are required to have the following markings:

4.2.1. The overall classification of the document.

4.2.2. The agency, office of origin, and date of the document.

4.2.3. The office or source document that classified the information.

4.2.3.1. If it is originally classified, the document will reference the office. Example:

CLASSIFIED BY: HQ USAF/XO

4.2.3.2. If a document is derivatively classified, it will reference the source document or the secu-rity classification/declassification guide. Example:

DERIVED FROM: HQ USAF/XO Memo dated 12 Jan 2003

Subj: Funding Problems

4.2.4. The reason for classification. Each originally classified document shall bear a concise state-ment of the reason for classification, determined by the original classifier.