The authorized sources for derivative classification are:

  • A Security Classification Guide (SCG).
  • A properly marked source document that already contains the classified information you are using, paraphrasing, or restating.

These two are identified in formal training materials as the only authorized sources for derivative classification guidance; things like NISPOM, other DoD manuals, your personal expertise, or a security manager’s opinion are not considered authorized sources unless they are providing or pointing you to an SCG or a properly marked source document.