How do I assess the maturity of my agency's classified records management program?

Assessing maturity means measuring not just whether your agency follows the rules, but how consistently, reliably, and defensibly it manages classified records across their full lifecycle. A useful assessment looks at people, processes, technology, and oversight together rather than auditing a single control in isolation.

Start With the Lifecycle

Map how classified records move through your agency from creation to final disposition. For each stage, ask whether practices are ad hoc, documented, consistently applied, measured, or actively improved:

• Classification and marking — Are original and derivative classification decisions properly justified, marked, and traceable to a source authority?
• Custody and access — Can you demonstrate who created, accessed, and altered records, and on what authority?
• Declassification review — Are records reviewed on schedule (automatic, systematic, and mandatory review), with decisions documented?
• Disposition and transfer — Are eligible records transferred or destroyed under an approved schedule, not held indefinitely by default?

A program is more mature when each stage is documented, repeatable, and produces evidence, rather than depending on the memory of individual staff.

Use a Maturity Model

Frame findings on a scale — for example, from initial/ad hoc to managed to optimized. International records management standards describe the program elements worth scoring: governance, accountability, policy, defined processes, trained people, and monitoring. Rate each element honestly, then identify the lowest-scoring areas as priorities.

Look for Evidence, Not Intentions

Maturity is proven by artifacts. Strong indicators include:

• Current, approved policies and records schedules that staff actually follow
• A self-inspection or internal review program that runs on a regular cadence
• Training records showing classifiers and custodians are qualified
• Metrics on backlogs, overdue declassification reviews, and audit findings
• Corrective-action tracking that closes gaps over time

Benchmark Against Oversight Expectations

Compare your practices to the standards used by external reviewers and oversight bodies. The Information Security Oversight Office sets and reports on government-wide expectations for classification and declassification programs, making its guidance a useful yardstick for self-assessment.

For related guidance on review processes and program elements, see the declassification topic hub. The goal is a candid baseline you can re-measure over time — maturity is shown by steady, documented improvement, not a single passing score.