How does ISOO audit and enforce agency compliance with classification rules?

The Information Security Oversight Office (ISOO), a component of the National Archives, oversees how executive branch agencies create, protect, and declassify national security information. ISOO does not run a single courtroom-style enforcement process. Instead, it relies on a combination of policy oversight, on-site review, public reporting, and escalation to senior officials to hold agencies accountable to the rules established under the governing executive order on classified national security information.

How ISOO oversees agencies

ISOO’s authority comes from the President’s executive order on classified information and related directives, which it helps implement and interpret. Its oversight typically works through several channels:

• Policy and guidance. ISOO issues directives and instructions that translate the executive order into consistent, government-wide practice, so agencies measure compliance against a common standard.
• On-site assessments and reviews. ISOO conducts inspections and reviews of agency security programs, examining whether classification decisions, markings, safeguarding, and declassification activities follow the rules.
• Data collection. Agencies report classification and declassification activity to ISOO, which compiles and analyzes that information.

How compliance is enforced

ISOO’s primary enforcement tools are transparency and escalation rather than fines:

• Annual reporting. ISOO publishes an annual report to the President summarizing classification activity, declassification progress, costs, and problem areas. Public reporting creates pressure to correct deficiencies.
• Findings and recommendations. When reviews reveal over-classification, marking errors, or weak programs, ISOO identifies the problems and recommends corrective action.
• Referral and escalation. ISOO can raise persistent or serious problems with agency leadership and senior officials responsible for the classification system, who have authority to compel changes.

For systematic and automatic declassification, ISOO also monitors agency progress and the work of interagency review bodies, helping ensure aging records move toward release rather than remaining classified indefinitely.

Why it matters for records professionals

For records and information governance staff, ISOO oversight reinforces that classification is a documented, reviewable decision, not a permanent label. Sound recordkeeping (clear markings, retention of declassification authorities, and audit trails) is what lets an agency demonstrate compliance during an ISOO review.

For related background, see the declassification topic hub.