What should I do if I find a classified marking on an old record in our files?

Finding a classified marking on an old record can be unsettling, but the right response is calm, deliberate, and procedural. The marking signals that the document may contain information whose disclosure could harm national security, so it must be handled under your organization’s security policies rather than treated as an ordinary record.

Do Not Read, Copy, or Share It Further

The moment you recognize a classified marking, stop handling the document as if it were unclassified.

• Do not photocopy, scan, email, or upload it.
• Do not discuss its contents with people who lack the appropriate clearance and need-to-know.
• Limit your own review to confirming the marking exists; you do not need to study the contents.

Treat it as potentially still classified even if it appears very old. Markings are not automatically removed by the passage of time alone.

Secure and Report It Promptly

Place the record where it cannot be casually accessed and notify the right people without delay.

• Contact your security manager, security officer, or designated classified-information point of contact.
• If your organization has no such role, escalate to your records manager, legal counsel, or agency security office.
• Follow their instructions for safeguarding or transferring custody.

Reporting is not an accusation of wrongdoing. Older records often surface in files when programs change, offices merge, or paper collections are digitized.

Let Authorized Officials Decide on Status

Only an appropriate original or derivative classification authority, or a formal declassification review, can determine whether information remains classified, should be downgraded, or can be released. A line through a marking, a handwritten note, or your personal judgment is not sufficient.

Some markings you find may not be national-security classification at all, but rather older legacy markings or Controlled Unclassified Information (CUI). The authorized reviewer will sort this out.

Document What You Did

Briefly note when and where you found the record and to whom you reported it. This supports a clean chain of custody and demonstrates that your organization handled the matter responsibly.

For broader background on classification, review, and release processes, see our declassification topic hub.