What should we do if a classified system or repository is being decommissioned but the records inside still have years left on their classification?

Decommissioning a system never cancels the obligations attached to the records it holds. A record’s classification level and its declassification timeline are properties of the information, not of the platform storing it. So if classified records still have years left on their classification, the guiding principle is simple: the system can go away, but the records — and their protections, retention requirements, and eventual declassification schedule — must continue intact somewhere else.

Separate the records from the system

Before anything is shut down, treat the decommissioning as a records event, not just an IT event. That means:

• Inventory what classified information lives in the system, at what levels, and under what declassification instructions (including any automatic declassification dates or exemptions).
• Confirm retention status. Check the applicable records schedule. Records cannot be deleted simply because their host is retiring; disposition must be authorized.
• Plan a destination for anything still scheduled to be retained, whether that is a successor accredited system, secure offline media, or transfer to an archival authority.

Migrate, don’t lose, the classification metadata

The hardest failures happen when records survive a migration but their markings and declassification instructions do not. Carry forward classification levels, declassification dates, downgrading instructions, and any handling caveats so the receiving environment can keep enforcing them. Records that remain classified must move only into an environment cleared and accredited to hold that level.

Coordinate the right authorities

Decommissioning classified holdings is a team effort. Involve your records officer, your security/classification authority (the original classification authority or its successor), and IT. For federal agencies, classification and declassification practices are governed by the executive-branch security framework overseen by the Information Security Oversight Office, and records disposition is governed by your NARA-approved schedule. Both must be satisfied — security alone does not authorize destruction, and a retention schedule alone does not authorize declassification.

Document everything

Capture what was migrated, what was destroyed (with authorization), and where surviving records now live. A clear audit trail proves nothing was prematurely declassified, improperly destroyed, or orphaned.

For a broader overview of how classified information is reviewed and released over time, see the declassification topic hub.