520045m

(8) Surprise, related to possession and capability to use.
(9) Specifications – may be indicative of goals, aims, or achievements.
(10) Manufacturing technology.
(11) Associations with other data or activities.
14
DoDM 5200.45, April 2, 2013
d. Step 4 - Make Initial Classification Determination. Conducting the analysis outlined in
paragraphs 3.b. and 3.c. of this section will help identify the net national advantage, and hence,
what requires classification to protect that advantage. Although at this stage of the guide’s
preparation the focus is primarily on information relating to the overall effort, consideration must
be given to some of the more specific information or data that covers performance capabilities
and possible vulnerabilities and weaknesses. Appendix 3 to this enclosure has been designed to
help in that consideration.
(1) Before trying to identify specific items of information that require classification,
some sense of what information about the system, plan, program, project, or mission needs
protection is required. Use an engineering approach or view of the effort to group information
about the effort into large categories and then consider each category in turn. One or more of the
large categories may be able to be eliminated from further consideration with relative ease (i.e.,
none of the information in the category qualifies for or requires classification). A work
breakdown structure or system architecture may help identify the categories. After the large
categories are identified, they can be repetitively broken into smaller and smaller pieces until
specific elements of information are identified.
(2) Additionally, be aware that the information that needs protection may change as a
system, plan, program, project or mission progresses through its life-cycle. What needs to be
classified in the early stages of a system, plan, program, project or mission (e.g., during research
and development) may differ from that which requires classification in other life-cycle phases
(e.g., system development, production, operations or execution). The effort must be regularly
reevaluated to determine which information requires classification and the classification
guidance updated as appropriate.
(3) Once the information that needs to be protected has been identified, do not forget to
look at all the related processes (e.g., manufacturing, logistics, budgeting) to ensure the
information is protected throughout execution of those processes (e.g., do the budget estimates
need to be classified? does shipment of the end-item to certain locations reveal classified data?).
e. Step 5 - Identify Specific Items of Information That Require Classification
(1) The core of a classification guide is the identification of the specific items or
elements of information warranting security protection. Regardless of the size or complexity of
the subject matter of the guide, or the level at which the classification guide is issued, there are
certain identifiable features of the information that create or contribute to actual or expected
ENCLOSURE 2