Classified Working Papers are properly marked, destroyed when no longer needed, or treated as a finished document after 180 days.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-245824	IS-04.03.01	IS-04.03.01	SV-245824r1138446_rule	2025-12-04	2

Description
Failure to properly mark or handle classified documents can lead to the loss or compromise of classified or sensitive information. REFERENCES: CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 6.a. and Enclosure C, paragraph 21.h.(7). NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-3 & PE-5(3). DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 3, paragraph 13 and figure 11. DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraph 13. 32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

Description

Failure to properly mark or handle classified documents can lead to the loss or compromise of classified or sensitive information. REFERENCES: CJCSI 6510.01F, INFORMATION ASSURANCE (IA) AND SUPPORT TO COMPUTER NETWORK DEFENSE (CND), Enclosure A, paragraph 6.a. and Enclosure C, paragraph 21.h.(7). NIST Special Publication 800-53 (SP 800-53), Rev 4, Control: MP-3 & PE-5(3). DOD Manual 5200.01, Volume 2, 24 February 2012, SUBJECT: DOD Information Security Program: Marking of Classified Information; Enclosure 3, paragraph 13 and figure 11. DOD Manual 5200.01, Volume 3, 24 February 2012, SUBJECT: DOD Information Security Program: Protection of Classified Information; Enclosure 2, paragraph 13. 32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1

ℹ️ Check
Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.)for compliance with the following guidance: Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: - Dated when created - Marked Top and Bottom with the highest classification of any information contained in the document - Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents". TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.

ℹ️ Check

Check any Working Papers, documents and/or Computer Media (CD, tape, flash drive, etc.)for compliance with the following guidance: Working papers are documents and material (includes computer media) accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: - Dated when created - Marked Top and Bottom with the highest classification of any information contained in the document - Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents". TACTICAL ENVIRONMENT APPLICABILITY: If classified working documents are found in a tactical environment they should be marked and handled according to the aforementioned guidance.

✔️ Fix
Ensure that all Working Papers, documents and/or computer media comply with the following guidance: Working papers are documents and material accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: - Dated when created - Marked Top and Bottom with the highest classification of any information contained in the document - Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents".

✔️ Fix

Ensure that all Working Papers, documents and/or computer media comply with the following guidance: Working papers are documents and material accumulated or created in the preparation of finished documents and material. Working papers are marked in the same manner as a finished document at the same classification level when released by the originator outside the originating activity, retained more than 180 days from date of origin (30 days for SAPs), or filed permanently. Working papers containing classified information shall be: - Dated when created - Marked Top and Bottom with the highest classification of any information contained in the document - Annotated "WORKING PAPER" If any Automated Information System (AIS) hard drives or media are found to contain working papers or documents, the automated documents must be marked and handled in the same manner as hard copy documents. If an entire AIS media storage device (tapes, diskettes, flash drives, CDs, DVDs, etc.) contains classified documents or data that are being treated as a working documents - then each individual working document on the media should be marked and handled as detailed above AND the media itself should be marked with the highest classification level, dated and marked "Working Documents".