DHS Classified National Security Information Rules
Legal Authority
- 5 U.S.C. § 301 — Agency housekeeping authority: general statutory authority for agencies to prescribe rules for internal organization and procedures; basis for DHS's authority to promulgate 6 CFR Part 7 governing its classified information program
- Executive Order 13526 (signed December 29, 2009): the President's governing order for classification and declassification of national security information throughout the executive branch; DHS Part 7 implements E.O. 13526 at the departmental level
- Executive Order 13549 — Classified National Security Information Program for State, Local, Tribal, and Private Sector Entities: governs DHS's sharing of classified information with non-federal partners including state fusion centers
- Executive Order 12829 — National Industrial Security Program: governs classified information shared with private contractors; DHS Part 7 does not apply to contractors (they fall under E.O. 12829 and NISP)
- 6 CFR Part 7 — DHS regulations implementing E.O. 13526 for DHS components and employees
Key Mechanics
DHS's classification system is managed by the Chief Security Officer (CSO), who oversees classification authority, training, annual self-assessments, and mandatory declassification reviews. Original classification authority flows downward from the Secretary; the Secretary can classify at the Top Secret level, the CSO can classify at all levels, and other DHS officials may be granted derivative classification authority (the ability to carry forward existing classification to new documents). The 25-year automatic declassification rule is the most consequential provision for historical records: DHS must request ISCAP exemptions for records it wishes to keep classified beyond 25 years, and those requests must be filed at least one year in advance.
Current Rule (2026)
| Parameter | Value |
|---|---|
| Citation | 6 CFR Part 7 |
| Issuing agency | Office of the Secretary of Homeland Security |
| Statutory authority | 5 U.S.C. § 301 (agency housekeeping authority) |
| Executive Order authority | E.O. 13526 (classification); E.O. 13549 (state/local sharing); E.O. 12829 (industrial security) |
| Last major amendment | No recent Federal Register amendments |
What This Rule Does
When the Department of Homeland Security handles classified national security information — Top Secret, Secret, or Confidential — it must follow structured rules for who can classify it, how long it stays secret, how it gets declassified, and what happens when something goes wrong. Six CFR Part 7 is DHS's internal implementation of Executive Order 13526, which is the president's standing order governing how the executive branch manages classified information.
The rules assign primary responsibility to the DHS Chief Security Officer (CSO), who oversees the entire classification program. Every DHS component (CBP, ICE, TSA, FEMA, USCIS, etc.) must name its own security officer or liaison to carry these rules out day to day. The rules also govern how DHS handles classified information in court proceedings, how employees can challenge classification decisions they think are wrong, and how the public can request mandatory declassification review.
This Part does not apply to private contractors or grantees — they fall under E.O. 12829 and the National Industrial Security Program. It also does not override CIA or DNI authority over intelligence sources and methods under the National Security Act.
Key Provisions
- § 7.10 — Chief Security Officer runs the DHS classification program; must run annual self-assessments, suspend access for training failures, report to ISOO, and manage sharing with state/local/tribal partners
- § 7.11 — Each component must designate a security officer; track who really needs access; report violations to the CSO
- § 7.12 — Employees who lose, expose, or mishandle classified material face reprimands, pay suspension, loss of classification authority, or removal of access
- § 7.13 — Subpoenas or court orders for classified material must go immediately to the DHS General Counsel; follow Classified Information Procedures Act (CIPA) in federal criminal cases
- § 7.20 — Only the Secretary (or designated officials) can originally classify Top Secret; the CSO can classify up to Top Secret; classifiers cannot re-delegate; training must be completed within 60 days and annually
- § 7.21 — Four tests must all be met to classify: authorized person, government-owned information, fits E.O. 13526 § 1.4 categories, and unauthorized disclosure would cause identifiable national security damage; doubt → don't classify; doubt about level → use lower level
- § 7.22 — If immediate classification is needed and no authorized classifier is available, protect it and forward within 5 working days; the authorized classifier must rule within 30 days
- § 7.23 — Senior DHS officials may share classified information with unauthorized individuals only when there is an imminent threat to life or homeland defense; must notify CSO within 72 hours (no later than 7 days); sharing does not declassify the material
- § 7.24 — Classification duration must be set at marking time; target 10 years or less; maximum 25 years for original classification; confidential human sources and WMD design concepts may be exempt
- § 7.25 — Classified material must be marked so classification is obvious; foreign government material must keep original markings or receive equivalent U.S. classification
- § 7.26 — Derivative classification (copying or paraphrasing classified material into new documents) requires training every two years; authority suspended for missed training
- § 7.27 — Declassify as soon as the need for protection ends; if public interest may outweigh protection, refer to the CSO, who recommends to the Secretary
- § 7.28 — Records over 25 years old with permanent historical value automatically declassify on December 31 of that year unless DHS requests an exemption through ISCAP at least one year in advance
- § 7.29 — DHS must support the National Archives' National Declassification Center; CSO provides classification guides with ISCAP-approved exemptions
- § 7.31 — Any authorized holder who believes information is wrongly classified may challenge it in writing; the original classifier must respond within 60 days; unresolved challenges can go to the Interagency Security Classification Appeals Panel
- § 7.32 — Any individual (not foreign governments) may request mandatory declassification review by writing to the DHS Privacy Office; DHS must respond within one year
How It Affects You
Most people will not directly interact with 6 CFR Part 7 — it governs DHS's internal procedures, not the public directly. But it matters in several indirect ways:
If you receive classified information in an emergency, a DHS official using the emergency-release provision in § 7.23 must have you sign a non-disclosure agreement and must notify the CSO within 72 hours. The information does not become public just because it was shared with you.
If you're a journalist, researcher, or FOIA requester seeking DHS records, § 7.32 gives you the right to ask DHS to review specific classified documents for possible declassification — even if you can't get them under FOIA. DHS must act within one year. If DHS denies you, you can appeal to ISCAP.
If you're a DHS employee, missing a required security training can result in suspended classification authority (§ 7.20, § 7.26). You are expected — and in some cases legally required — to challenge classification decisions you believe are wrong (§ 7.31). Employees who mishandle classified information can face suspension without pay or removal of access (§ 7.12).
If you're litigating against DHS, courts cannot freely compel production of classified records. DHS must notify the General Counsel and follow the Classified Information Procedures Act (§ 7.13).
Statutory Authority
This rule implements:
- 5 U.S.C. § 301 — General authority for executive agencies to make internal rules governing agency organization and procedure
- Executive Order 13526 — Presidential order governing the classification, safeguarding, and declassification of national security information across the executive branch
- Executive Order 13549 — Classified national security information sharing with state, local, tribal, and private sector partners
Recent Rulemakings
No major amendments reported in the Federal Register. The rule implements E.O. 13526, which was signed by President Obama in 2009 and remains the governing classification order.