(a) Purpose. This subpart sets standards for agency security education and training programs. Implementation of these standards should:

(1) Ensure that all executive branch employees who create, process, or handle classified information have a satisfactory knowledge and understanding of classification, safeguarding, and declassification policies and procedures;

(2) Increase uniformity in the conduct of agency security education and training programs; and

(3) Reduce instances of over-classification or improper classification, improper safeguarding, and inappropriate or inadequate declassification practices.

(b) Responsibility. The senior agency official is responsible for the agency's security education and training program. The senior agency official shall designate agency personnel, as necessary, to assist in carrying out this responsibility.

(c) Approach. Security education and training should be tailored to meet the specific needs of the agency's security program and the specific roles employees are expected to play in that program. The agency official(s) responsible for the program shall determine the means and methods for providing security education and training. Training methods may include briefings, interactive videos, dissemination of instructional materials, on-line presentations, and other media and methods. Each agency shall maintain records about the programs it has offered and employee participation in them.

(d) Frequency. The frequency of agency security education and training will vary in accordance with the needs of the agency's security classification program, subject to the following requirements:

(1) Initial training shall be provided to every person who has met the standards for access to classified information in accordance with section 4.1 of the Order.

(2) Original classification authorities shall receive training in proper classification and declassification prior to originally classifying information and at least once each calendar year thereafter.

(3) Persons who apply derivative classification markings shall receive training in the proper application of the derivative classification principles of the Order prior to derivatively classifying information and at least once every two years.

(4) Each agency shall provide some form of refresher security education and training at least annually for all its personnel who handle or generate classified information.

(a) General. Each department or agency shall establish and maintain a formal security education and training program which provides for initial training, refresher training, specialized training, and termination briefings. This subpart establishes fundamental security education and training standards for original classification authorities, derivative classifiers, declassification authorities, security managers, classification management officers, security specialists, and all other personnel whose duties significantly involve the creation or handling of classified information. Agency officials responsible for the security education and training programs should determine the specific training to be provided according to the agency's program and policy needs.

(b) Initial training. All cleared agency personnel shall receive initial training on basic security policies, principles, practices, and criminal, civil, and administrative penalties. Such training must be provided in conjunction with the granting of a security clearance, and prior to accessing classified information.

(c) Training for original classification authorities. Original classification authorities shall be provided detailed training on proper classification and declassification, with an emphasis on the avoidance of over-classification. At a minimum, the training shall cover classification standards, classification levels, classification authority, classification categories, duration of classification, identification and markings, classification prohibitions and limitations, sanctions, classification challenges, security classification guides, and information sharing.

(1) Personnel shall receive this training prior to originally classifying information.

(2) In addition to this initial training, original classification authorities shall receive training in proper classification and declassification at least once each calendar year.

(3) Original classification authorities who do not receive such mandatory training at least once within a calendar year shall have their classification authority suspended until such training has taken place.

(i) An agency head, deputy agency head, or senior agency official may grant a waiver of this requirement if an individual is unable to receive this training due to unavoidable circumstances. All such waivers shall be documented.

(ii) Whenever such a waiver is granted, the individual shall receive the required training as soon as practicable.

(d) Training for persons who apply derivative classification markings. Persons who apply derivative classification markings shall receive training in the proper application of the derivative classification principles of the Order, emphasizing the avoidance of over-classification. At a minimum, the training shall cover the principles of derivative classification, classification levels, duration of classification, identification and markings, classification prohibitions and limitations, sanctions, classification challenges, security classification guides, and information sharing.

(1) Personnel shall receive this training prior to derivatively classifying information.

(2) In addition to this preparatory training, derivative classifiers shall receive such training at least once every two years.

(3) Derivative classifiers who do not receive such mandatory training at least once every two years shall have their authority to apply derivative classification markings suspended until they have received such training.

(i) An agency head, deputy agency head, or senior agency official may grant a waiver of this requirement if an individual is unable to receive this training due to unavoidable circumstances. All such waivers shall be documented.

(ii) Whenever such a waiver is granted, the individual shall receive the required training as soon as practicable.

(e) Other specialized security education and training. Classification management officers, security managers, security specialists, declassification authorities, and all other personnel whose duties significantly involve the creation or handling of classified information shall receive more detailed or additional training no later than six months after assumption of duties that require other specialized training.

(f) Annual refresher security education and training. Agencies shall provide annual refresher training to employees who create, process, or handle classified information. Annual refresher training should reinforce the policies, principles and procedures covered in initial and specialized training. Annual refresher training should also address identification and handling of other agency-originated information and foreign government information, as well as the threat and the techniques employed by foreign intelligence activities attempting to obtain classified information, and advise personnel of penalties for engaging in espionage activities. Annual refresher training should also address issues or concerns identified during agency self-inspections.

(g) Termination briefings. Except in extraordinary circumstances, each agency shall ensure that each employee who is granted access to classified information and who leaves the service of the agency receives a termination briefing. Also, each agency employee whose clearance is withdrawn or revoked must receive such a briefing. At a minimum, termination briefings must impress upon each employee the continuing responsibility not to disclose any classified information to which the employee had access and the potential penalties for non-compliance, and the obligation to return to the appropriate agency official all classified documents and materials in the employee's possession.

(h) Other security education and training. Agencies are encouraged to develop additional security education and training according to program and policy needs. Such security education and training could include:

(1) Practices applicable to U.S. officials traveling overseas;

(2) Procedures for protecting classified information processed and stored in automated information systems;

(3) Methods for dealing with uncleared personnel who work in proximity to classified information;

(4) Responsibilities of personnel serving as couriers of classified information; and

(5) Security requirements that govern participation in international programs.