The system of designating information as confidential, secret, top secret and so on is indeed established by an executive order (EO 12356) however, one should a

The system of designating information as confidential, secret, top secret and so on is indeed established by an executive order (EO 12356) however, one should actually read 12356 because it isn't as simple as "has ultimate control." Even within the EO framework, some co-ordination with the NSC is required. Additionally, the law (Espionage Act etc) doesn't speak to classification and names, very broadly: "Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer" edit: I quoted the wrong statute.