Intelligence Community
Information Technology Systems
Security Risk Management
A. PURPOSE

I. Pursuant to Intelligence Community Directive (ICD) IO I, Section
G. l .b.(3), technical amendments are hereby made to ICD 503, Intelligence
Community Information Technology Systems Security Risk Management,
Certification, and Accreditation.
2. Amendments to this Directive include replacement of legacy
certification and accreditation terminology with current security control
assessment and security authorization terminology. These amendments
are reflected in a change to the title of the Directive, to Intelligence
Community Information Technology Systems Security Risk Management.
The amended ICD also reflects the DNI's designation of the Intelligence
Community Chief Information Officer as the Authorizing Official forIntelligence Community Information Technology Enterprise (IC ITE)
Services and components in EIS 00564, Guiding Principles for
Implementing and Operating in a Common Intelligence Community
Information Technology Enterprise, signed 19 September 2013.
B. EFFECTIVE DATE : The technical amendment to ICD 503 becomes
effective on the date of signature.

As~t~ f§ . ~Intelligence for Policy and Strategy

Intelligence Community
Information Technology Systems
Security Risk Management
A. AUTHORITY: The National Security Act of 1947, as amended; The
Federal Information Security Management Act of 2002, as amended;
Executive Order (EO) 12333, as amended; EO 13231; EO 13526; Directorof National Intelligence (DNI) Memorandum, Guiding Principles for
Implementing and Operating in a Common Intelligence Community
Information Technology Enterprise, 19 September 2013; and otherapplicable provisions of law.
B. PURPOSE: This Intelligence Community Directive (ICD) establishes
Intelligence Community (IC) policy for the information technology
systems security risk management.
I. This Directive implements strategic goals agreed upon in January
2007 by the IC Chief Information Officer (CIO), the Chief lnfom1ation
Officers of the Department of Defense (DoD), the Office of Management
and Budget, and the National Institute of Standards and Technology(NIST). This ICD focuses on a more holistic and strategic process for therisk management of information technology systems, and on processes andprocedures designed to develop trust across the intelligence community
information technology enterprise through the use of common standards
and reciprocally accepted security assessments and authorization .
2. This ICD rescinds and replaces the Director of Central Intelligence
Directive (DCID) 6/3, Protecting Sensitive Compartmented Information
within Information Systems, and the associated DCID 6/3 Manual having
the same title. It also rescinds DCID 6/5, Implementation Manual for theProtection of Certain non-Sensitive Compartmented Information (SCI)
Sources and Methods Information (.~AMI). Appendix E in the DCID 6/3
Manual, Access by Foreign Nationals to Systems Processing Intelligence
Information, shall remain in effect until subsequent issuances supersede it.
C. APPLICABILITY: This ICD applies to the IC, as defined by the
National Security Act of 194 7, as amended, and other departments oragencies that may be designated by the President, or designated jointly by
the DNI and the head of the department or agency concerned, as an
clement of the IC.
D. POLICY
I. Risk Management
a. The principal goal of an IC element's information technology
risk management process shall be to protect the element's ability toperform its mission, not just its information assets. Therefore, IC elements

ICD 503
shall consider risk management an essential management function , and shall ensure that it istightly woven into the system development life cycle.
b. Because risk cannot be eliminated entirely, the risk management process must allow
decision makers to consider the operational and econom ic costs of protective measures weighedagainst requirements for mission accomplishment. For example, a very high level of security
may reduce risk to a very low level, but can be extremely expensive, and may unacceptably
impede essential operations.
(I) In detennining the level of acceptable risk associated with the operation of an
information technology system at a particular level of security, IC elements shall give
appropriate weight to the often competing equities of mission and security requirements, budget
consequences, operational performance efficiencies, schedule requirements, counterintelligenceconcerns, civil liberties and privacy protection, and other relevant policy requirements.
(2) Elements of the IC shall weigh the potential costs of protective measures against
security benefits gained, ensuring that security measures adopted and applied allow mission
capabilities at acceptable risk levels.
(3) Elements of the IC shall consider information sharing and collaboration acrossthe IC and with appropriate foreign partners as essential mission capabilities.
c. Elements of the IC shall determine the level of security required for an information
system by considering the sensitivity of the information contained within the system, and by
evaluating the system's ability to permit information sharing and collaboration across the IC.
(I) An infonnation technology system is a discrete set of information resources
organized for the collection, processing, maintenance, use, sharing, dissemination or dispositionof information.
(2) An item of information technology is any equipment or interconnected system orsubsystem of equipment that is used in the automatic acquisition, storage, manipulation,
management, movement, control, display, switching, interchange, transmission, or reception ofdata or information. The term "information technology" includes computers, anci llaryequipment, software, firmware and similar procedures, services (including support services), andre lated resources.
d. Many IC information systems are interconnected. Therefore, the risk accepted by one
element is efiectively accepted by all, just as security limitations imposed by one are effectively
imposed upon all. To promote interoperability and efficiency across the IC infonnation
technology enterprise, and to provide a sound basis for trust and reciprocal acceptance ofindividual element security assessments and authorization decisions across the enterprise, IC
elements shall apply common standards and follow a common process to manage risk for theirsystems.
e. Elements of the IC shall apply standards for information technology risk management
estab lished, published, issued, and promulgated by the IC CIO. Information technology risk
management standards published, issued, and promulgated for the IC by the IC CIO may include
standards, policies and guidelines approved by either or both NIST and the Committee on
National Security Systems (CNSS).

2

ICD 503
2. Security Authorization
a. Authorization decisions are official management decisions that explicitly accept adefined level of risk associated with the operation of an information technology system at aparticular level of security in a specific environment on behalf of an IC clement.
b. By authorizing an information system, an IC element approves it for operation at aparticular level of security in a particular environment, and thus establishes the level of risk
associated with operating the system and the associated implications for operations, assets, orindividuals.
c. In determining the level of acceptable risk associated with the operation of an
information technology system, IC elements shall make authorization decisions in accordancewith the policy for risk management described in this Directive and in any standards that may besubsequently issued pursuant to the authorities granted herein.
d. Authorization decisions by IC elements shall ensure that risk is mitigated to the extent
possible, commensurate with the sensitivity of the information in a system . Elements shallensure that authorization of their systems permits IC-wide collaboration and information sharing
sufficient to ensure both element and IC-wide mission accomplishment. In authorizing any
system over which it has authority as described below, an element shall accept only theminimum degree ofrisk required to ensure that the information system etlectively supports
mission accomplishment while appropriately protecting the information in the system.
e. The head of each IC element may designate one or more Authorizing Officials to
make authorization decisions on behalf of the clement head. The element head shall retain
ultimate responsibility for all authorization and associated risk management decisions made on
his or her behalf.
(I) An Authorizing Official shall be accountable to the element head for theauthorization and associated risk management decision, for which the element head is ultimately
responsible and accountable.
(2) An Authorizing Official has inherent U.S. Government authority and, as such,must be a government employee.
(3) An Authorizing Official shall have a broad and strategic understanding of the IC
and of his or her particular IC element and its place and role in the overall IC. An Authorizing
Official shall use this knowledge to assign appropriate weight to the often competing equities of
mission and security requirements, budget consequences, operational performance efficiencies,
schedule requirements, counterintelligence concerns, information sharing, civil liberties andprivacy protection, and other relevant policy requirements. Then, in light of these factors, theAuthorizing Official will detem1ine the level of risk deemed acceptable for an authorized system.
(4) An Authorizing Official should normally be the agency or element CIO. For IC
elements without a CIO, an Authorizing Official shall be an executive of sufficient seniority to
execute the decision-making and approval respons ibilities described above on behalf of theclement.
(5) In conformance with the DNI's designation in the DNI Executive
Correspondence, Guiding Principles for Implementing and Operating in a Common Intelligence3

!CD 503
Communizy Inf<Jrmation Technology Enterprise, the IC CIO is the assessing and Authorizing
Official for IC !TE Services and components and provides the framework for security
assessments and authorization decisions for IC ITE, in consultation with Service Providers andaffected IC elements. The IC CIO may delegate this authority to a Service Provider on a caseby-case basis consistent with this Directive.
(6) An IC element Authorizing Official shall, consistent with the designation in
Section D.2.e.(5), make authorization decisions for systems the element funds, operates, ormanages, as well as any operated by the element as an executive agent on behalf of the IC
enterprise.
(7) An Authorizing Official's authorization decision shall aiticulate the supporting
rationale for the decision, provide an explanation of any terms and conditions for theauthorization, and explain any limitations or restrictions imposed on the operation of the systemand the reasons for those limitations or restrictions. An Authorizing Official shall state, in theauthorization decision documentation, whether the system is authorized for operation, authorized
for operation with conditions, or not authorized for operation.
f. An Authorizing Official may appoint one or more Delegated Authorizing Officials to
expedite authorization decisions for designated systems, and provide mission support.
(I) A Delegated Authorizing Official has inherent U.S. Government authority and,as such, must be a government employee.

(2) Like an Authorizing Official, a Delegated Authorizing Official shall have abroad and strategic understanding of the IC and of his or her particular IC element and its place
and role in the overall IC . A Delegated Authorizing Official shall use this knowledge to assign
appropriate weight to the often competing equities of mission and security requirements, budget
consequences, operational performance efficiencies, schedule requirements, counterintelligenceconcerns, civil liberty and privacy protection, and other relevant policy requirements. Then inlight of these factors, the Delegated Authorizing Official will determine the level of risk deemed
acceptable for an authorized system.
g. In detennining which particular infonnation systems may be authorized by aDelegated Authorizing Official, an Authorizing Official shall consider the potential impact onorganizations or individuals should there be a breach of security of a particular system such thata loss of information confidentiality, integrity or availability results.
( 1) Confidentiality means the preservation of authorized restrictions on information
access and disclosure, including means for protecting personal privacy, proprietary information,and classified information. A loss of confidentiality is the unauthorized disclosure of
information.

(2) Integrity means the prevention of improper modification or destruction of
information and includes ensuring information non-repudiation and authenticity. A loss of
integrity is the unauthorized modification or destruction of information.
(3) Availability means ensuring timely and reliable access to and use of information.
A loss of availability is the disruption of access to or use of infonnation in an information
system.

4

!CD 503
h. A Delegated Authorizing Official shall only authorize an information system if the
Authorizing Official detennines that a breach of security of that infonnation system would resultin no more than a low to moderate potential impact on organizations or individuals. In no caseshall a Delegated Authorizing Official make an authorization decision for a system when an
Authorizing Official deems a breach of security of that information system would result in a highpotential impact on organizations or individuals.
(I) The potential impact is low if the loss of confidentiality, integrity or avai !ability
could be expected to have a limited adverse impact on organizational operations, organizational
assets, or individuals. Examples of a limited adverse impact are losses of confidentiality,
integrity or availability that might cause any of the following:(a) a degradation in mission capability to an extent and duration that theorganization is able to perform its primary functions, but the effectiveness of the functions is
noticeably reduced;(b) minor damage to organizational assets;(c) minor financial loss; or(d) minor harm to individuals .
(2) The potential impact is moderate if the loss of confidentiality, integrity oravailability could be expected to have a serious adverse impact on organizational operations,organizational assets, or individuals. Examples of a serious adverse impact are losses ofconfidentiality, integrity, or availability that might cause any of the following:(a) degradation in mission capability to an extent and duration that theorganization is able to perform its primary functions, but effectiveness of the functions is
reduced significantly;(b) significant damage to organizational assets; or(c) significant harm to individuals that does not involve loss of life or serious life
threatening injuries.
(3) The potential impact is high if the loss of confidentiality, integrity, or availability
could be expected to have a severe or catastrophic adverse impact on organizational operations,organizational assets, or individuals. Examples of a severe or catastrophic adverse impact arelosses of confidentiality, integrity, or availability that might cause any of the following :(a) degradation in mission capability to an extent and duration that theorganization is not able to perfom1 one or more of its primary functions;(b) major damage to organizational assets;(c) major financial loss; or(d) significant harm to individuals involving loss of life or serious life
threatening injuries.
i. Elements of the IC shall provide appropriate authorization decision documentation to
IC and DoD elements, if requested, to support reciprocity and re-use.

5

ICD 503
j. Elements of the IC shall establish a formally-defined stake-holder appeal process toresolve any conflicts resulting from Authorizing Official or Delegated Authorizing Official
decisions. Such conflicts might include disagreements on the competing equities of mission andsecurity requirements, budget consequences, operational performance efficiencies, schedulerequirements, counterintelligence concerns, civil liberty and privacy protection, and otherrelevant policy requirements.
k. Elements of the IC shall apply standards for authorization processes and decisions,
including impact levels that may be determined in addition to those discussed above, as may be
published, issued, and promulgated by the IC CIO in the future . Information technology
authorization process and decision standards published, issued, and promulgated for the IC by
the IC CIO may include standards, policies and guidelines approved by either or both NIST and
CNSS .
3. Security Assessment
a. A security assessment is the required comprehensive assessment of the management,
operational and technical security controls in an infonnation technology system, or for aparticular item of information technology, made in support of authorization decisions.
b. A security assessment shall provide the essential information technology systems
security analysis needed to make a credible, risk-based decision on whether to authorize
operation of the information system or of an item of information technology (that is, upon which
to make the authorization decision).
c. A security assessment shall serve as the information technology systems security
portion of the factors, equities and concerns upon which an Authorizing Official or DelegatedAuthorizing Official shall base an authorization decision, thereby appropriately accepting risk inaccordance with the policies set forth by this Directive.
d. An Authorizing Official shall appoint a Security Assessor to act on his or her behalf
to conduct a security assessment. A Security Assessor may not also be an Authorizing Official
or a Delegated Authorizing Official.
e. The Authorizing Official or Delegated Authorizing Official shall use the results of the
security assessment as input to the authorization decision.
f. A Security Assessor may not approve an authorization decision on behalf of an
Authorizing Official or a Delegated Authorizing Official.
g. Elements of the IC shall apply standards for security assessment, testing, process andreporting published, issued and promulgated by the IC CIO. Information technology security
assessment standards published, issued and promulgated for the IC by the IC CIO may include
standards, policies and guidelines approved by either or both NIST and CNSS .
4. Reciprocity
a. Elements of the IC shall make appropriate authorization decision documentation
available to other IC elements, and to the non-IC parts of the DoD generally, its Military
Departments, Combatant Commands and Defense Agencies, and also to non-IC agencies of theFederal Government.

6

!CD 503
b. Authorizing Officials of IC elements shall make appropriate security assessment
documentation of an information technology system or other item of information technology
available to other IC elements, to the non-IC parts of the DoD generally, its Military
Departments, Combatant Commands and Defense Agencies, and to other non-IC agencies of theFederal Government.
c. An IC element shall accept the security assessment of a system or other item of
information technology by another IC element without requiring or requesting any additional
validation or verification testing of the system or item of information technology.
(I) Elements of the IC shall test only the configuration differences introduced byusing the system or item of information technology in a new or different environment.
(2) Authorizing Officials and Delegated Authorizing Officials of IC elements shallconsider the original IC element security assessment when making the authorization decision for
placing a system or item of information technology of another IC element into operation as a
new or additional part of any system for which the Authorizing Official or DelegatedAuthorizing Official exercises authorization authority.
d. Elements of the IC shall accept a security assessment of an information system or of
an item of information technology of any non-IC agency of the Federal Government, or of astate, tribal or non-governmental agency, organization, or contractor, if that security assessment
is based on standards compatible with those established for the IC in accordance with thisDirective (such as, for example, either or both NIST and CNSS standards issued fr)r the IC by the
IC CIO pursuant to the authority granted in this Directive), without requiring or requesting any
additional validation or verification testing of the system or item of information technology.
(I) Elements of the IC may test only the configuration differences introduced byusing the system or the item in a new environment.
(2) IC element Authorizing Officials and Delegated Authorizing Officials shallconsider the original agency, state, tribal or non-governmental agency, organization, or
contractor security assessment when making the authorization decision for placing a system oritem of information technology of a non-IC system into operation as part of a new or additional
system for which the Authorizing Official or Delegated Authorizing Official exercises
authorization authority, if that security assessment is based on standards compatible with thoseestablished for the IC in accordance with this Directive (such as, for example, either or both
NIST and CNSS standards issued for the IC by the IC CIO pursuant to the authority granted inthis Directive).
e. All IC elements shall accept authorization decisions granted by the Commonwealth/5Eyes Partners (Australia, Canada, New Zealand, United Kingdom) for their respective sovereign
information technology systems or items of information technology that store, process, and/or
communicate national intelligence infonnation provided by the U.S . Government.
5. Interconnection
a. Elements of the IC shall perm it interconnections of authorized information
technology systems with the authorized systems of other IC elements in accordance withstandards for system interconnection published, issued and promulgated by the IC CIO.

7

ICD 503
Infonnation technology system interconnection standards published, issued, and promulgated forthe IC by the IC CIO may include standards, policies and guidelines approved by either or both
NIST and CNSS.
b. Elements of the IC may permit interconnection of authorized information technology
systems with the information technology systems of U.S. Government, state, tribal and nongovernmental agencies, organizations, entities, contractors and elements outside of the IC inaccordance with standards for system interconnection published, issued, and promulgated by the
IC CIO. Infornrntion technology system interconnection standards published, issued, andpromulgated for the IC by the IC CIO may include standards, policies and guidelines approvedby either or both NIST and CNSS.
c. Standards for interconnection established in accordance with paragraph 5.a. and b.
above may require the use of an interconnection security agreement. The interconnection
security agreement is a security document that defines the technical and security requirements
for establishing, operating and maintaining the connection. The IC CIO shall identify thestandards required in an interconnection security agreement, if required by applicable standards.
d. The IC CIO shall identify and define the guidelines and standards for connecting IC
systems to systems operated by Commonwealth Partners, and shall update guidelines andstandards at intervals appropriate for that purpose.
e. The IC CIO shall identify and define the guidelines and standards for connecting IC
systems to systems operated by foreign nationals other than Commonwealth Partners, and shallupdate guidelines and standards, at intervals appropriate for that purpose.
6. Governance and Dispute Resolution
a. The IC CIO shall monitor IC element compliance with this Directive to ensure thatclements appropriately assess and authorize systems within acceptable levels of community risk.
b. In the event an IC element finds that the reciprocal acceptance of an interconnection
decision, a risk management decision or a security assessment of another IC element creates adegree of risk or imposes a level of security that results in unacceptable or incompatible
consequences either for that element, or for the IC as a whole, the concerned element
Authorizing Official shall refer the matter to the IC CIO.
(I) The IC CIO shall mediate the matter and, if unresolved, make recommendations
to the IC element heads.

(2) In making this recommendation, the IC CIO shall give appropriate weight to theoften competing equities of mission and security requirements, budget consequences, operational
performance efficiencies, schedule requirements, counterintelligence concerns, information
sharing, civil liberties and privacy protection, and other relevant policy requirements, andbalance risk in accordance with this Directive.
E. EFFECTIVE DATE: This ICD becomes effective on the date of signature. IC elements
may continue to operate systems and items of infonnation technology currently assessed andauthorized under pre-existing policies, guidelines and standards. Any security assessment,
reassessment, authorization or reauthorization of existing assessed and authorized systems or
items of information technology undertaken after the date of signature must, however, be

8ICD 503
accomplished in accordance with the policies set forth in this Directive. Any information
systems or items of information technology placed into service after the date of signature shall beassessed and authorized in accordance with the policies set forth in this Directive.

Signed//J.M. McConnell
Director of National Intelligence

15 September 2008
Date

9

ICD 503
APPENDIX A - ACRONYMS

ICD 503 - INTELLIGENC E COMMUNITY INFORMATION T ECHNOLOGY SYSTEMSSEC URITY RISK MANAGEM ENT

CIO

Chief Information Officer

CNSS
DC ll)

Committee on National Security Systems

DoD

Department of Defense

EO

Executive Order

ICIntelligence Community

ICD
NIST

Intelligence Community Directive

SCI

Director of Central Intelligence Directive

National Institute of Standards and Technology
Sensitive Compartmented Information

10