Intelligence Community Directive 503 Summary

This is an Intelligence Community Directive (ICD) establishing policy for information technology systems security risk management, certification, and accreditation across the Intelligence Community (IC), effective September 15, 2008. The directive applies to all IC elements as defined under the National Security Act of 1947, as amended, and other departments or agencies designated by the President or jointly by the Director of National Intelligence and relevant agency heads. The policy implements strategic goals established in January 2007 by the IC Chief Information Officer, DoD Chief Information Officers, Office of Management and Budget, and the National Institute of Standards and Technology to create a holistic and strategic risk management process utilizing common standards and reciprocally accepted certification and accreditation decisions across the IC information technology enterprise.

The directive establishes four primary policy areas: (1) Risk Management—requiring IC elements to consider risk management as an essential function integrated into system development life cycles, weighing operational and economic costs of protective measures against mission requirements while considering mission equities, budget consequences, operational performance, schedule requirements, counterintelligence concerns, civil liberties, and privacy protection; (2) Accreditation—authorizing designated Authorizing Officials and Delegated Authorizing Officials to make official management decisions accepting defined risk levels for information technology systems at particular security levels in specific environments, with accreditation decisions articulating supporting rationale, terms, conditions, and limitations; (3) Certification—requiring comprehensive assessments of management, operational, and technical security controls in information technology systems to support accreditation decisions, conducted by Certification Agents appointed by Authorizing Officials; and (4) Reciprocity and Interconnection—requiring IC elements to accept certifications and accreditations from other IC elements and compatible federal, state, and non-governmental agencies without requiring additional validation, while establishing standards for system interconnections. The directive mandates application of standards published by the IC CIO, which may include standards approved by NIST and the Committee on National Security Systems.