IC_Policy Guidance_500_2.pdf

INTELLIGENCE COMMUNITY POLICY GUIDANCE

NUMBER 500.2

ATTRIBUTE-BASED AUTHORIZATION AND ACCESS MANAGEMENT

(EFFECTIVE: 23 NOVEMBER 2010)

ICPG 500.2

A. AUTHORITY: The National Security Act of 1947, as amended; Executive Order 12333, as amended; and other applicable provisions of law .

B. PURPOSE: This Intelligence Community Policy Guidance establishes that attributes shall be used by Intelligence Community (IC) elements to authorize and manage access by personnel or processes to information resources in the information environment. This Guidance also addresses the management and protection of attributes .

C. APPLICABILITY: This Guidance applies to the IC, as defined by the National Security Act of 1947, as amended ; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the IC .

D. DEFINITIONS

1 . Information resources are defined as "information and related resources, such as personnel, equipment, funds, and information technology ."'

2. Information environment is defined as the "aggregate of individuals, organizations, and/or systems that collect, process, or disseminate information, also included is the information itself." 2

3 . Attributes are distinct characteristics of an object or subject .

a. An object is a "passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information . Access to an object implies access to the information it contains ." 3

~ Committee on National Security Systems Instruction No . 4009, National Information Assurance Glossary z lbfd Ibid

ICPG 500.2

b. A subject is an active entity (generally an individual, process, or device) that causes information to flow among objects or changes the system state . 4

E. POLICY

1 . The Assistant Director of National Intelligence and Chief Information Officer (IC CIO) shall issue IC Standards) regarding the identification and maintenance of attributes .

2. IC elements shall implement and maintain attributes in accordance with IC Standards) issued by the ADNUIC CIO .

3 . IC elements shall use attributes to authorize and manage access by personnel or processes to information resources in the information environment .

4 . IC elements shall ensure attributes are :

a. Used by information resources to control access to information by personnel or processes ;

b. Attributable to a person or process ;

c . Derived from authoritative sources ;

d. Readily accessible ;

e . Maintained for accuracy and currency ;

f. Compatible with Department of Defense and other United States Government formats, to the maximum extent practicable ;

g. Managed via an integrated lifecycle approach ; and

h. Supportive of Che requirements of IC Directive 501, Discovery anti Dissemination or

Retrieval of Information within the Intelligence Community .

5. IC elements shall manage, audit, and protect information resources where attributes are collected, processed, developed, stored, maintained, or disseminated, in accordance with IC Standards) issued by the IC CIO .

E. EFFECTIVE DATE : This Guidance becomes effective on Che date of signature .

Assistant Director of National Intelligence

Date for Policy & Strategy

' Ibid

~ `~ ~ fg~r~,,~~t 2d ~ a