ATT0072 DD254 Appendix B- ICD-503.pdf

This document is Intelligence Community Directive (ICD) 503, establishing federal policy for Information Technology Systems Security Risk Management, Certification, and Accreditation within the Intelligence Community, effective September 15, 2008.

The directive mandates that IC elements treat risk management as an essential function integrated into system development lifecycles, requiring balanced consideration of mission requirements, security needs, budget consequences, operational performance, schedule requirements, counterintelligence concerns, civil liberties, and privacy protection. Accreditation decisions must be made by Authorizing Officials (typically agency or element CIOs) or Delegated Authorizing Officials who are government employees with strategic IC understanding and authority to accept defined risk levels for information systems. Security certifications, conducted by appointed Certification Agents, provide the technical security analysis supporting accreditation decisions. The directive establishes three potential impact levels—low, moderate, and high—based on confidentiality, integrity, and availability considerations, with Delegated Authorizing Officials prohibited from accrediting systems where breaches would result in high potential impact. The policy emphasizes reciprocal acceptance of certifications and accreditations across IC elements and from compatible non-IC federal, state, tribal, and non-governmental agencies to promote interoperability and efficiency. Standards for risk management, accreditation processes, certification assessments, system interconnection, and reciprocal acceptance are to be published by the IC CIO, potentially incorporating NIST and Committee on National Security Systems (CNSS) standards. The IC CIO monitors compliance and mediates disputes between elements regarding conflicting accreditation or risk management decisions.