# ICD 503 **Entity class:** Intelligence Community directive ## Definition **Intelligence Community Directive 503**, *Intelligence Community Information Environment Risk Management*, establishes risk-management policy for the IC Information Environment. It requires an RMF promoting security, privacy, interoperability, and efficiency and establishes a basis for trust and reciprocal acceptance of security and privacy assessments and authorization decisions. ICD 503 states that reciprocal acceptance of assessments and authorization decisions does **not** confer data reciprocity. One element's authorization therefore does not automatically entitle another element to its data. ## Relationships - **issued by:** [[wiki/Office of the Director of National Intelligence|ODNI]]. - **governs:** [[wiki/Intelligence Community Information Environment|IC Information Environment]]. - **uses:** [[wiki/Risk Management Framework|RMF]], [[wiki/Authorization to Operate|ATO]], [[wiki/Continuous Monitoring|continuous monitoring]], and [[wiki/Reciprocity (Information Assurance)|reciprocity]]. - **control foundation:** [[wiki/NIST SP 800-53|NIST SP 800-53]] and [[wiki/CNSSI 1253|CNSSI 1253]]. ## Sources / Provenance - [ODNI — ICD 503](https://www.dni.gov/files/documents/ICD/ICD-503.pdf)