# Reciprocity (Information Assurance) **Entity class:** Cross-organizational assurance practice ## Definition **Reciprocity** is one organization's acceptance and reuse of another organization's security or privacy assessment and authorization evidence when the standards, scope, environment, and risk decisions are sufficiently compatible. It reduces duplicative adjudication and speeds interconnection. Reciprocity is bounded. ICD 503 explicitly states that reciprocal acceptance of assessments and authorization decisions does not confer data reciprocity. ## Relationships - **depends on:** [[wiki/Unified Federal Information Security Framework|common frameworks]] and [[wiki/Machine-Readable Assurance|machine-readable evidence]]. - **reuses:** [[wiki/Authorization to Operate|authorization]] and control-assessment evidence. - **enables:** [[wiki/Federated Trust Fabric|Federated Trust Fabric]]. - **IC policy:** [[wiki/ICD 503|ICD 503]]. ## Sources / Provenance - [ODNI — ICD 503](https://www.dni.gov/files/documents/ICD/ICD-503.pdf)