What is ICD 503?

ICD 503 refers to the Director of Central Intelligence Directive (DCID) 6/3, which has been superseded by Intelligence Community Directive (ICD) 503. ICD 503 outlines the security risk management framework for Intelligence Community (IC) Information Technology (IT) systems. It provides guidance for protecting classified information and IC IT systems throughout their lifecycle. It defines the roles, responsibilities, and processes for authorizing systems to operate, ensuring they meet required security controls, and managing risks associated with their operation. This includes requirements for security planning, assessment, authorization, and continuous monitoring.