ICD 703, explained

Intelligence Community Directive (ICD) 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information, is the 6-page directive in which the Director of National Intelligence (DNI) states how classified national intelligence (CNI) and its most protected subset, sensitive compartmented information (SCI), are to be kept from unauthorized disclosure. It is dated June 21, 2013. The directive is short on mechanics and long on pointers: it defines the 2 terms, states 8 policy statements, and then sends the reader to ICD 704 for who may hold SCI, ICD 705 for where it may be used, ICD 503 for the systems that process it, and ICD 710 for how it is marked. This post reads the directive section by section and follows each pointer far enough to show what the rule is.

What ICD 703 says and where its authority comes from

Section A of ICD 703 cites the National Security Act of 1947, Executive Orders 12333, 13526, 13549, 12829, and 12968, and 32 CFR Parts 2001, 2003, and 2004. The National Security Act makes the DNI responsible for protecting intelligence sources and methods and for setting uniform standards for granting SCI access to officers, employees, and contractors of any agency. Executive Order 13526, signed December 29, 2009, governs classified national security information generally; its Section 6.2(b) lets the DNI issue implementing directives for protecting intelligence information. And under the Atomic Energy Act and 32 CFR 2001.24, the Secretary of Energy and the DNI jointly decide what information about other nations' atomic energy programs is safeguarded as classified.

Section B states the purpose in 1 sentence: the directive "establishes policy for the protection of classified national intelligence, including SCI." It then lists what it replaced: Director of Central Intelligence Directive (DCID) 1/20P on travel of personnel with SCI access, DCID 6/1, Security Policy for Sensitive Compartmented Information and its Security Policy Manual, Sections V and VI of DCID 6/6, and IC Policy Memorandum 2006-700-8, which modified the DCID 6/1 Supplement titled Security Policy Manual for SCI Control Systems, all to be rescinded once the standards ordered in Section G.1.a.1 were issued.

Section C sets 3 limits on scope. The directive applies to the Intelligence Community (IC) and any element designated part of it. It applies only to information classified under EO 13526 Section 1.4(c), the category for intelligence activities, sources, and methods, and cryptology. And it applies to the handling of SCI by any individual who receives, handles, stores, or processes it, including executive departments and agencies, the Executive Office of the President, the legislative and judicial branches, and all other U.S. entities as defined in EO 13526 Section 6.1(ss). That third sentence is what makes ICD 703 relevant to a congressional committee, a court, or a contractor.

Classified national intelligence versus SCI

Section D holds the 2 definitions. Classified National Intelligence is national intelligence as defined in 50 U.S.C. 401a(5), classified pursuant to EO 13526. Sensitive Compartmented Information is "a subset of CNI" concerning or derived from intelligence sources, methods, or analytical processes that is required to be protected within formal access control systems established by the DNI. The NIST glossary carries the same definition, citing ICD 703 through CNSSI 4009.

Two things follow from the definitions. First, SCI is not a classification level. EO 13526 Section 1.2 allows exactly 3 levels, Top Secret, Secret, and Confidential, and forbids any other term for classified information. SCI is an access control layered on top of a level; a document can be Secret and SCI, or Top Secret and not SCI. Second, what makes information SCI is the DNI's decision to protect it within a formal access control system, not the sensitivity of the content by itself. The directive does not name the control systems. Their names and markings live in the Controlled Access Program Coordination Office (CAPCO) Register and Manual, which ICD 710 Section D.1.b says shall include all markings authorized for use with intelligence information, including those that communicate controlled access programs. ICD 703 inherits the DCID 6/1 Supplement's phrase "SCI Control Systems" only in the list of documents it replaces.

The relationship to special access programs is set by the executive order rather than the directive. EO 13526 Section 4.3 lets the DNI create special access programs pertaining to intelligence sources, methods, and activities, and 32 CFR 2001.49 says safeguarding may be enhanced for information in one. ICD 703 does not use the phrase; it works through the DNI's access control systems.

The 8 policy statements

Section E of ICD 703 states the policy in 8 numbered paragraphs.

1. CNI, including SCI, shall be protected from unauthorized disclosure "to protect the people, mission, capabilities, and information of the IC."
2. Protection is achieved through disciplined adherence to 5 things: proper original classification decisions; proper derivative classification and control markings under ICD 710 and the IC standards on machine-readable markings; the DNI's declassification guidance; national, IC, and element policies; and self-inspections and reviews by the Information Security Oversight Office and the Office of the DNI.
3. Protection is also achieved through counterintelligence and security practices in 3 disciplines: personnel security under ICD 704, physical security under ICD 705, and information assurance under ICD 503, Information Technology Systems Security Risk Management, Certification and Accreditation.
4. The protection measures are the responsibility of any entity that receives, handles, stores, or processes CNI, including the executive, legislative, and judicial branches and state, local, tribal, and private sector (SLTPS) entities under EO 13549.
5. Contractors, contract employees, licensees, and grantees may be granted SCI access under EO 12829, the National Industrial Security Program, and the requirements of EO 13526 Section 4.1(a), ICD 704, and other DNI guidance.
6. Consistent with 32 CFR 2004.22(c)(4)(ii), the DNI must concur on National Interest Determinations (NID) involving SCI.
7. Protection requirements shall be implemented in a manner that facilitates responsible sharing and appropriate dissemination.
8. An IC element that is an authorized recipient of CNI created before EO 13526 was implemented on June 28, 2010, and that bears no restrictive control marking, may use it in its own products and disseminate them within the executive branch if the intelligence has been sanitized of all references and inferences to sources, methods, activities, and the producing agency, or if the originator has consented. Where there is any doubt, the recipient consults the originator first.

The eighth statement is the one ICD 710 cites back. ICD 710 Section D.1.e.(2) says classified intelligence information created before June 28, 2010 without an originator-control marking shall not be further disseminated without the originator's approval unless the originating element waived the requirement or the conditions in ICD 703 Section E.8 have been met. The 2 directives, issued the same day, were written to interlock.

Personnel security: ICD 704 eligibility and the duties that come with access

ICD 703 does not say who is eligible for SCI. It says, in Section E.3.a, that persons determined eligible and granted access "in accordance with ICD 704" incur a special and continuing security obligation. ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information, in the technically amended version of June 20, 2018, supplies the standards. The DNI establishes eligibility standards and delegates the authority to grant access to heads of IC elements, who may further delegate it to their Cognizant Security Authority (CSA). Threshold criteria are U.S. citizenship; stability, trustworthiness, reliability, discretion, excellent character, sound judgment, and unquestioned loyalty; and no immediate family subject to duress by a foreign power. Investigations follow ICPG 704.1, adjudication follows Security Executive Agent Directive 4, and determinations are recorded in the Scattered Castles repository, the authoritative source for SCI access verification. Temporary access is allowed only in emergencies or exceptional circumstances and may not exceed 1 year.

ICD 703 then adds the duties. A person with SCI access must be aware of foreign intelligence and terrorist risks at home and abroad and of the security environment in the workplace, and must report to the CSA, as defined in ICS 700-1, any active or planned involvement in activities that may threaten CNI. That includes reporting unofficial close and continuing, or suspicious, contact with foreign nationals, though casual contact need not be reported; reporting, getting prior approval for, and receiving defensive briefings on unofficial foreign travel, with the CSA able to set conditions under which approval is not needed; and any other reporting the CSA requires. Section G.4 restates the individual's 4 obligations: a favorable determination before access, compliance with nondisclosure agreements required by EO 13526 Section 4.1 and 32 CFR 2001.80, compliance with CSA reporting requirements, and continued awareness of the risks.

EO 13526 Section 4.1(a) is the floor under all of this: access requires a favorable eligibility determination, a signed nondisclosure agreement, and a need to know. 32 CFR 2001.80 prescribes the Standard Form 312 as that agreement, waivable only by the DNI as Security Executive Agent. ICD 703 Section G.2.b requires IC element heads to ensure recipients sign approved SCI or other nondisclosure agreements covering protection, handling, accountability, storage, dissemination, and destruction.

Physical security and information systems: SCI inside the SCIF

The directive answers the question of where SCI may be in 1 sentence. Section E.3.b says that with regard to physical security, all SCI "must be processed, stored, used, or discussed in accordance with ICD 705." ICD 705 Section D.1 completes the thought: all SCI must be processed, stored, used, or discussed in an accredited SCIF, and Section D.3 says a SCIF must be accredited before use. ICD 703 therefore contains no rule for SCI outside a SCIF in ordinary operations, because the rule it adopts does not allow one. The physical standards, ICS 705-1 and ICS 705-2 and the IC Tech Spec, are covered in ICD 705, explained, and the facility itself in What is a SCIF.

Section E.3.c does the same for systems: all SCI must be processed, stored, and communicated in accordance with ICD 503. Section G.1.d adds the IC Chief Information Officer's duties, to issue standards and technical specifications implementing EO 13526 within the IC Information Technology Environment for classification, access, and dissemination, and to establish integrated defense and security controls under ICD 502 and ICD 503. 32 CFR 2001.50 is the government-wide counterpart: each agency head ensures that classified information electronically accessed, processed, stored, or transmitted is protected under Committee on National Security Systems issuances and ICD 503.

The directive does carve out one departure. Section F.4 allows emergency disclosure or release to U.S. recipients as a deviation from the normal practices when necessary to respond to an imminent threat to life or in defense of the homeland. An IC element head or designee may disclose CNI, including SCI, to U.S. individuals not otherwise eligible for access when the disclosure is limited to the duration of the emergency and the people who need it, there is insufficient time, generally less than 12 hours, to use normal channels, the information has been sanitized as far as practical, and the amount disclosed and the number of recipients are minimized. Section F.5 says the information remains classified regardless, and the disclosure is reported to the originator within 24 hours or as soon as the emergency permits. 32 CFR 2001.52 has the parallel emergency authority for classified information generally.

Marking and handling under ICD 710

ICD 703 requires markings twice. Section E.2.b lists proper use of derivative classification and control markings under ICD 710 among the 5 disciplines of protection. Section F.2 says that for U.S. recipients, protection and dissemination of CNI, including SCI, is managed through 3 things: the need-to-know of an appropriately cleared recipient, the proper application of classification and control markings as defined in ICD 710 and the CAPCO Register and Manual, and the security controls established under the directive and its standards.

ICD 710, Classification Management and Control Markings System, also dated June 21, 2013, is where the marking rules sit. Standardized classification and control markings are "the primary means by which the IC protects intelligence sources, methods, and activities." The CAPCO Register and Manual holds every authorized marking and the information each one communicates: classification type and level, controlled access programs, foreign government information, dissemination controls, disclosure and release determinations, and other warnings. Control markings are carried forward to any new format or medium unless the originator consents otherwise. Every portion of a document, including the title and metadata, is marked at the beginning to show its classification and control markings. Information on networks conforms to EO 13526 and 32 CFR Part 2001 for electronic marking and to the IC standards on machine-readable markings, and the lowest appropriate classification and least restrictive controls are applied to maximize dissemination.

Two other handling rules are easy to miss. Section F.1 says CNI, including SCI, shall be discoverable under ICD 501, and Section F.3 says foreign disclosure and release follow ICD 403. Section F.7 then makes each IC element that grants SCI access responsible for the compliance of everyone it has cleared.

Who does what: the DNI, IC element heads, CSAs, and individuals

Section G divides the work among 4 parties. The DNI acts through 4 offices. Through the National Counterintelligence Executive (the technically amended ICD 705 now assigns these security functions to the Director of the National Counterintelligence and Security Center), the DNI was to issue standards within 120 days covering reporting requirements for individuals with access, safeguarding procedures such as indoctrination, debriefing, and the role of Special Security Officers, procedures for sharing with entities outside the IC, and procedures for DNI concurrence on NIDs, which the office processes within 30 days. Through the Assistant DNI for Partner Engagement and the IC Information Sharing Executive, the DNI resolves sharing disputes with foreign and U.S. recipients. Through the IC Chief Information Officer, the DNI issues the IC ITE standards described above.

Heads of IC elements have 5 duties. They ensure access to SCI by each employee is in accordance with EO 12968 Section 1.2(c). They ensure intended recipients sign approved nondisclosure agreements. They designate a CSA for their element as the authority for all aspects of security program management, in accordance with ICD 700, Protection of National Intelligence, which in its June 7, 2012 version requires every IC element head to designate a CSA and lets the CSA delegate within the element. They submit NID concurrence requests to the National Counterintelligence Executive under 32 CFR 2004 before giving contractors SCI access on new contract requirements, including pre-contract activities. And they coordinate with the Department of Energy on Atomic Energy Act information.

CSAs may designate additional personnel to implement the directive and may issue guidance for their element and any additional parties they are responsible for, consistent with ICD 703, adding requirements for the protection of CNI and SCI. Individuals with access have the 4 obligations described earlier. ICD 700 frames the whole arrangement: it says counterintelligence and security are interdependent disciplines that shall be integrated, to the extent practicable, to protect national intelligence, and it assigns the National Counterintelligence Executive to develop and promulgate IC counterintelligence and security standards that implement IC counterintelligence and security policies.

SCI outside the Intelligence Community

ICD 703 is written to follow SCI wherever it goes. Section C.3 applies the directive to the handling of SCI by anyone who handles it in the legislative and judicial branches and across the executive branch, and Section E.4 makes the protection measures the responsibility of SLTPS entities under EO 13549. Section F.6 supplies the mechanism for bodies that have no security apparatus of their own: the Director of the Central Intelligence Agency provides SCI access determinations and SCIF accreditation for the legislative and judicial branches and for executive departments and agencies outside the IC that have no designated CSA or delegated authority, and may delegate this in writing.

Contractors reach SCI through 2 doors, both named in the directive. The first is EO 12829, the National Industrial Security Program, and its rule at 32 CFR 117.23, which says national intelligence is under the jurisdiction and control of the DNI and that contractors "will follow Intelligence Community directives, policy guidance, standards, and specifications" for classified national intelligence and SCI. The second is the NID. Section E.6 and Section G.2.d together mean that an IC element must obtain the DNI's concurrence before a contractor operating under a special security agreement to mitigate foreign ownership, control, or influence receives SCI, and must ask before giving that access, pre-contract activities included. The current rule, 32 CFR 2004.34(h), has the cognizant security agency ask ODNI to concur for SCI.

What ICD 703 does not do is relax any requirement for these outside holders. The same ICD 704 eligibility, accredited SCIF under ICD 705, ICD 503 systems, and ICD 710 markings apply to a committee staffer, a court, or a cleared contractor as to an IC employee.

What to check

• Whether the information is SCI at all, meaning the DNI has placed it in a formal access control system and it carries the corresponding CAPCO marking, or is classified national intelligence protected at its level without the compartment.
• Whether every person who will hold it has a favorable ICD 704 determination recorded in Scattered Castles, a signed nondisclosure agreement, and a need to know.
• Whether the space and the system it will be used in are an accredited SCIF under ICD 705 and an accredited system under ICD 503.
• Whether any contractor on the effort is under foreign ownership, control, or influence mitigated by a special security agreement, which requires a national interest determination with DNI concurrence before SCI access, including during pre-contract work.
• Whether legacy intelligence dated before June 28, 2010 without an originator-control marking is being reused, which under ICD 703 Section E.8 requires sanitization or originator consent.
• Who the Cognizant Security Authority is for the element that granted access, since ICD 703 makes that element responsible for the compliance of everyone it cleared.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is ICD 703?

Intelligence Community Directive 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information, is a 6-page directive from the Director of National Intelligence dated June 21, 2013. It establishes policy for protecting classified national intelligence and SCI, defines both terms, lists the disciplines that protection rests on, and assigns duties to the DNI, heads of IC elements, Cognizant Security Authorities, and individuals with SCI access. It provides for rescinding DCID 6/1, Sections V and VI of DCID 6/6, and related policies once the standards it ordered are issued.

What is the difference between classified national intelligence and SCI?

ICD 703 defines classified national intelligence as national intelligence under 50 U.S.C. 401a(5) that is classified under EO 13526. It defines sensitive compartmented information as a subset of that, concerning or derived from intelligence sources, methods, or analytical processes, that must be protected within formal access control systems established by the DNI. All SCI is classified national intelligence; only the part the DNI places in a control system is SCI.

What are the policy statements in ICD 703?

Section E of ICD 703 has 8 numbered statements. Classified national intelligence shall be protected from unauthorized disclosure; protection comes through classification, markings under ICD 710, declassification guidance, policies, and self-inspections; and through counterintelligence and security practices covering personnel, physical, and information assurance. Any entity that handles it is responsible, contractors may be granted access under EO 12829, the DNI concurs on national interest determinations, protection must enable sharing, and legacy unmarked intelligence may be reused under 2 conditions.

How does ICD 703 relate to EO 13526?

EO 13526 is the authority. ICD 703 cites its Section 6.2(b), which lets the DNI issue implementing directives for intelligence information, and limits its own scope to information classified under Section 1.4(c), intelligence activities, sources, and methods. It requires individuals to comply with nondisclosure agreements under EO 13526 Section 4.1 and 32 CFR 2001.80, and allows reuse of intelligence created before EO 13526 was implemented on June 28, 2010 only if sanitized or with originator consent.

How does ICD 703 relate to ICD 704?

ICD 703 Section E.3.a says persons determined eligible for and granted access to SCI under ICD 704 incur a special and continuing security obligation. ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information, sets the eligibility rules: U.S. citizenship, trustworthiness and loyalty, no family under foreign duress, investigations under ICPG 704.1, and adjudication under SEAD 4. ICD 703 then adds the duties that come with access, including reporting foreign contacts and travel.

Does ICD 703 require SCI to be kept in a SCIF?

Yes, by reference. ICD 703 Section E.3.b says that with regard to physical security, all SCI must be processed, stored, used, or discussed in accordance with ICD 705, and ICD 705 Section D.1 says all SCI must be processed, stored, used, or discussed in an accredited SCIF. Section E.3.c adds that SCI must be processed, stored, and communicated under ICD 503 for information systems. The only exception ICD 703 describes is emergency disclosure to respond to an imminent threat to life or in defense of the homeland.

What does ICD 703 say about marking SCI?

ICD 703 requires proper use of derivative classification and control markings in accordance with ICD 710, Classification Management and Control Markings System, IC classification guides, and the IC standards on machine-readable markings. Section F.2 says dissemination to U.S. recipients is managed through need-to-know, the markings defined in ICD 710 and the Controlled Access Program Coordination Office's Register and Manual, and the security controls of the directive. ICD 710 says the Register holds every authorized marking, including controlled access programs.

Who can access SCI under ICD 703?

ICD 703 Section G.4 says an individual must have a favorable determination for SCI access by an appropriate authority before receiving it, must comply with signed nondisclosure agreements required by EO 13526 Section 4.1 and 32 CFR 2001.80, must meet the Cognizant Security Authority's reporting requirements, and must stay aware of foreign intelligence and terrorist risks. Contractors may be granted access under EO 12829 and ICD 704. In an emergency an IC element head may disclose SCI to a U.S. person who is not otherwise eligible.

Does ICD 703 apply outside the Intelligence Community?

Yes. Section C.3 applies the directive to the handling of SCI by any individual who receives, handles, stores, or processes it, including executive departments, the Executive Office of the President, the legislative and judicial branches, and all other U.S. entities defined in EO 13526. Section E.4 extends the protection measures to state, local, tribal, and private sector entities under EO 13549. Section F.6 names the Director of CIA as the SCI access and SCIF accreditation authority for Congress, the courts, and agencies with no CSA.

What is a national interest determination under ICD 703?

Under 32 CFR 2004.34(h), a national interest determination is the finding needed before a contractor under foreign ownership, control, or influence, mitigated by a special security agreement, may access proscribed information such as SCI. ICD 703 Section E.6 says the DNI must concur on those involving SCI. Section G.2.d requires IC element heads to submit requests before giving contractors SCI access, including pre-contract activities, and Section G.1.a.2 has the DNI process them within 30 days.

Sources

1. 1Intelligence Community Directive 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information · Office of the Director of National Intelligence
2. 2Executive Order 13526, Classified National Security Information · National Archives and Records Administration, Information Security Oversight Office
3. 332 CFR Part 2001, Classified National Security Information · Electronic Code of Federal Regulations
4. 4Intelligence Community Directive 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information · Office of the Director of National Intelligence
5. 5Intelligence Community Directive 705, Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
6. 6Intelligence Community Directive 710, Classification Management and Control Markings System · Office of the Director of National Intelligence
7. 7Intelligence Community Directive 700, Protection of National Intelligence · Office of the Director of National Intelligence
8. 832 CFR 2004.34, Foreign ownership, control, or influence (FOCI) · Electronic Code of Federal Regulations
9. 932 CFR 117.23, Supplement to this rule: Security Requirements for ACCM, SAPs, SCI, RD, FRD, TFNI, and NNPI · Electronic Code of Federal Regulations
10. 10Sensitive compartmented information (glossary entry) · National Institute of Standards and Technology

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.