National Security Presidential Memorandum/NSPM-12
This National Security Presidential Memorandum establishes the official United States policy for the cybersecurity of National Security Systems (NSS), directing that these systems, owned by the Department of War (DOW), Intelligence Community (IC), and Federal Civilian Executive Branch (FCEB) Agencies, must be defended to the greatest extent practicable.
The memorandum formally re-establishes the Committee on National Security Systems (CNSS) under NSC staff coordination, designates the Director of the NSA as the National Manager for NSS, and rescinds earlier governing documents.
It sets forth governance, accountability structures, mandates cybersecurity requirements equivalent to or exceeding those for other Federal systems, and details implementation steps for harmonizing policies, incident reporting, and assessing cloud security.
Arguments For
Establishes clear accountability for cybersecurity defenses of National Security Systems (NSS) with agency heads holding responsibility.
Re-establishes and empowers the Committee on National Security Systems (CNSS) and designates the NSA Director as the National Manager for NSS, clarifying leadership structure.
Mandates that NSS meet or exceed cybersecurity standards set by NIST, ensuring a high baseline of protection, while allowing for specific cryptographic standards via the National Manager.
Implements specific, proactive actions like revising existing directives, establishing incident reporting standards, and creating system inventories to manage risk effectively.
Ensures alignment between NSS cybersecurity requirements and parallel Federal Information Systems requirements established in prior Executive Orders.
Arguments Against
Rescinding previous directives (NSD-42 and NSM-8) could lead to temporary confusion or gaps during transition if not managed perfectly.
Placing the NSA Director as the National Manager centralizes significant cryptographic and technical oversight, potentially raising concerns about scope creep or undue influence over civilian agency system design.
The mandate to adopt NIST baselines may face resistance from Department of War (DoW) or Intelligence Community (IC) elements who feel their unique, more specialized security architecture requires deviation.
Implementation timelines, such as the 30-day deadline for CNSS directive revision, may prove challenging given the need to coordinate across multiple distinct agencies (DoW, IC, FCEB).
Exempting intelligence collection means/methods from interference might inadvertently create ambiguities in technical oversight for civilian agencies processing classified data.
Presidential Actions
MEMORANDUM FOR THE VICE PRESIDENT
THE SECRETARY OF STATE
THE SECRETARY OF THE TREASURY
THE SECRETARY OF WAR
THE ATTORNEY GENERAL
THE SECRETARY OF THE INTERIOR
THE SECRETARY OF AGRICULTURE
THE SECRETARY OF COMMERCE
THE SECRETARY OF LABOR
THE SECRETARY OF HEALTH AND HUMAN SERVICES
THE SECRETARY OF HOUSING AND URBAN DEVELOPMENT
THE SECRETARY OF TRANSPORTATION
THE SECRETARY OF ENERGY
THE SECRETARY OF EDUCATION
THE SECRETARY OF VETERANS AFFAIRS
THE SECRETARY OF HOMELAND SECURITY
THE WHITE HOUSE CHIEF OF STAFF
THE DEPUTY CHIEF OF STAFF FOR POLICY AND HOMELAND SECURITY ADVISOR
THE DIRECTOR OF THE OFFICE OF MANAGEMENT AND BUDGET
THE DIRECTOR OF NATIONAL INTELLIGENCE
THE ASSISTANT TO THE PRESIDENT FOR SCIENCE AND TECHNOLOGY
THE ASSISTANT TO THE PRESIDENT FOR NATIONAL SECURITY AFFAIRS
THE ASSISTANT TO THE PRESIDENT AND COUNSEL TO THE PRESIDENT
THE CHAIRMAN OF THE JOINT CHIEFS OF STAFF
THE DIRECTOR OF THE CENTRAL INTELLIGENCE AGENCY
THE DIRECTOR OF THE NATIONAL SECURITY AGENCY
THE ADMINISTRATOR OF GENERAL SERVICES
THE NATIONAL CYBER DIRECTOR
THE DIRECTOR OF THE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY
SUBJECT: National Policy for the Cybersecurity of National Security Systems
As President, it is my priority to ensure that the United States can conduct key military and intelligence missions in contested cyber environments and that our personnel have access to the modern, secure technology they need to accomplish these missions. The Department of War (DOW), Intelligence Community (IC), and Federal Civilian Executive Branch (FCEB) Agencies own or operate this technology as National Security Systems (NSS). It shall be the policy of the United States Government that these systems be defended to the greatest extent practicable and that executive department and agency (agency) heads be accountable for this defense through government-wide oversight mechanisms. Therefore, by the authority vested in me by the Constitution and the laws of the United States, including section 3557 of title 44, United States Code, and section 301 of title 3, United States Code, it is hereby ordered:
Section 1. Purpose. (a) This National Security Presidential Memorandum sets forth principles and establishes cybersecurity governance for NSS. It further details the governance structure of the Committee on National Security Systems (CNSS) and the role of the Director, National Security Agency (NSA) as the National Manager for NSS.
(b) This memorandum further sets forth requirements for NSS that are equivalent to or exceed the cybersecurity requirements for other Federal Information Systems set forth within Executive Order 14306 of June 6, 2025 (Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144).
Sec. 2. Policy. (a) National Security Directive 42 (NSD‑42) of July 5, 1990 (National Policy for the Security of National Security Telecommunications and Information Systems) and National Security Memorandum 8 (NSM-8) of January 19, 2022 (Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems) are hereby rescinded.
(b) It shall be the policy of the United States Government to foster a proactive, adaptive, and resilient cybersecurity ecosystem for all NSS to better safeguard the Nation against persistent cyber threats from sophisticated adversaries. To this end, this memorandum establishes a clear structure of authorities, roles, and responsibilities for the governance of NSS as well as accountability for owners and operators of NSS. This memorandum shall:
(i) enhance national cyber defense governance and accountability and re-establish and designate clear governance roles and scope of authorities for the CNSS;
(ii) re-establish and empower a National Manager for NSS to identify emerging threats, advise the CNSS, issue emergency directives, provide authoritative minimum requirements for cryptology and cryptographic systems, and, through the CNSS, direct technical solutions for separation of classification levels (whether between systems or on the same system);
(iii) foster collaboration, standardization, and efficient resource management by promoting coordination and information sharing across agencies, public-private partnerships, and international liaison activities; and
(iv) promote efficient use of taxpayer funds in securing NSS.
Sec. 3. The Committee on National Security Systems. (a) The Committee on National Security Systems (CNSS) is re-established to enhance accountability and coordination across the DOW, the IC, and FCEB Agencies in implementing necessary cyber defenses on all NSS. The CNSS shall operate under the coordination of a member of the National Security Council (NSC) staff, who shall serve as Chair.
(i) The CNSS members shall consist of:
(A) the Secretary of War, acting through the DOW Chief Information Officer (CIO);
(B) the Director of National Intelligence (DNI), acting through the IC CIO;
(C) the Director of the Office of Management and Budget (OMB), acting through the Federal CIO; and
(D) the Director of the NSA as National Manager, acting through the Deputy National Manager.
(ii) The following officials may recommend representatives as advisors to the members of the CNSS:
(A) the Attorney General;
(B) the Secretary of Commerce;
(C) the Director of the Central Intelligence Agency (CIA);
(D) the Assistant to the President for National Security Affairs;
(E) the Assistant to the President for Science and Technology;
(F) the National Cyber Director;
(G) the Chairman of the Joint Chiefs of Staff;
(H) the Director of the Cybersecurity and Infrastructure Security Agency (CISA); and
(I) any other advisors as the CNSS deems necessary.
(b) The objectives of the CNSS shall be to:
(i) establish baseline cybersecurity requirements for all NSS;
(ii) through the respective statutory and delegated authorities held by the members, hold NSS owners and operators accountable for implementing required security measures;
(iii) represent the requirements of the NSS ecosystem, owners, and operators in interagency fora, public fora, the Congress, and the Council of Inspectors General on Integrity and Efficiency;
(iv) coordinate with NSS shared service providers to promote efficient use of secure shared services where practicable; and
(v) facilitate a shared platform or forum for dissemination and access to CNSS guidance and decisions, NSS requirements, and related policies, accessible by all NSS end-user IC, DOW, and FCEB Agencies.
(c) The CNSS, acting through its members consistent with section 301 of title 3, United States Code, shall issue directives and complementary standards that apply to all NSS, including directives and standards issued under subsections (c)(i) and (c)(ii) of this section. The agencies that own or operate NSS shall comply with all directives and complementary standards issued by the CNSS.
(i) For the purposes of safeguarding NSS from a known or reasonably suspected information security threat, vulnerability, or risk, the CNSS may issue a directive to the head of an agency, through that agency's CIO, Chief Information Security Officer (CISO), or other officer designated by the head of the agency, to take any lawful action with respect to the operation of that NSS for the purpose of protecting the system from, or mitigating, the threat, vulnerability, or risk.
(ii) NSS shall meet or exceed the protection level of cybersecurity standards issued by the National Institute of Standards and Technology (NIST) unless the CNSS provides otherwise.
(A) The CNSS may issue a complementary standard to adapt NIST-prescribed baselines for NSS where appropriate.
(B) CNSS Policy (CNSSP) 15, or successor policy, or interim guidance from the National Manager, will constitute the commercial cryptographic standard for NSS.
(C) Unless specifically stated by the CNSS or a complementary CNSS issuance exists, all relevant standards issued by NIST shall apply as a minimum baseline to secure NSS.
(d) The CNSS shall have a permanent Executive Secretariat composed of personnel provided by the National Manager. The National Manager shall further provide facilities and support as required. Other agencies shall provide facilities and support as requested by the CNSS, consistent with applicable law.
(i) The Secretary of War, through the DOW CIO, in coordination with the DNI, through the IC CIO, shall be responsible for overseeing the activities of the Executive Secretariat.
(ii) The Executive Secretariat shall be responsible for maintaining an authoritative, machine-readable portal of CNSS guidance applicable to NSS as well as a collaborative environment that is accessible by all NSS owners and operators on Unclassified, Secret, and Top Secret/Sensitive Compartmented Information (TS/SCI) systems.
Sec. 4. Policy Coordination Committee. (a) A Policy Coordination Committee (PCC) for NSS shall be formed pursuant to National Security Presidential Memorandum 1 of January 20, 2025 (Organization of the National Security Council and Subcommittees).
(i) The PCC shall be chaired by a member of the NSC staff and shall consist of representatives of the members and advisors from the CNSS.
(ii) Agencies that operate NSS may be invited at the discretion of the PCC chair.
(b) The PCC through the CNSS may request an assessment of the cybersecurity posture of NSS government-wide, to include performance metrics, cybersecurity assessment results, and compliance with current policy. The PCC chair may request that the National Manager conduct such assessment.
Sec. 5. The National Manager for NSS. (a) The Director of the NSA is the National Manager for NSS and will carry out the certain responsibilities in accordance with existing law, Executive Orders, and other Presidential directives. In this capacity the National Manager is responsible for providing technical advice to the CNSS and:
(i) providing recommendations on incident response for security incidents that impact NSS government-wide; and
(ii) as referenced in section 2(b)(ii) of this memorandum, in response to a known or reasonably suspected information security threat, vulnerability, or risk that represents a substantial threat to the information security of NSS, or in response to intelligence of adversary capability and intent to target NSS, the National Manager may issue an emergency directive to the head of an agency, through that agency’s CIO, CISO, or officer designated by the head of the agency, to take any lawful action with respect to the operation of that NSS, including such systems used or operated by another entity on behalf of an agency, for the purpose of protecting the NSS from, or mitigating, the threat, vulnerability, or risk.
(b) The National Manager shall serve as the cryptologic authority for NSS. Through this role, the National Manager shall, in accordance with applicable law and policy:
(i) design, build, test, deliver, and protect cryptographic keys and codes capabilities;
(ii) review, approve, and publish standards related to the security of NSS;
(iii) develop, evaluate and approve techniques, systems, products, solutions, and equipment related to the cybersecurity of NSS, provided that nothing in this provision shall restrict agencies from testing cryptography on NSS that they own or operate;
(iv) operate such printing, fabrication, and other facilities as may be required to perform critical functions related to the provisions of cryptographic, identity, key management, and other technical security material or services;
(v) in consultation with the CNSS, prescribe the minimum standards, methods, and procedures for protecting cryptographic and other technical security material, techniques, and information related to NSS; and
(vi) enter into agreements for the procurement of technical security material and other equipment, their provision to agencies, and, where appropriate, government contractors and foreign governments.
(c) The National Manager shall assess the cybersecurity posture of NSS across the United States Government on behalf of the CNSS and serve as a technical advisor to the CNSS and agencies that own or operate NSS, in alignment with provisions set forth in section 9 of this memorandum. Through this role the National Manager shall:
(i) in consultation with the CNSS, develop government-wide performance metrics for the defense of NSS; and coordinate with the CNSS chair and CNSS members and advisors on any CNSS collection of those metrics on a regular basis from each agency that owns or operates NSS;
(ii) assess the overall security posture of and disseminate information on threats to and vulnerabilities in NSS;
(iii) operate a technical center to evaluate and certify the security of NSS;
(iv) request from the heads of agencies, through an agency’s CIO, CISO, or other officer designated by the head of the agency, such information and technical support as may be needed to discharge the responsibilities assigned herein;
(v) conduct, coordinate, or endorse research and development of techniques and equipment to secure NSS;
(vi) upon request, provide cybersecurity services and technical assistance to NSS owners and operators;
(vii) examine NSS and evaluate their vulnerability to foreign interception and exploitation, provided no examination or monitoring shall be performed without advising the CIO of the agency that owns or operates the NSS; and
(viii) conduct foreign cryptographic and cybersecurity liaison relationships, including by providing information, services, and support and by entering into agreements with foreign governments and with international and private organizations regarding NSS. Any liaison conducted with foreign intelligence or security services shall be carried out in coordination with the Secretary of War, the DNI, and the Director of the CIA in accordance with Executive Order 12333 of December 4, 1981 (United States Intelligence Activities), as amended. Any such agreements shall be coordinated with affected agencies.
(d) The National Manager, through the CNSS, shall establish requirements for cross-domain solutions and alternative technical solutions for the separation of security domains for NSS. Through this role, the National Manager shall:
(i) serve as the principal advisor to NSS owners and operators on cross-domain capabilities;
(ii) develop and maintain community outreach programs and fora focused on cross-domain solutions;
(iii) develop and establish improved security solutions, standards, and technologies for cross-domain solutions; and
(iv) perform comprehensive testing for establishment of approved cross-domain solution products.
(e) NSS owned or operated by civilian agencies play an important role in many military and intelligence missions. Additionally, heads of civilian agencies are accountable for protection of classified material that is stored or processed on NSS that are owned or operated by such agencies. The Director of OMB, with support from the National Manager, and acting through the Federal CIO as appropriate, shall oversee compliance of FCEB Agencies with NSS policies and directives with the exception of agencies and agency components that are part of the IC. National Manager support may include:
(i) collection of metrics and direct assessment of the cybersecurity posture of NSS owned or operated by FCEB Agencies;
(ii) provision of technical assistance upon request to NSS owners and operators on the implementation of the NSS policies; and
(iii) consistent with applicable law, assignment of personnel to the Office of the Federal CIO to align and enhance oversight across FCEB Agencies.
(f) The National Manager may partner and collaborate with the heads of other agencies on matters related to cybersecurity, including with the heads of CISA and NIST, as well as the private sector and academia, to carry out the responsibilities assigned herein in accordance with applicable law and policy.
Sec. 6. Implementation. (a) Within 30 days of the date of this memorandum, the CNSS shall revise CNSS Directive 900 of May 2013 (Committee on National Security Systems (CNSS) Governing and Operating Procedures), and any other policies as the CNSS deems appropriate, to incorporate the changes set forth in this memorandum.
(b) The CNSS and the National Manager shall take the following steps to harmonize NSS policies:
(i) within 60 days of the date of this memorandum, the CNSS shall issue a roadmap and policy priority areas for NSS to be applied in the next calendar year;
(ii) within 90 days of the date of this memorandum, the CNSS shall determine which National Manager Binding Operational Directives and other National Manager policies, including those related to NSM-8, with the exception of National Manager Emergency Directives, must be maintained and, where appropriate, incorporate those requirements into CNSS Directives. Upon completion of this process, the National Manager shall take necessary steps to rescind all National Manager Binding Operational Directives and Memoranda related to NSM-8 as appropriate; and
(iii) within 90 days of the date of this memorandum, the CNSS shall review all existing CNSS policies, directives, and instructions to determine which should be rescinded or harmonized. The CNSS shall complete rescission or harmonization of identified policies within 90 days of the completion of this review.
(c) Effective incident reporting for incidents that occur on or impact NSS is essential to minimize risk to the critical missions enabled by these systems and drive accountability for owners and operators, including civilian, defense, and intelligence agencies.
(i) Within 60 days of the date of this memorandum, the National Manager shall recommend to the CNSS new or modified incident reporting standards that enable government-wide awareness of incidents impacting NSS. This recommendation shall include thresholds for required reporting of incidents.
(ii) Within 60 days of the receipt of the National Manager's recommendations, the CNSS shall update applicable CNSS policies to incorporate those recommendations as appropriate.
(iii) Within 60 days of the release of the incident reporting standards described in section 6(c)(i) of this memorandum, agencies shall update their respective incident response policies to incorporate the revised standards, and ensure that all incidents meeting defined thresholds and that occur on or impact NSS are properly reported to the National Manager, IC CIO, DOW CIO, or Federal CIO.
(d) Each agency shall maintain and annually update an inventory of all NSS owned or operated by that agency.
(i) To assist the National Manager in reporting government-wide metrics, agencies shall make inventories available to the National Manager. At a minimum, this inventory must include the number of total information systems, NSS, and non-NSS, owned or operated by the agency.
(ii) Within 60 days of the date of this memorandum, the CNSS shall establish a working group to deconflict the identification and inventory of NSS and non-NSS in FCEB Agencies.
(e) Within 60 days of the date of this memorandum, the National Manager and the Director of OMB, through the Federal CIO, shall develop any memoranda of agreement necessary for the National Manager to assign or detail personnel to the Office of the Federal CIO, consistent with applicable law, to assist in the oversight of NSS owned or operated by FCEB Agencies in accordance with section 5(e) of this memorandum.
Sec. 7. Adaptation of Executive Order 14306 to National Security Systems. (a) Executive Order 14306 required the development of requirements for NSS that are consistent with the requirements set forth in that order as appropriate and consistent with applicable law. This section implements these requirements for NSS.
(i) Consistent with section 3(b) of Executive Order 14144 of January 16, 2025 (Strengthening and Promoting Innovation in the Nation's Cybersecurity), as amended by Executive Order 14306, within 120 days of the date of this memorandum, the CNSS shall request from cloud service providers accredited to host NSS, excluding those supporting compartmented intelligence missions, baselines with specifications and recommendations for agency configuration of agency cloud-based systems in order to secure Federal data based on agency requirements. The CNSS will assess these recommendations and make an independent decision as to whether to recommend them to the National Manager. The treatment of existing commercial cloud services provided by the CIA as a Service of Common Concern shall be subject to negotiation between the CIA and the CNSS.
(ii) Within 90 days of the date of this memorandum, the CNSS, in coordination with the Secretary of State, through the Department of State CIO, the Secretary of Commerce, through the Department of Commerce CIO, the Secretary of Energy, through the CIO of the National Nuclear Security Administration, and the Secretary of Homeland Security, through the Department of Homeland Security CIO, shall issue a report on the provisioning of cloud capabilities, to include recommended secure configuration baselines, at the Secret, Top Secret Collateral, TS/SCI, and Top Secret Controlled and Special Access Program levels for FCEB Agencies. This report shall be drafted in coordination with the roadmap on advanced computing resources tasked in National Security Presidential Memorandum 11 of June 5, 2026 (Artificial Intelligence in the National Security Enterprise).
(iii) Within 90 days of the date of this memorandum, the CNSS will review and identify revisions needed to CNSSP-32 of May 2022 (Policy on Cloud Security), to provide guidance and requirements for the secure hosting of NSS in cloud environments.
(b) Secure unclassified communication among agencies is essential in promoting the security of NSS and the missions that these systems support. Within 90 days of the date of this memorandum, the National Manager will provide recommendations to the CNSS on policy to promote government-wide, secure, interoperable unclassified voice and video communication capabilities for mobile and fixed devices among FCEB Agencies, DOW, and the IC.
Sec. 8. Definitions. For purposes of this memorandum:
(a) The term “agency” has the meaning given to it in 44 U.S.C. 3502(1).
(b) The term “Federal Civilian Executive Branch Agencies” means all agencies except for the Department of War and agencies in the Intelligence Community.
(c) The term “Federal Chief Information Officer” means the Administrator of the Office of Electronic Government appointed pursuant to 44 U.S.C. 3602(b).
(d) The term “National Security System” has the meaning given to that term in 44 U.S.C. 3552(b)(6), 44 U.S.C. 3553(e)(2), and 44 U.S.C. 3553(e)(3).
(e) The term “information system” has the meaning given to it in 44 U.S.C. 3502(8).
Sec. 9. General Provisions. This memorandum shall not be construed to implicitly alter or supersede existing authorities or contravene existing law, Executive Orders, or Presidential Directives to include authorities conferred to ensure the protection of intelligence sources and methods or to confer the authority to interfere with the means and methods necessary to undertake intelligence collection or covert action operations. This memorandum shall be implemented consistent with applicable law and subject to the availability of appropriations. No implementation measures shall impede the conduct or support of DOW or IC activities, or other activities under provisions of law, and all such implementation measures shall be designed to protect intelligence sources and methods.
DONALD J. TRUMP
The post National Security Presidential Memorandum/NSPM-12 appeared first on The White House.
The opening section identifies the recipients of this memorandum, which include the Vice President, several Cabinet Secretaries (State, Treasury, War, etc.), leaders in intelligence, and key White House advisors.
This distribution list confirms the high-level, government-wide scope of the order.
The memorandum itself declares the President's priority: ensuring the United States can conduct critical military and intelligence missions in hostile cyber environments.
It designates National Security Systems (NSS) as the technology owned or operated by the Department of War (DOW), Intelligence Community (IC), and Federal Civilian Executive Branch (FCEB) Agencies.
The policy established is that these NSS must be defended to the maximum extent practical, with agency heads held accountable via government oversight.
Section 1 outlines the purpose: setting cybersecurity governance principles for NSS, detailing the structure of the Committee on National Security Systems (CNSS), and defining the role of the NSA Director as the National Manager for NSS. It also cross-references previous Executive Orders (EO 14306, EO 13694, EO 14144) regarding Federal Information Systems, requiring NSS requirements to meet or exceed those standards where applicable.
Section 2 details the policy itself, immediately rescinding National Security Directive 42 (NSD-42) and National Security Memorandum 8 (NSM-8).
The core policy objective is to cultivate a proactive, adaptive, and resilient cybersecurity ecosystem for all NSS. It establishes clear authorities, responsibilities, and accountability, aiming to enhance governance, empower the National Manager, foster interagency collaboration, and promote efficient spending of taxpayer funds for security.
Section 1. Purpose. (a) This National Security Presidential Memorandum sets forth principles and establishes cybersecurity governance for NSS. It further details the governance structure of the Committee on National Security Systems (CNSS) and the role of the Director, National Security Agency (NSA) as the National Manager for NSS.
(b) This memorandum further sets forth requirements for NSS that are equivalent to or exceed the cybersecurity requirements for other Federal Information Systems set forth within Executive Order 14306 of June 6, 2025 (Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144).
Sec. 2. Policy. (a) National Security Directive 42 (NSD‑42) of July 5, 1990 (National Policy for the Security of National Security Telecommunications and Information Systems) and National Security Memorandum 8 (NSM-8) of January 19, 2022 (Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems) are hereby rescinded.
(b) It shall be the policy of the United States Government to foster a proactive, adaptive, and resilient cybersecurity ecosystem for all NSS to better safeguard the Nation against persistent cyber threats from sophisticated adversaries. To this end, this memorandum establishes a clear structure of authorities, roles, and responsibilities for the governance of NSS as well as accountability for owners and operators of NSS. This memorandum shall:
(i) enhance national cyber defense governance and accountability and re-establish and designate clear governance roles and scope of authorities for the CNSS;
(ii) re-establish and empower a National Manager for NSS to identify emerging threats, advise the CNSS, issue emergency directives, provide authoritative minimum requirements for cryptology and cryptographic systems, and, through the CNSS, direct technical solutions for separation of classification levels (whether between systems or on the same system);
(iii) foster collaboration, standardization, and efficient resource management by promoting coordination and information sharing across agencies, public-private partnerships, and international liaison activities; and
(iv) promote efficient use of taxpayer funds in securing NSS.
Section 1 explicitly states the memorandum's purpose: to define the principles and governance structure for National Security Systems (NSS).
This includes detailing the Committee on National Security Systems (CNSS) structure and assigning the Director of the National Security Agency (NSA) as the National Manager for NSS. Furthermore, NSS cybersecurity requirements must be equal to or stricter than those set for general Federal Information Systems under Executive Order 14306.
Section 2 outlines the policy by formally rescinding two prior governing documents: National Security Directive 42 (NSD-42) from 1990 and National Security Memorandum 8 (NSM-8) from 2022.
The overarching policy goal is to create a proactive and resilient cybersecurity environment for NSS to counter sophisticated threats.
This is achieved by establishing explicit roles, authorities, and accountability for NSS owners and operators, specifically by re-establishing the CNSS, empowering the National Manager with advisory and directive capabilities regarding threats and cryptography, and improving interagency coordination and resource efficiency.
Sec. 3. The Committee on National Security Systems. (a) The Committee on National Security Systems (CNSS) is re-established to enhance accountability and coordination across the DOW, the IC, and FCEB Agencies in implementing necessary cyber defenses on all NSS. The CNSS shall operate under the coordination of a member of the National Security Council (NSC) staff, who shall serve as Chair.
(i) The CNSS members shall consist of:
(A) the Secretary of War, acting through the DOW Chief Information Officer (CIO);
(B) the Director of National Intelligence (DNI), acting through the IC CIO;
(C) the Director of the Office of Management and Budget (OMB), acting through the Federal CIO; and
(D) the Director of the NSA as National Manager, acting through the Deputy National Manager.
(ii) The following officials may recommend representatives as advisors to the members of the CNSS:
(A) the Attorney General;
(B) the Secretary of Commerce;
(C) the Director of the Central Intelligence Agency (CIA);
(D) the Assistant to the President for National Security Affairs;
(E) the Assistant to the President for Science and Technology;
(F) the National Cyber Director;
(G) the Chairman of the Joint Chiefs of Staff;
(H) the Director of the Cybersecurity and Infrastructure Security Agency (CISA); and
(I) any other advisors as the CNSS deems necessary.
(b) The objectives of the CNSS shall be to:
(i) establish baseline cybersecurity requirements for all NSS;
(ii) through the respective statutory and delegated authorities held by the members, hold NSS owners and operators accountable for implementing required security measures;
(iii) represent the requirements of the NSS ecosystem, owners, and operators in interagency fora, public fora, the Congress, and the Council of Inspectors General on Integrity and Efficiency;
(iv) coordinate with NSS shared service providers to promote efficient use of secure shared services where practicable; and
(v) facilitate a shared platform or forum for dissemination and access to CNSS guidance and decisions, NSS requirements, and related policies, accessible by all NSS end-user IC, DOW, and FCEB Agencies.
(c) The CNSS, acting through its members consistent with section 301 of title 3, United States Code, shall issue directives and complementary standards that apply to all NSS, including directives and standards issued under subsections (c)(i) and (c)(ii) of this section. The agencies that own or operate NSS shall comply with all directives and complementary standards issued by the CNSS.
(i) For the purposes of safeguarding NSS from a known or reasonably suspected information security threat, vulnerability, or risk, the CNSS may issue a directive to the head of an agency, through that agency's CIO, Chief Information Security Officer (CISO), or other officer designated by the head of the agency, to take any lawful action with respect to the operation of that NSS for the purpose of protecting the system from, or mitigating, the threat, vulnerability, or risk.
(ii) NSS shall meet or exceed the protection level of cybersecurity standards issued by the National Institute of Standards and Technology (NIST) unless the CNSS provides otherwise.
(A) The CNSS may issue a complementary standard to adapt NIST-prescribed baselines for NSS where appropriate.
(B) CNSS Policy (CNSSP) 15, or successor policy, or interim guidance from the National Manager, will constitute the commercial cryptographic standard for NSS.
(C) Unless specifically stated by the CNSS or a complementary CNSS issuance exists, all relevant standards issued by NIST shall apply as a minimum baseline to secure NSS.
(d) The CNSS shall have a permanent Executive Secretariat composed of personnel provided by the National Manager. The National Manager shall further provide facilities and support as required. Other agencies shall provide facilities and support as requested by the CNSS, consistent with applicable law.
(i) The Secretary of War, through the DOW CIO, in coordination with the DNI, through the IC CIO, shall be responsible for overseeing the activities of the Executive Secretariat.
(ii) The Executive Secretariat shall be responsible for maintaining an authoritative, machine-readable portal of CNSS guidance applicable to NSS as well as a collaborative environment that is accessible by all NSS owners and operators on Unclassified, Secret, and Top Secret/Sensitive Compartmented Information (TS/SCI) systems.
Section 3 formally re-establishes the Committee on National Security Systems (CNSS) to improve accountability and coordination for cybersecurity defenses across the DOW, IC, and FCEB Agencies.
The CNSS leadership is structured to be coordinated by an NSC staff member, who serves as the Chair.
The membership of the CNSS comprises representatives from the Department of War CIO, the Director of National Intelligence CIO, the OMB Federal CIO, and the NSA Director (serving as the National Manager), utilizing their primary designees.
Several other key officials, including the Attorney General, Secretaries of Commerce and Energy, and the Directors of the CIA and CISA, may provide advisory representatives.
The CNSS objectives include setting baseline cybersecurity requirements, enforcing accountability on system owners, representing ecosystem needs in external forums, coordinating secure shared services, and providing a central, accessible platform for guidance dissemination across different classification levels (Unclassified, Secret, TS/SCI).
Crucially, the CNSS is empowered to issue binding directives and standards applicable to all NSS. If a significant threat is identified, the CNSS can direct an agency head to take lawful action to mitigate it.
Furthermore, NSS are required to meet or exceed standards from the National Institute of Standards and Technology (NIST), though the CNSS can issue separate complementary standards or use CNSSP 15 for commercial cryptography.
The structure includes a permanent Executive Secretariat, overseen by the DOW CIO and IC CIO, which will maintain a central, machine-readable portal for all NSS guidance and operational environments up to the TS/SCI level.
Sec. 4. Policy Coordination Committee. (a) A Policy Coordination Committee (PCC) for NSS shall be formed pursuant to National Security Presidential Memorandum 1 of January 20, 2025 (Organization of the National Security Council and Subcommittees).
(i) The PCC shall be chaired by a member of the NSC staff and shall consist of representatives of the members and advisors from the CNSS.
(ii) Agencies that operate NSS may be invited at the discretion of the PCC chair.
(b) The PCC through the CNSS may request an assessment of the cybersecurity posture of NSS government-wide, to include performance metrics, cybersecurity assessment results, and compliance with current policy. The PCC chair may request that the National Manager conduct such assessment.
Section 4 establishes a Policy Coordination Committee (PCC) specifically for NSS, consistent with the structure set forth in National Security Presidential Memorandum 1 of 2025.
The PCC will be chaired by an NSC staff member and will include representatives from the CNSS members and advisors.
Agencies operating NSS can attend these PCC meetings if the chair invites them.
The PCC, leveraging the CNSS, gains the authority to request comprehensive assessments of the cybersecurity posture of NSS across the entire government.
This includes requesting reports on performance metrics, assessment outcomes, and policy compliance, with the authority to direct the National Manager to conduct these assessments.
Sec. 5. The National Manager for NSS. (a) The Director of the NSA is the National Manager for NSS and will carry out the certain responsibilities in accordance with existing law, Executive Orders, and other Presidential directives. In this capacity the National Manager is responsible for providing technical advice to the CNSS and:
(i) providing recommendations on incident response for security incidents that impact NSS government-wide; and
(ii) as referenced in section 2(b)(ii) of this memorandum, in response to a known or reasonably suspected information security threat, vulnerability, or risk that represents a substantial threat to the information security of NSS, or in response to intelligence of adversary capability and intent to target NSS, the National Manager may issue an emergency directive to the head of an agency, through that agency’s CIO, CISO, or officer designated by the head of the agency, to take any lawful action with respect to the operation of that NSS, including such systems used or operated by another entity on behalf of an agency, for the purpose of protecting the NSS from, or mitigating, the threat, vulnerability, or risk.
(b) The National Manager shall serve as the cryptologic authority for NSS. Through this role, the National Manager shall, in accordance with applicable law and policy:
(i) design, build, test, deliver, and protect cryptographic keys and codes capabilities;
(ii) review, approve, and publish standards related to the security of NSS;
(iii) develop, evaluate and approve techniques, systems, products, solutions, and equipment related to the cybersecurity of NSS, provided that nothing in this provision shall restrict agencies from testing cryptography on NSS that they own or operate;
(iv) operate such printing, fabrication, and other facilities as may be required to perform critical functions related to the provisions of cryptographic, identity, key management, and other technical security material or services;
(v) in consultation with the CNSS, prescribe the minimum standards, methods, and procedures for protecting cryptographic and other technical security material, techniques, and information related to NSS; and
(vi) enter into agreements for the procurement of technical security material and other equipment, their provision to agencies, and, where appropriate, government contractors and foreign governments.
(c) The National Manager shall assess the cybersecurity posture of NSS across the United States Government on behalf of the CNSS and serve as a technical advisor to the CNSS and agencies that own or operate NSS, in alignment with provisions set forth in section 9 of this memorandum. Through this role the National Manager shall:
(i) in consultation with the CNSS, develop government-wide performance metrics for the defense of NSS, and coordinate with the CNSS chair and CNSS members and advisors on any CNSS collection of those metrics on a regular basis from each agency that owns or operates NSS;
(ii) assess the overall security posture of and disseminate information on threats to and vulnerabilities in NSS;
(iii) operate a technical center to evaluate and certify the security of NSS;
(iv) request from the heads of agencies, through an agency’s CIO, CISO, or other officer designated by the head of the agency, such information and technical support as may be needed to discharge the responsibilities assigned herein;
(v) conduct, coordinate, or endorse research and development of techniques and equipment to secure NSS;
(vi) upon request, provide cybersecurity services and technical assistance to NSS owners and operators;
(vii) examine NSS and evaluate their vulnerability to foreign interception and exploitation, provided no examination or monitoring shall be performed without advising the CIO of the agency that owns or operates the NSS; and
(viii) conduct foreign cryptographic and cybersecurity liaison relationships, including by providing information, services, and support and by entering into agreements with foreign governments and with international and private organizations regarding NSS. Any liaison conducted with foreign intelligence or security services shall be carried out in coordination with the Secretary of War, the DNI, and the Director of the CIA in accordance with Executive Order 12333 of December 4, 1981 (United States Intelligence Activities), as amended. Any such agreements shall be coordinated with affected agencies.
(d) The National Manager, through the CNSS, shall establish requirements for cross-domain solutions and alternative technical solutions for the separation of security domains for NSS. Through this role, the National Manager shall:
(i) serve as the principal advisor to NSS owners and operators on cross-domain capabilities;
(ii) develop and maintain community outreach programs and fora focused on cross-domain solutions;
(iii) develop and establish improved security solutions, standards, and technologies for cross-domain solutions; and
(iv) perform comprehensive testing for establishment of approved cross-domain solution products.
(e) NSS owned or operated by civilian agencies play an important role in many military and intelligence missions. Additionally, heads of civilian agencies are accountable for protection of classified material that is stored or processed on NSS that are owned or operated by such agencies. The Director of OMB, with support from the National Manager, and acting through the Federal CIO as appropriate, shall oversee compliance of FCEB Agencies with NSS policies and directives with the exception of agencies and agency components that are part of the IC. National Manager support may include:
(i) collection of metrics and direct assessment of the cybersecurity posture of NSS owned or operated by FCEB Agencies;
(ii) provision of technical assistance upon request to NSS owners and operators on the implementation of the NSS policies; and
(iii) consistent with applicable law, assignment of personnel to the Office of the Federal CIO to align and enhance oversight across FCEB Agencies.
(f) The National Manager may partner and collaborate with the heads of other agencies on matters related to cybersecurity, including with the heads of CISA and NIST, as well as the private sector and academia, to carry out the responsibilities assigned herein in accordance with applicable law and policy.
Section 5 officially appoints the Director of the NSA as the National Manager for NSS, tasking them with executing responsibilities under existing law and directives, primarily involving providing technical advice to the CNSS.
The National Manager has critical authority in incident response, offering recommendations government-wide. Crucially, in response to a substantial threat or adversary intent, the National Manager can issue an emergency directive to an agency head, compelling immediate lawful action to protect the NSS.
In their role as the cryptologic authority for NSS, the National Manager controls the design, protection, and delivery of cryptographic keys and codes.
This includes reviewing and approving security standards, evaluating security solutions, operating necessary fabrication facilities, and prescribing minimum standards for protecting cryptographic material, potentially entering into procurement agreements for security equipment.
As a technical advisor, the National Manager is responsible for assessing the overall NSS cybersecurity posture across the government, developing performance metrics in consultation with CNSS, operating a technical evaluation center, and requesting necessary information from agency CIOs/CISOs.
This section also explicitly permits the National Manager to conduct vulnerability examinations, but only after advising the host agency's CIO. They will also manage foreign cryptographic and cybersecurity liaison relationships, coordinating intelligence liaisons with the Secretary of War, DNI, and CIA Director.
Regarding system separation, the National Manager establishes requirements for cross-domain solutions.
Finally, for civilian agencies (FCEB), the Director of OMB, supported by the National Manager and operating through the Federal CIO, oversees compliance, with the National Manager providing technical assistance, metrics collection, and potentially detailing personnel to the Federal CIO's office for oversight alignment.
Sec. 6. Implementation. (a) Within 30 days of the date of this memorandum, the CNSS shall revise CNSS Directive 900 of May 2013 (Committee on National Security Systems (CNSS) Governing and Operating Procedures), and any other policies as the CNSS deems appropriate, to incorporate the changes set forth in this memorandum.
(b) The CNSS and the National Manager shall take the following steps to harmonize NSS policies:
(i) within 60 days of the date of this memorandum, the CNSS shall issue a roadmap and policy priority areas for NSS to be applied in the next calendar year;
(ii) within 90 days of the date of this memorandum, the CNSS shall determine which National Manager Binding Operational Directives and other National Manager policies, including those related to NSM-8, with the exception of National Manager Emergency Directives, must be maintained and, where appropriate, incorporate those requirements into CNSS Directives. Upon completion of this process, the National Manager shall take necessary steps to rescind all National Manager Binding Operational Directives and Memoranda related to NSM-8 as appropriate; and
(iii) within 90 days of the date of this memorandum, the CNSS shall review all existing CNSS policies, directives, and instructions to determine which should be rescinded or harmonized. The CNSS shall complete rescission or harmonization of identified policies within 90 days of the completion of this review.
(c) Effective incident reporting for incidents that occur on or impact NSS is essential to minimize risk to the critical missions enabled by these systems and drive accountability for owners and operators, including civilian, defense, and intelligence agencies.
(i) Within 60 days of the date of this memorandum, the National Manager shall recommend to the CNSS new or modified incident reporting standards that enable government-wide awareness of incidents impacting NSS. This recommendation shall include thresholds for required reporting of incidents.
(ii) Within 60 days of the receipt of the National Manager's recommendations, the CNSS shall update applicable CNSS policies to incorporate those recommendations as appropriate.
(iii) Within 60 days of the release of the incident reporting standards described in section 6(c)(i) of this memorandum, agencies shall update their respective incident response policies to incorporate the revised standards, and ensure that all incidents meeting defined thresholds and that occur on or impact NSS are properly reported to the National Manager, IC CIO, DOW CIO, or Federal CIO.
(d) Each agency shall maintain and annually update an inventory of all NSS owned or operated by that agency.
(i) To assist the National Manager in reporting government-wide metrics, agencies shall make inventories available to the National Manager. At a minimum, this inventory must include the number of total information systems, NSS, and non-NSS, owned or operated by the agency.
(ii) Within 60 days of the date of this memorandum, the CNSS shall establish a working group to deconflict the identification and inventory of NSS and non-NSS in FCEB Agencies.
(e) Within 60 days of the date of this memorandum, the National Manager and the Director of OMB, through the Federal CIO, shall develop any memoranda of agreement necessary for the National Manager to assign or detail personnel to the Office of the Federal CIO, consistent with applicable law, to assist in the oversight of NSS owned or operated by FCEB Agencies in accordance with section 5(e) of this memorandum.
Section 6 establishes concrete implementation timelines to transition to the new policy framework.
The CNSS must revise its 2013 Directive 900 within 30 days to incorporate this memorandum's changes.
For policy harmonization, within 60 days, the CNSS must issue a roadmap of priority areas for the following year.
Within 90 days, the CNSS must determine which predecessor directives (like those from NSM-8) should be absorbed into new CNSS Directives, after which the National Manager rescinds outdated materials.
Incident reporting is prioritized for effective risk reduction.
Within 60 days, the National Manager will recommend new, government-wide reporting standards, including specific thresholds.
The CNSS will incorporate these recommendations into policy within 60 days of receiving them.
Finally, agencies have 60 days after the standards release to update their internal policies to ensure reporting to the National Manager, IC CIO, DOW CIO, or Federal CIO.
Each agency must inventory its NSS annually.
Inventories must be shared with the National Manager for metrics reporting, detailing total systems, NSS, and non-NSS. Within 60 days, the CNSS must also establish a working group to ensure consistent counting of NSS versus non-NSS systems in FCEB Agencies.
Lastly, within 60 days, memoranda of agreement must be developed to allow the National Manager to detail personnel to the Office of the Federal CIO to support civilian agency oversight.
Sec. 7. Adaptation of Executive Order 14306 to National Security Systems. (a) Executive Order 14306 required the development of requirements for NSS that are consistent with the requirements set forth in that order as appropriate and consistent with applicable law. This section implements these requirements for NSS.
(i) Consistent with section 3(b) of Executive Order 14144 of January 16, 2025 (Strengthening and Promoting Innovation in the Nation's Cybersecurity), as amended by Executive Order 14306, within 120 days of the date of this memorandum, the CNSS shall request from cloud service providers accredited to host NSS, excluding those supporting compartmented intelligence missions, baselines with specifications and recommendations for agency configuration of agency cloud-based systems in order to secure Federal data based on agency requirements. The CNSS will assess these recommendations and make an independent decision as to whether to recommend them to the National Manager. The treatment of existing commercial cloud services provided by the CIA as a Service of Common Concern shall be subject to negotiation between the CIA and the CNSS.
(ii) Within 90 days of the date of this memorandum, the CNSS, in coordination with the Secretary of State, through the Department of State CIO, the Secretary of Commerce, through the Department of Commerce CIO, the Secretary of Energy, through the CIO of the National Nuclear Security Administration, and the Secretary of Homeland Security, through the Department of Homeland Security CIO, shall issue a report on the provisioning of cloud capabilities, to include recommended secure configuration baselines, at the Secret, Top Secret Collateral, TS/SCI, and Top Secret Controlled and Special Access Program levels for FCEB Agencies. This report shall be drafted in coordination with the roadmap on advanced computing resources tasked in National Security Presidential Memorandum 11 of June 5, 2026 (Artificial Intelligence in the National Security Enterprise).
(iii) Within 90 days of the date of this memorandum, the CNSS will review and identify revisions needed to CNSSP-32 of May 2022 (Policy on Cloud Security), to provide guidance and requirements for the secure hosting of NSS in cloud environments.
(b) Secure unclassified communication among agencies is essential in promoting the security of NSS and the missions that these systems support. Within 90 days of the date of this memorandum, the National Manager will provide recommendations to the CNSS on policy to promote government-wide, secure, interoperable unclassified voice and video communication capabilities for mobile and fixed devices among FCEB Agencies, DOW, and the IC.
Section 7 specifically integrates requirements from Executive Order 14306 into NSS protection.
Within 120 days, the CNSS must request baseline specifications and configuration recommendations from cloud service providers accredited to host NSS, excluding those supporting compartmented intelligence missions.
The CNSS independently reviews and decides whether to recommend these baselines to the National Manager.
Any existing commercial cloud services used by the CIA are subject to negotiation.
Within 90 days, several agencies, coordinated by the CNSS, must report on cloud provisioning.
This report must include recommended secure configuration baselines for Secret, TS/SCI, and SAP levels for FCEB Agencies, and it will align with directives related to Artificial Intelligence in the National Security Enterprise (NSPM-11).
Also within 90 days, the CNSS must review and revise CNSSP-32 (Policy on Cloud Security) to ensure it provides adequate requirements for securing NSS hosted in cloud environments.
Finally, to bolster operational security, the National Manager must provide recommendations to the CNSS within 90 days to establish secure, interoperable unclassified voice and video communication capabilities across all major entities (FCEB, DOW, and IC) for both mobile and fixed devices.
Sec. 8. Definitions. For purposes of this memorandum:
(a) The term “agency” has the meaning given to it in 44 U.S.C. 3502(1).
(b) The term “Federal Civilian Executive Branch Agencies” means all agencies except for the Department of War and agencies in the Intelligence Community.
(c) The term “Federal Chief Information Officer” means the Administrator of the Office of Electronic Government appointed pursuant to 44 U.S.C. 3602(b).
(d) The term “National Security System” has the meaning given to that term in 44 U.S.C. 3552(b)(6), 44 U.S.C. 3553(e)(2), and 44 U.S.C. 3553(e)(3).
(e) The term “information system” has the meaning given to it in 44 U.S.C. 3502(8).
Section 8 provides key definitions used throughout the memorandum, referring to statutory references for precise legal interpretations.
An "agency" uses the meaning defined in 44 U.S.C. 3502(1).
The term "Federal Civilian Executive Branch Agencies" (FCEB Agencies) specifically excludes the Department of War (DoW) and any agencies belonging to the Intelligence Community (IC).
Definitions are provided for the "Federal Chief Information Officer" (the Administrator of the Office of Electronic Government), "National Security System" (NSS), and "information system," all cross-referenced to specific sections of Title 44 of the U.S. Code.
Sec. 9. General Provisions. This memorandum shall not be construed to implicitly alter or supersede existing authorities or contravene existing law, Executive Orders, or Presidential Directives to include authorities conferred to ensure the protection of intelligence sources and methods or to confer the authority to interfere with the means and methods necessary to undertake intelligence collection or covert action operations. This memorandum shall be implemented consistent with applicable law and subject to the availability of appropriations. No implementation measures shall impede the conduct or support of DOW or IC activities, or other activities under provisions of law, and all such implementation measures shall be designed to protect intelligence sources and methods.
DONALD J. TRUMP
The post National Security Presidential Memorandum/NSPM-12 appeared first on The White House.
Section 9 outlines General Provisions, ensuring the memorandum operates within existing legal constraints.
It explicitly clarifies that this directive does not override existing authorities regarding the protection of intelligence sources and methods, nor does it grant power to interfere with intelligence collection or covert action operations.
Implementation must comply with applicable law and is contingent upon the availability of appropriated funds.
The final provision emphasizes that any measures taken under this memorandum must not hinder Department of War or Intelligence Community activities and must be designed specifically to safeguard intelligence sources and methods.
Related
Flag Day and National Flag Week, 2026
* Donald J. Trump proclaimed June 14, 2026, as Flag Day and the week starting June 14, 2026, as National Flag Week, directing federal flag displays and encouraging public observance.
Read MoreNomination and Withdrawal Sent to the Senate
The President sent a nomination for Walter Clayton to be Director of National Intelligence to the Senate and simultaneously withdrew a previous nomination for Clayton as the U.S. Attorney for the Southern District of New York.
Read More75th Anniversary of the White House Navy Mess, 2026
* The President proclaimed June 11, 2026, as a day commemorating the 75th Anniversary of the White House Navy Mess and honoring dedicated food service professionals in the Armed Forces.
Read MoreRestoring American Commercial Fishing in the Pacific
* A Presidential Proclamation modified prior actions establishing specific Marine National Monuments to remove certain monument-based prohibitions on commercial fishing, restoring access to U.S. flagged vessels in designated zones under existing Federal law.
Read More