National Security Presidential Memorandum/NSPM-12

6/12/2026

Presidential Memoranda

View Original

Action Summary

Purpose & Scope: Defines a national cybersecurity policy for National Security Systems (NSS) to ensure uninterrupted military and intelligence operations in contested cyber environments.
Rescissions: Repeals previous directives—NSD‑42 (1990) and NSM‑8 (2022)—to update and streamline NSS cybersecurity measures.
Cybersecurity Governance:
- Committee on National Security Systems (CNSS): Re-established to coordinate and enforce cybersecurity standards across the Department of War (DOW), Intelligence Community (IC), and Federal Civilian Executive Branch (FCEB) Agencies. It operates under a designated NSC staff member, with specific membership and advisory roles.
- National Manager for NSS: The NSA Director assumes a central role responsible for technical advice, emergency directives, cryptographic authority, and overall NSS cybersecurity oversight.
Policy Directives:
- Establishes baseline cybersecurity standards for NSS, aligning them with and often exceeding existing federal standards (e.g., NIST guidelines).
- Empowers the CNSS to issue directives, complementary standards, and emergency actions in the event of identified cyber threats.
- Mandates interagency collaboration, resource efficiency, and coordinated intelligence-sharing with domestic and international partners.
Implementation & Compliance:
- Timelines include: CNSS revising existing directives within 30 days; issuing a policy roadmap within 60 days; and harmonizing NSS policies within 90 days.
- Mandates updated incident reporting standards, comprehensive NSS inventories, and establishment of working groups to ensure compliance and monitor cybersecurity posture.
Cloud & Communication Requirements:
- Directs secure cloud configuration reviews and reporting from accredited service providers.
- Requires recommendations to enhance secure, interoperable, unclassified communications among FCEB, DOW, and IC agencies.
General Provisions: Clarifies definitions and affirms that the memorandum does not override existing authorities, emphasizing adherence to legal frameworks and protection of intelligence sources and methods.

Risks & Considerations

The National Security Presidential Memorandum emphasizes the importance of cybersecurity for National Security Systems (NSS), which could impose stringent compliance requirements on institutions like Vanderbilt University that collaborate with federal agencies. This may necessitate the university to enhance its cybersecurity infrastructure and governance policies.
The focus on accountability for agency heads regarding the defense of NSS introduces risks if Vanderbilt University is involved in research or operations related to NSS. Any failure to comply with these heightened standards could lead to legal repercussions and loss of research funding.
This memorandum fosters a proactive and adaptive cybersecurity ecosystem, which may require Vanderbilt to invest in new technologies and training for staff to stay compliant with ever-evolving cybersecurity requirements.
Potential partnerships with federal agencies for research could be impacted by the strict governance and operational changes required by this memorandum, leading to delays or complications in collaborative efforts.

Impacted Programs

Cybersecurity Research Initiatives at Vanderbilt may see increased scrutiny and demand for compliance with federal cybersecurity standards, affecting how research projects are structured and funded.
The Office of Sponsored Programs may need to reassess its funding strategies and compliance protocols to align with the new cybersecurity requirements outlined in the memorandum.
Programs involving collaboration with the Department of Defense or Intelligence Community may experience shifts in operational protocols and funding opportunities due to the emphasis on national security and cybersecurity.
The Data Governance Office will likely need to enhance its policies and practices to ensure that all data handling complies with the stringent regulations set forth in the memorandum.

Financial Impact

The need to upgrade cybersecurity measures and infrastructure could result in significant financial implications for Vanderbilt University, potentially diverting funds from other critical areas.
Changes in federal funding landscapes due to the memorandum may affect grant opportunities, particularly for projects that do not meet the new cybersecurity standards.
Vanderbilt may encounter increased costs related to compliance activities and potential penalties for non-compliance, which could strain the university’s budget allocations.
As federal contracts and partnerships become more reliant on stringent cybersecurity measures, there could be a shift in the university’s revenue streams, necessitating a reevaluation of financial strategies to adapt to these changes.

Relevance Score: 4 (The order presents a need for potential major changes or transformations of programs.)

Key Actions

The Office of Information Technology at Vanderbilt should develop a robust cybersecurity framework in alignment with the new National Security Presidential Memorandum. This framework should include the establishment of baseline cybersecurity requirements and regular assessments of the cybersecurity posture, ensuring that the university’s systems meet or exceed the standards set for National Security Systems (NSS).
The Cybersecurity Task Force should be re-established to oversee compliance with the new policies introduced in the memorandum. This task force will be responsible for coordinating efforts across university departments to enhance cybersecurity governance and accountability.
Vanderbilt’s Legal and Compliance Office should review existing policies and procedures to ensure they incorporate the requirements outlined in the memorandum, particularly concerning incident reporting and response protocols. This will help mitigate risks associated with cybersecurity threats.
The Office of Federal Relations should engage with federal agencies to stay informed about cybersecurity initiatives and funding opportunities that may arise from the implementation of this memorandum. This engagement could position Vanderbilt to benefit from federal resources aimed at enhancing cybersecurity.
The Research Office should explore opportunities for collaboration with the Department of Defense and other federal agencies in cybersecurity research and development initiatives. This could lead to funding for innovative projects that align with national security interests.

Opportunities

Vanderbilt can leverage the emphasis on improving cybersecurity for National Security Systems by strengthening its partnerships with technology firms and other universities to enhance its cybersecurity capabilities and research.
The university has an opportunity to expand its educational programs related to cybersecurity, preparing students for careers in a field that is increasingly critical to national security and public safety.
By participating in public-private partnerships, Vanderbilt can contribute to the development of best practices in cybersecurity, potentially influencing policies at the national level.
The establishment of a robust incident reporting framework presents an opportunity for Vanderbilt to enhance its incident response capabilities and foster a culture of cybersecurity awareness across the campus.
Collaborating with federal agencies on cybersecurity initiatives could open doors for Vanderbilt to access funding and resources dedicated to enhancing its cybersecurity infrastructure.

Relevance Score: 4 (The memorandum necessitates major process changes to enhance cybersecurity governance and accountability.)

Average Relevance Score: 4.4

Timeline for Implementation

Within 30 days: The CNSS shall revise CNSS Directive 900 of May 2013 and any other policies deemed appropriate (Section 6(a)).
Within 60 days: Multiple actions including issuing a roadmap for NSS policy priorities, recommending and updating incident reporting standards, establishing a working group to deconflict inventory identification, and developing memoranda of agreement for oversight (Sections 6(b)(i), 6(c)(i-iii), 6(d)(ii), and 6(e)).
Within 90 days: Actions include determining which directives to maintain or rescind, reviewing existing CNSS policies, and issuing reports and guidance on cloud security configurations (Sections 6(b)(ii), 6(b)(iii), and 7(a)(ii-iii), (b)).
Within 120 days: The CNSS shall request cloud service providers to provide baselines and recommendations for securing Federal cloud-based systems supporting NSS (Section 7(a)(i)).

Since the shortest timeline is 30 days, this triggers a compliance period in the 30–59 days range.

Relevance Score: 4

Impacted Government Organizations

Vice President’s Office: The memorandum is addressed to the Vice President, thereby involving the Vice President’s office in its oversight and implementation.
Department of State: Tasked with cybersecurity initiatives for national security systems, particularly related to international aspects and interagency collaboration.
Department of the Treasury: Included in the list, indicating its role may include financial oversight related to cybersecurity investments and implementation.
Department of War: Explicitly mentioned to oversee certain aspects through its Chief Information Officer and management of National Security Systems.
Department of Justice: Represented by the Attorney General, its inclusion suggests a role in legal accountability and enforcement of cybersecurity directives.
Department of the Interior: Identified as one of the agencies that must adhere to cybersecurity requirements for their national security systems.
Department of Agriculture: Listed as an affected agency, implying that systems under its purview are subject to updated cybersecurity governance.
Department of Commerce: Plays a role in facilitating interagency coordination and may provide advisory or technical support in cybersecurity measures.
Department of Labor: Included in the memorandum, indicating that cybersecurity policies extend to systems within its operations.
Department of Health and Human Services: Its systems are covered under these directives, ensuring cybersecurity compliance.
Department of Housing and Urban Development: As an affected agency, it must meet the cybersecurity standards for its National Security Systems.
Department of Transportation: Obligated to implement the cybersecurity directives for its systems involved in national security.
Department of Energy: Tasked with ensuring that its systems, including those with potential nuclear security implications, comply with the cybersecurity framework.
Department of Education: Its operational systems that are designated as National Security Systems fall under the cybersecurity governance set forth in the memorandum.
Department of Veterans Affairs: Included as an impacted organization that will need to align its cybersecurity measures with the new standards.
Department of Homeland Security: With a critical role in national cybersecurity, especially through its cybersecurity components, its systems are directly impacted.
The White House Chief of Staff and Deputies: The memorandum addresses key staff members to ensure implementation and interagency coordination at the highest levels in the executive branch.
Office of Management and Budget (OMB): The Director of OMB plays an important role in oversight and resource management within the cybersecurity framework.
Office of the Director of National Intelligence (DNI): Central to coordinating and advising on cybersecurity measures within the Intelligence Community.
Assistant to the President for Science and Technology, and National Security Affairs, and Counsel to the President: These positions are integral in advising on and supporting the implementation of the cybersecurity directives.
Chairman of the Joint Chiefs of Staff: Ensures that the military’s National Security Systems align with the cybersecurity requirements.
Central Intelligence Agency (CIA): As an agency with critical intelligence systems, it is affected particularly where its systems interact with cloud services and cybersecurity directives.
National Security Agency (NSA): Designated as the National Manager for NSS, it plays a central role in leading the cybersecurity initiatives outlined in the memorandum.
General Services Administration (GSA): Through its Administrator role, GSA provides support and facilities as requested in the memo.
National Cyber Director: Involved in setting cybersecurity policies and overseeing compliance across agencies.
Cybersecurity and Infrastructure Security Agency (CISA): Tasked with contributing to the technical guidance and interoperability of cybersecurity measures across all National Security Systems.
Federal Civilian Executive Branch (FCEB) Agencies: Although not individually listed here, the memorandum extends directives to all FCEB agencies that own or operate National Security Systems, ensuring a broad impact.
Intelligence Community (IC) Agencies: Similarly, all agencies within the IC that manage National Security Systems are subject to the updated cybersecurity governance and oversight.

Relevance Score: 5 (The memorandum impacts almost every major executive branch agency and key entities across the federal government, applying government-wide oversight of National Security Systems.)

Responsible Officials

Secretary of War – Responsible for overseeing CNSS operations and the Executive Secretariat through the Department of War Chief Information Officer.
Director of National Intelligence – Implements cybersecurity directives for the Intelligence Community via the IC Chief Information Officer.
Director of the Office of Management and Budget – Manages oversight for Federal Civilian Executive Branch agencies’ adherence to NSS policies through the Federal Chief Information Officer.
Director of the National Security Agency (National Manager for NSS) – Charged with leading cybersecurity governance, issuing emergency directives, and serving as the cryptologic authority for National Security Systems.
CNSS Chair (NSC Staff Member) – Entrusted with coordinating the operations of the Committee on National Security Systems across defense, intelligence, and civilian agencies.
Secretaries of State, Commerce, Energy, and Homeland Security (via their agency CIOs) – Tasked with specific directives on secure cloud configurations and interagency communications as detailed in Section 7 of the memorandum.

Relevance Score: 5 (Directives affect top-level Cabinet officials and senior agency heads responsible for critical national security and cybersecurity policy implementation.)