National Security Presidential Memorandum/NSPM-12

Key Points

• Trump signed a presidential memorandum that sets new cybersecurity standards for National Security Systems used by the Department of War, Intelligence Community, and civilian agencies that handle classified information. It replaces two older directives dating back to 1990 and 2022.
• The NSA Director is designated as the National Manager for all National Security Systems, with broad authority to issue emergency directives to agencies, serve as the government's cryptologic authority, and assess cybersecurity posture across government.
• The Committee on National Security Systems is re-established to set baseline cybersecurity requirements for all national security systems, hold agencies accountable, and issue binding directives. It operates under National Security Council coordination with members from DOW, DNI, OMB, and NSA.
• Agencies must update incident reporting within 60 days and maintain yearly inventories of all their national security systems. New reporting thresholds will be set to ensure government-wide awareness of cyber incidents.
• The memorandum requires agencies to develop secure cloud hosting standards at multiple classification levels within 90 to 120 days, including configuration baselines for Secret, Top Secret, and other sensitive environments.