On June 12, 2026, President Trump signed National Security Presidential Memorandum 12 (NSPM-12), which establishes a new cybersecurity governance framework for National Security Systems (NSS). This framework applies to federal agencies that own or operate NSS, which includes any contractors that operate NSS on behalf of a federal agency.
Key takeaways for government contractors that own or operate NSS include that:
NSPM-12 applies to federal agencies that own or operate NSS, which includes any contractors that own or operate NSS on behalf of a federal agency. NSS has a relatively broad definition that encompasses systems that process classified information, involve intelligence activities, involve command and control of military forces, or are critical to the direct fulfillment of military or intelligence missions. See 44 U.S.C. § 3552. Common types of NSS include cloud service providers, managed security service providers, and systems integrators.
NSPM-12 re-establishes the CNSS as the principal governance body for NSS cybersecurity, and re-designates the Director of the NSA as the National Manager for NSS. Among other things, the Director of the NSA may issue binding emergency directives to any federal agency including directives requiring immediate operational changes to covered systems. The memorandum harmonizes NSS requirements with Executive Order 14306 (June 6, 2025), establishing NIST cybersecurity standards as a mandatory baseline for all NSS unless the CNSS provides otherwise.
NSPM-12 establishes an aggressive implementation timeline that will generate new regulatory requirements in rapid succession:
Any company that owns, operates, or provides services to a system meeting the NSS definition must review its existing cybersecurity posture now. The most immediate obligations are contractual and operational: existing government contracts will need to be reviewed for cybersecurity clauses that may require updating to reflect new CNSS directives; incident response plans must be revised to align with forthcoming reporting thresholds; and NSS inventory requirements must be satisfied as an ongoing compliance matter.
The National Manager’s emergency directive authority is particularly significant. Under NSPM-12, NSA can issue a directive to any agency including civilian agencies requiring immediate action with respect to an NSS, including systems “used or operated by another entity on behalf of an agency.” This means a directive can flow directly to a contractor operating an NSS under a government contract, requiring operational changes on short notice with no requirement for the contractor's consent.
The memorandum also strengthens accountability mechanisms. The CNSS may request government-wide assessments of NSS cybersecurity posture, including performance metrics and compliance results, and CNSS findings may be reported to Congress and the Council of Inspectors General on Integrity and Efficiency. Contractors with deficient cybersecurity postures risk contract non-compliance findings, adverse past performance assessments, and potential False Claims Act exposure where cybersecurity certifications are incorporated into contract representations.
Companies providing cloud services to the federal government at classified levels face discrete obligations under NSPM-12. Within 120 days, cloud service providers accredited to host NSS must submit configuration baselines and security specifications to the CNSS, which will evaluate them against NSS requirements. Providers operating at TS/SCI and SAP classification levels should begin preparing those baseline submissions now and should expect the CNSS cloud security report due within 90 days, to define new accreditation standards that could affect existing FedRAMP authorizations.
The memorandum also establishes NSA as the principal advisor to NSS owners and operators on cross-domain solutions, the hardware and software products that allow data to move between systems operating at different classification levels. Contractors providing or integrating cross-domain solutions should anticipate updated standards and a revised CNSS-approved products list.
Womble Bond Dickinson’s International Trade and National Security Practice attorneys advise defense contractors, intelligence community support companies, and federal agencies on the full spectrum of NSS compliance obligations. Our team has deep experience with CNSS policy frameworks, NSA technical security requirements, contracting structures, and the intersection of cybersecurity obligations with government contracts law. We also advise clients on cybersecurity compliance and related False Claims Act and government contracts enforcement risk.
Specific services include: NSS inventory audits and classification assessments; NIST cybersecurity compliance, contract clause review and modification for CNSS directive compliance; incident response policy drafting and updating; cloud accreditation and FedRAMP-to-NSS gap analysis; and counsel on National Manager emergency directive response.
