National Security Presidential Memorandum 12, or NSPM-12, signed June 12, 2026, establishes a renewed policy direction for the cybersecurity of National Security Systems (NSS). For Department of War programs, Intelligence Community missions, and Federal Civilian Executive Branch agencies that own or operate NSS, the message is clear: cybersecurity for these systems is becoming more centralized, more measurable, and more accountable.
NSPM-12 re-establishes the Committee on National Security Systems to enhance accountability and coordination across NSS cybersecurity. It also directs CNSS to establish baseline cybersecurity requirements for all NSS and hold NSS owners and operators accountable for required security measures. For NSS owners, OEMs, and systems integrators, that creates a timely opportunity to reassess how mission data at rest is protected across the endpoints, tactical systems, edge servers, and deployable platforms that support national-security operations.
The memorandum also strengthens the role of the Director of the National Security Agency as the National Manager for NSS and as the cryptologic authority for NSS. That role includes responsibilities around NSS security standards, cybersecurity techniques, products, solutions, equipment, and minimum standards for protecting cryptographic and technical security material.
That distinction matters because NSS carry a different mission and risk profile than ordinary enterprise systems. They support military, intelligence, and national-security missions. They may process classified information. They may operate in contested cyber environments. And they may depend on endpoints, tactical systems, edge servers, deployable kits, removable storage, and disconnected platforms that do not fit neatly inside traditional enterprise security models.
NSPM-12 is a National Security Presidential Memorandum signed June 12, 2026 that resets how the U.S. government governs the cybersecurity of National Security Systems, the systems that support military, intelligence, and national-security missions. It re-establishes the Committee on National Security Systems (CNSS) as the coordination and accountability body, directs CNSS to set baseline cybersecurity requirements for all NSS, strengthens the NSA Director’s role as National Manager, and names the commercial cryptographic standard NSS must follow. The existing ‘NSS Cybersecurity Is Moving Toward Stronger Accountability’ section then continues as published.”
Data-at-Rest (DAR) protection is often treated as a basic IT control.
A device has encryption enabled. A policy is applied. A compliance box is checked. The conversation moves on.
That mindset does not fit the realities of National Security Systems. In NSS environments, the question is not simply whether encryption exists. The question is whether the protection architecture is appropriate for the mission, the data, the operating environment, and the level of assurance required.
Mission data may reside far beyond traditional endpoints. It may be stored on tactical laptops, ruggedized workstations, deployable servers, ISR processing nodes, local AI systems, unmanned platforms, removable media, transportable storage, and fielded systems operating in disconnected or bandwidth-constrained environments.
Those systems can create serious Data-at-Rest risk.
A device can be lost. A tactical system can be captured. A removable drive can be misplaced. A forward-deployed platform can be tampered with. A system operating outside normal enterprise management can store mission data longer than intended. Even inside controlled facilities, local storage can become a point of exposure if authentication, key protection, recovery procedures, or administrative workflows are not designed for high-assurance environments.
For NSS owners and operators, Data-at-Rest protection must be evaluated as part of the mission architecture. That means looking beyond whether a drive is encrypted and asking how the full protection model works before data becomes available.
NSPM-12 reinforces the importance of cryptographic assurance for National Security Systems. The memorandum states that NSS must meet or exceed NIST cybersecurity standards unless CNSS provides otherwise. It also identifies CNSS Policy 15, successor policy, or interim National Manager guidance as the commercial cryptographic standard for NSS.
For programs using commercial cryptographic technologies to protect sensitive or classified mission data, that language matters. It reinforces the need for security architectures that align with NSA and CNSS expectations, especially when commercial technologies are used in environments where compromise could affect national-security missions.
For Data-at-Rest, that distinction is critical. The objective is not simply stronger encryption in the abstract. The objective is a protection architecture designed to reduce the risk that one exploited component, one recovery path, one trusted platform behavior, or one misconfiguration can expose mission data.
That requires attention to how authentication occurs, when protected data becomes available, how encryption keys are created and protected, what components are trusted before the operating system loads, and how the system is recovered, updated, and sustained over time.
The Data-at-Rest challenge becomes more visible as mission systems become more distributed. Defense and intelligence operations increasingly depend on systems that operate closer to the mission: mobile endpoints, tactical kits, ruggedized servers, edge compute, unmanned systems, deployable infrastructure, and AI-enabled platforms that generate, process, and store sensitive data locally.
These environments often do not look like traditional enterprise IT. They may be disconnected. They may be mobile. They may operate under strict change-control procedures. They may sit outside continuously monitored facilities. They may support missions where data cannot always be immediately centralized, transmitted, or sanitized through typical workflows.
That creates a different kind of risk.
Network security controls cannot protect data on a powered-off device. Enterprise monitoring may not reach a disconnected platform. Access control policies may not matter if protected data becomes available through a recovery workflow or trusted boot behavior. Standard administrative processes may not be sufficient when a system is lost, seized, stolen, or analyzed offline.
Data-at-Rest protection is the control that remains closest to the data. For NSS environments, that makes DAR a mission assurance issue, not just an endpoint security feature.
As NSS cybersecurity moves toward stronger governance, inventories, baselines, and accountability, mission owners should be prepared to examine how sensitive and classified data is protected when it resides locally on mission systems. That starts with understanding where mission data persists and how the Data-at-Rest architecture performs under realistic mission conditions.
That requires asking:
These questions matter because Data-at-Rest risk is not theoretical. It exists anywhere sensitive mission data is stored on systems that can be accessed, transported, captured, or analyzed outside intended controls.
NSPM-12 makes this conversation more urgent by pushing NSS cybersecurity toward stronger baselines, clearer accountability, and greater alignment with NSA and CNSS governance.
For many mission programs, the challenge is not recognizing that Data-at-Rest protection matters. The challenge is implementing it in a way that is defensible, repeatable, and operationally sustainable.
Custom security architectures can be slow and difficult to maintain. One-off platform decisions can create inconsistent protection across programs. Default commercial OS encryption, such as BitLocker, does not provide the assurance required for classified Data-at-Rest. And unmanaged encryption deployments can introduce operational risk if they are difficult to configure, update, recover, or decommission in the field.
NSA’s Commercial Solutions for Classified program provides a pathway for using properly configured commercial technologies in layered solutions to protect classified National Security System data.
For Data-at-Rest, CSfC is not simply a compliance label. It is an architecture-based approach that relies on approved components, defined configuration requirements, strong authentication, independent layers of protection, and operational discipline across the lifecycle of the system. That is especially important as agencies review NSS inventories and assess where sensitive or classified data persists across endpoints, tactical systems, edge servers, removable media, and deployable platforms.
If protection cannot be deployed where the data lives, it cannot reduce risk at mission scale. DAR protection needs to be technically strong, but it also needs to be operationally practical. It must support provisioning, configuration, authentication, updates, monitoring, decommissioning, and secure sanitization across the environments where mission systems operate.
NSPM-12 creates an opportunity for NSS owners, OEMs, and systems integrators to reassess how mission data is protected at rest. As agencies strengthen governance, update inventories, align to CNSS requirements, and prepare for greater accountability, Data-at-Rest protection should be built into mission platforms from the start.
That is especially important for systems that store sensitive or classified information locally, operate outside traditional enterprise boundaries, or support missions where physical compromise is a realistic threat.
DAR should not be treated as an afterthought. It should not be reduced to whatever encryption capability ships with the operating system. And it should not be solved differently on every platform, program, or deployment.
NSS programs need protection models that are aligned to the mission, repeatable across environments, and sustainable across the lifecycle of the system.
That means choosing architectures that account for pre-operating system access, independent protection layers, key protection, approved components, deployment at scale, and secure end-of-life handling.
NSPM-12 reinforces a clear direction for National Security System cybersecurity: stronger governance, stronger accountability, stronger cryptographic assurance, and stronger protection for the systems that support national-security missions.
For Data-at-Rest, the implication is straightforward: mission owners should take a closer look at how sensitive and classified data is protected on the systems where it actually resides. That includes endpoints. It includes tactical kits. It includes edge servers. It includes removable media. It includes unmanned systems. It includes deployable platforms. It includes disconnected systems. And it includes any NSS where local storage becomes part of the mission data footprint.
Cigent helps defense organizations protect sensitive and classified Data-at-Rest with secure storage, Pre-Boot Authentication, and Software Full Drive Encryption capabilities designed for CSfC DAR architectures. By combining hardware-based protection, pre-OS authentication, software encryption, and lifecycle control, Cigent helps mission teams protect data where it lives: on the systems, devices, and platforms that support operations. Cigent components are listed on the NSA CSfC Components List, and Cigent solutions have been tested and validated by organizations including MITRE, NIST, NSA, and NIAP.
As NSS cybersecurity becomes more accountable, Data-at-Rest protection deserves a closer look.
Encryption alone is not enough. NSS programs need the right architecture, the right assurance, and the right protection model for the mission. If you want to see where you stand, start with the CSfC for DAR assessment.
NSPM-12 is a National Security Presidential Memorandum signed June 12, 2026 that strengthens cybersecurity governance for National Security Systems. It re-establishes the Committee on National Security Systems, directs baseline security requirements for all NSS, and reinforces the NSA Director’s role as National Manager.
NSS are information systems supporting military, intelligence, and other national-security missions, including systems that process classified information. They span far more than office networks: tactical kits, deployable servers, unmanned platforms, removable media, and disconnected systems all qualify when they carry mission data.
The memorandum directs the Committee on National Security Systems to establish baseline cybersecurity requirements applying to all NSS and to hold system owners and operators accountable for implementing required security measures, moving NSS security from distributed practice toward measurable, centralized governance.
The Director of the National Security Agency serves as National Manager, the authority responsible for NSS security standards, cybersecurity techniques, approved products and solutions, and minimum standards for protecting cryptographic material. NSPM-12 reinforces that authority.
NSS must meet or exceed applicable NIST cybersecurity standards unless CNSS provides otherwise, and CNSS Policy 15, its successor, or interim National Manager guidance governs the use of commercial cryptography to protect NSS information.
Accountability sits with NSS owners and operators, but the practical effect reaches everyone who builds or integrates mission systems. Platforms that store mission data locally will be inventoried and measured against baselines, so integrators and OEMs should expect data-at-rest architecture questions in requirements.
Because stronger inventories and baselines surface every system where mission data persists locally, and the follow-up question is whether the protection architecture matches the assurance NSS require. Encryption that unlocks on boot, or depends on one layer, does not answer that question.
No. Default operating system encryption is a single software layer whose unlock path runs through the platform it protects. For classified data at rest, NSA’s CSfC program requires two independent layers, hardware encryption with pre-boot authentication plus independent software full drive encryption.
NSPM-12 sets governance and accountability; CSfC provides the implementation path. For classified data at rest, the CSfC Capability Package defines the layered architecture of approved commercial components that lets programs meet NSA and CNSS expectations in a repeatable, defensible way.
Inventory where sensitive and classified mission data persists locally, evaluate each system against realistic loss and capture scenarios, and confirm the protection architecture authenticates before boot, layers independently, and can be deployed and sustained in the field. The CSfC DAR assessment is a fast first pass.
Kelvin Quezada is a Product Marketing Manager at Cigent, where he leads strategy, positioning, and go-to-market efforts for the company’s Data-at-Rest protection solutions. With more than a decade of experience across cybersecurity deployments, product marketing, and technical enablement, he translates complex technical concepts into clear, mission-focused value for defense programs.
