Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information

This executive order establishes a comprehensive framework for securing classified computer networks across the federal government following WikiLeaks disclosures. It creates new interagency bodies to coordinate policies, designates the NSA and Defense Secretary as technical standards authorities, mandates insider threat programs at all agencies, and requires binding minimum standards for detecting and preventing unauthorized disclosures.

Federal Register Open PDF 76 FR 63811

Impact dates

Date TBD
Annual agency self-assessment reports to Steering Committee
Date TBD
Annual Executive Agent report to Steering Committee on CNSS work
Date TBD
Annual Steering Committee review of executive branch successes and shortcomings
Oct 7, 2012
Insider Threat Task Force binding minimum standards and guidance due
Jan 5, 2012
Steering Committee first report to President due

Key directives

Agency heads must designate senior official for classified information sharing and safeguarding oversight
Agencies must implement insider threat detection and prevention programs per Task Force standards
Agencies must perform annual self-assessments and report to Steering Committee
Steering Committee co-chaired by OMB and National Security Staff representatives
Steering Committee must prepare report within 90 days, then annually
Executive Agent (SecDef/NSA Director) develops technical safeguarding policies with CNSS
Executive Agent conducts independent compliance assessments annually
Insider Threat Task Force co-chaired by Attorney General and DNI
Task Force must develop and submit government-wide insider threat policy to Steering Committee
Task Force must issue binding minimum standards and guidance within 1 year
Task Force may continue modifying standards after 1 year if appropriations obtained
CISSO provides staff support to Steering Committee and advises on compliance monitoring

Timeline

Immediate

Steering Committee established with co-chairs from OMB and National Security Staff
CISSO established within PM-ISE office
Executive Agent role assigned to Secretary of Defense and NSA Director
Insider Threat Task Force established with Attorney General and DNI as co-chairs
agency heads must designate senior officials for classified information oversight

Near term (90d)

Steering Committee must prepare first report to President by January 5, 2012
agencies must begin implementing insider threat detection programs per forthcoming Task Force guidance

Long term

Insider Threat Task Force must issue binding minimum standards and guidance by October 7, 2012
annual reporting cycle begins for agency self-assessments, Executive Agent reports, and Steering Committee reviews
ongoing independent assessments of agency compliance
potential modification of standards contingent on appropriations after year one

Risks & tensions

Privacy and civil liberties protections are stated as required but lack specific enforcement mechanisms; implementation depends on agency discretion
Task Force continuation after year one is explicitly appropriations-dependent, creating uncertainty about sustained oversight
Whistleblower protections reference existing statutes but do not create new rights; tension with aggressive insider monitoring programs
NSA's dual role as Executive Agent and signals intelligence agency may raise concerns about domestic surveillance boundaries
Section 7(d) requires advance consultation for facility/system examinations, potentially limiting oversight effectiveness
Multiple overlapping authorities (SecDef, DNI, Attorney General, DHS, Energy) create coordination challenges that the Steering Committee must resolve