NSPM-13, or National Security Presidential Memorandum 13, is a classified directive signed by President Trump in August 2018 that rewired how the United States approves offensive cyber operations. It replaced Presidential Policy Directive 20 and delegated authority over time-sensitive military cyber operations to the Secretary of Defense, so that individual actions no longer had to reach the president’s desk through a consensus-driven interagency review.1U.S. Senate (Angus King). Letter to President Biden Regarding NSPM-13 The memorandum itself remains secret, but its consequences show up in election-defense operations, forward deployments on allied networks, and the operational tempo U.S. Cyber Command has kept up ever since.
What NSPM-13 Changed
The framework before 2018 was PPD-20, signed by President Obama in 2012. Under that directive, nearly every proposed offensive cyber action had to work its way through an interagency review involving the State Department, intelligence agencies, and other stakeholders. The process aimed for consensus, and consensus took time. John Bolton, National Security Advisor when the new memo was drafted, described the old process as “frozen solid.” Operations that might have disrupted an adversary in hours sat in committees for weeks, and many never launched.
NSPM-13 scrapped that architecture. The central change was delegation: rather than routing every offensive cyber action up to the president, the memorandum gave the Secretary of Defense defined authority to approve time-sensitive military cyber operations directly.1U.S. Senate (Angus King). Letter to President Biden Regarding NSPM-13 Other departments and agencies can use the process too, but Defense is the principal user. The practical result was a sharp acceleration in how fast the U.S. military could act in cyberspace.
The Strategy It Enabled
NSPM-13 provided the policy scaffolding for a broader shift the Pentagon adopted in its 2018 Cyber Strategy, built on two linked concepts. “Defend forward” means operating on adversary networks to disrupt threats at their source, including hostile activity that falls below the threshold of armed conflict. If a foreign actor is attacking or preparing to attack U.S. networks, the United States imposes costs rather than wait for the damage to arrive.2U.S. Cyber Command. CYBER 101 – Defend Forward and Persistent Engagement
“Persistent engagement” is the day-to-day operational concept that makes defend forward workable. Cyber operators continuously intercept threats, degrade adversary capabilities, and harden Defense Department networks. The posture moved from reactive to proactive: instead of waiting for an intrusion and investigating afterward, operators try to be present where adversaries plan and stage their attacks, introducing enough uncertainty that adversaries cannot count on their tools or infrastructure surviving contact.2U.S. Cyber Command. CYBER 101 – Defend Forward and Persistent Engagement
The Statutes That Back It Up
NSPM-13 is a presidential memorandum, but it does not stand alone. Congress reinforced the same operational posture in the FY2019 National Defense Authorization Act, and those statutes would remain in force even if the memo were revoked.
Section 394 of Title 10 explicitly affirms the Secretary of Defense’s authority to conduct military cyber operations, including clandestine ones, to defend the United States and respond to malicious foreign cyber activity. Clandestine cyber operations are designated as “traditional military activities” rather than covert action, which means they do not require a presidential finding and are overseen through the armed services committees rather than the intelligence committees.3Office of the Law Revision Counsel. 10 U.S. Code 394 – Authorities Concerning Military Cyber Operations
Section 1642 of the same NDAA gave the National Command Authority a separate statutory basis to order offensive cyber operations against four named nations, Russia, China, North Korea, and Iran, when any of them is conducting an active, systematic, and ongoing campaign of attacks in cyberspace against the United States, including election interference. Operations under Section 1642 are treated as traditional military activities and executed through the Secretary of Defense and the Commander of U.S. Cyber Command. Together, Section 394 and Section 1642 mean the most consequential authorities now rest on a statutory foundation independent of any presidential directive.
Who Runs Operations
U.S. Cyber Command is the unified combatant command that plans and executes military cyber operations, directs cyberspace operations, and integrates cyber expertise across the services.4U.S. Cyber Command. Mission and Vision Tactically, CYBERCOM works through the Cyber Mission Force, made up of teams that support combatant commanders, defend the nation against significant cyber threats, and defend Defense Department networks.5U.S. Government Accountability Office. DOD Cyberspace Operations
The National Security Agency supplies the intelligence backbone. The commander of CYBERCOM also serves as the director of NSA, a “dual-hat” arrangement that has drawn recurring debate. Supporters argue the military gains faster decisions and irreplaceable intelligence access; critics say one person holds too much power and that using intelligence tools for military purposes can burn espionage capabilities. Congress has consistently backed keeping the arrangement in place and has conditioned any future split on CYBERCOM first demonstrating it can independently develop the tools, accesses, and command-and-control systems it currently draws from NSA. Those conditions remain unmet.
Outside the Defense Department, the FBI’s National Cyber Investigative Joint Task Force coordinates cyber threat investigations across nearly two dozen federal agencies. That coordination keeps a military operation from colliding with a criminal investigation or a domestic infrastructure defense already in progress.
Limits, Legal Review, and Vulnerability Decisions
Delegated authority is not open-ended. Every proposed offensive operation must comply with domestic law and the law of armed conflict. Defense Department lawyers review each one for necessity and proportionality, weighing anticipated advantage against potential consequences and civilian harm.6U.S. Department of War. DOD General Counsel Remarks at U.S. Cyber Command Legal Conference NSPM-13 also set up a tiered system that reserves some operations for explicit presidential approval while leaving others within the Secretary of Defense’s authority. The exact dividing lines are classified, but the framework reportedly turns on the target country, escalation risk, the potential for effects to spread beyond the target network, and whether the operation could disrupt diplomatic efforts.
A separate boundary sits on the tools those operations use. Many offensive operations rely on software vulnerabilities the target has not patched, which forces a choice: disclose the flaw so it gets fixed, or keep it for use as a weapon. The Vulnerabilities Equities Process is the interagency mechanism for that call. The stated default is disclosure, on the premise that public cybersecurity and critical-infrastructure protection outweigh most operational value. A vulnerability is retained only when there is a demonstrable, overriding interest in using it for intelligence, law enforcement, or military purposes, weighed against defensive risk, commercial fallout, and effects on international partners.7White House Archives. Vulnerabilities Equities Policy and Process for the United States Government
Operations Attributed to This Framework
Most operations under NSPM-13 remain classified, but several have entered the public record. The most frequently cited is the disruption of Russia’s Internet Research Agency during the 2018 midterm elections, when CYBERCOM reportedly cut internet access to the troll factory on election day. It is widely viewed as the first major test of the memo’s authorities.
Hunt Forward Operations are the defend-forward strategy in its most visible form. CYBERCOM teams travel to partner nations at the host’s invitation to identify malicious activity on their networks. Between 2018 and 2022, the Cyber National Mission Force conducted more than two dozen such deployments.8National Security Archive. Cyber 101 Hunt Forward Operations One of the most consequential was a deployment to Ukraine before Russia’s 2022 invasion, hunting for Russian malware on Ukrainian networks. Malware samples and tactics discovered abroad often carry over to threats facing U.S. networks.
Before NSPM-13 existed, CYBERCOM ran Operation Glowing Symphony against ISIS, later described by the command as the most complex offensive cyberspace operation it had carried out at the time. It targeted ISIS propaganda infrastructure and forced the group to spend time and resources rebuilding.9National Security Archive. USCYBERCOM After Action Assessments Operation Glowing Symphony The friction that operation exposed in the older approval process fed directly into the case for the streamlined authorities that followed.
Congressional Oversight
Speed and secrecy make oversight harder, and Congress responded by writing reporting requirements into successive NDAAs. The primary mechanism is a quarterly briefing to the congressional defense committees under 10 USC 484. Each briefing covers all offensive and significant defensive military cyber operations from the previous quarter, broken out by geographic and functional command, along with the status of legal authorities, any new presidential delegations, adversary challenges, and Cyber Mission Force readiness.10Office of the Law Revision Counsel. 10 USC 484 – Quarterly Cyber Operations Briefings
On top of the quarterly cycle, the Secretary of Defense must deliver a written summary of all named military cyberspace effects operations from the prior calendar year by March 1. When the president delegates cyber authorities to the Secretary, Congress must be notified in writing within 15 days, and the same 15-day clock applies when the Secretary approves a new concept of operations under those delegated authorities.3Office of the Law Revision Counsel. 10 U.S. Code 394 – Authorities Concerning Military Cyber Operations These layered requirements let the armed services committees reconstruct the scope of operations after the fact even when they were not consulted before.
Where the Policy Stands Now
NSPM-13 has not been the last word. Its core innovation drew immediate pushback from agencies that lost their veto in the process, particularly the State Department, which raised concerns that military operations could complicate diplomacy without diplomats even knowing an operation was underway.
The Biden administration ran an extended interagency review. Co-chairs of the Cyberspace Solarium Commission publicly warned against limiting the Secretary of Defense’s freedom of action, arguing the pre-2018 status quo had proved unworkable.1U.S. Senate (Angus King). Letter to President Biden Regarding NSPM-13 The review reportedly kept the delegated authorities but built in a more structured way for the State Department and other agencies to raise diplomatic concerns, including a documented dispute-resolution mechanism, and folded the result into the Biden administration’s broader national security memoranda framework.
The second Trump administration, which took office in January 2025, inherited that modified framework. No public directive specifically addressing NSPM-13 has been disclosed, though the administration released a Cyber Strategy for America in early 2026 along with related executive orders. The underlying statutes, 10 USC 394 and Section 1642, remain in force regardless of which administration holds office, and the bipartisan congressional consensus favoring aggressive cyber operations has held. The operational tempo NSPM-13 set in motion looks unlikely to slow, even as the specific policy mechanisms keep evolving.