National Security System

A National Security System is a designation of information systems by the US Government defined in Title 44, Section 3542 of the United States Code. While the Cybersecurity and [Infrastructure Security Agency] has authority for the cybersecurity and protection of federal government information systems in general, any system which is designated as a National Security System is considered critical to the national defense of the United States and is subject to additional and stricter security requirements and standards.

Types

Any information system used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency, the function, operation, or use of which:

involves intelligence activities
involves cryptologic activities related to national security
involves command and control of military forces
involves equipment that is an integral part of a weapon or weapons system
is critical to the direct fulfillment of military or intelligence missions
is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

More succinctly, military weapons and systems, certain defense contractor systems, military encryption systems, and electronic intelligence systems are all considered NSS. Systems that are used for routine administrative and business applications are not.

Oversight and standards

Given the importance of these systems to the United States, several different groups provide security guidance to operators of NSS. The Committee on National Security Systems sets standards, policy, and other guidance for owners to implement and follow. The Director of the National Security Agency serves as the National Manager of NSS and functions as the focal point for cryptography, telecommunications systems security, and information systems security. On 19 January 2022, National Security Memorandum 8 gave the National Manager the authority to issue binding operational directives and emergency directives to NSS owners who must comply within a set timeframe.