EO 13587 Title 3—The President Executive Order 13587 of October 7 2011 Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information By the authority vested in me as President by the Constitution and the laws of the United States of America and in order to ensure the responsible sharing and safeguarding of classified national security information classified information on computer networks it is hereby ordered as follows Section 1 Policy Our Nation’s security requires classified information to be shared immediately with authorized users around the world but also requires sophisticated and vigilant means to ensure it is shared securely Computer networks have individual and common vulnerabilities that require coordinated decisions on risk management This order directs structural reforms to ensure responsible sharing and safeguarding of classified information on computer networks that shall be consistent with appropriate protections for privacy and civil liberties Agencies bear the primary responsibility for meeting these twin goals These structural reforms will ensure coordinated interagency development and reliable implementation of policies and minimum standards regarding information security personnel security and systems security address both internal and external security threats and vulnerabilities and provide policies and minimum standards for sharing classified information both within and outside the Federal Government These policies and minimum standards will address all agencies that operate or access classified computer networks all users of classified computer networks including contractors and others who operate or access classified computer networks controlled by the Federal Government and all classified information on those networks Sec 2 General Responsibilities of Agencies Sec 2 1 The heads of agencies that operate or access classified computer networks shall have responsibility for appropriately sharing and safeguarding classified information on computer networks As part of this responsibility they shall a designate a senior official to be charged with overseeing classified information sharing and safeguarding efforts for the agency b implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force established in section 6 of this order erowe on DSK2VPTVN1PROD with c perform self-assessments of compliance with policies and standards issued pursuant to sections 3 3 5 2 and 6 3 of this order as well as other applicable policies and standards the results of which shall be reported annually to the Senior Information Sharing and Safeguarding Steering Committee established in section 3 of this order d provide information and access as warranted and consistent with law and section 7 d of this order to enable independent assessments by the Executive Agent for Safeguarding Classified Information on Computer Networks and the Insider Threat Task Force of compliance with relevant established policies and standards and 276 VerDate Mar 15 2010 10 26 Aug 24 2012 Jkt 226006 PO 00000 Frm 00290 Fmt 8090 Sfmt 8090 Y SGML 226006T XXX 226006T Executive Orders EO 13587 e detail or assign staff as appropriate and necessary to the Classified Information Sharing and Safeguarding Office and the Insider Threat Task Force on an ongoing basis Sec 3 Senior Information Sharing and Safeguarding Steering Committee Sec 3 1 There is established a Senior Information Sharing and Safeguarding Steering Committee Steering Committee to exercise overall responsibility and ensure senior-level accountability for the coordinated interagency development and implementation of policies and standards regarding the sharing and safeguarding of classified information on computer networks Sec 3 2 The Steering Committee shall be co-chaired by senior representatives of the Office of Management and Budget and the National Security Staff Members of the committee shall be officers of the United States as designated by the heads of the Departments of State Defense Justice Energy and Homeland Security the Office of the Director of National Intelligence the Central Intelligence Agency and the Information Security Oversight Office within the National Archives and Records Administration ISOO as well as such additional agencies as the co-chairs of the Steering Committee may designate Sec 3 3 The responsibilities of the Steering Committee shall include a establishing Government-wide classified information sharing and safeguarding goals and annually reviewing executive branch successes and shortcomings in achieving those goals b preparing within 90 days of the date of this order and at least annually thereafter a report for the President assessing the executive branch’s successes and shortcomings in sharing and safeguarding classified information on computer networks and discussing potential future vulnerabilities c developing program and budget recommendations to achieve Government-wide classified information sharing and safeguarding goals d coordinating the interagency development and implementation of priorities policies and standards for sharing and safeguarding classified information on computer networks e recommending overarching policies when appropriate for promulgation by the Office of Management and Budget or the ISOO f coordinating efforts by agencies the Executive Agent and the Task Force to assess compliance with established policies and standards and recommending corrective actions needed to ensure compliance g providing overall mission guidance for the Program Manager-Information Sharing Environment PM–ISE with respect to the functions to be performed by the Classified Information Sharing and Safeguarding Office established in section 4 of this order and erowe on DSK2VPTVN1PROD with h referring policy and compliance issues that cannot be resolved by the Steering Committee to the Deputies Committee of the National Security Council in accordance with Presidential Policy Directive PPD–1 of February 13 2009 Organization of the National Security Council System Sec 4 Classified Information Sharing and Safeguarding Office Sec 4 1 There shall be established a Classified Information Sharing and Safeguarding Office CISSO within and subordinate to the office of the 277 VerDate Mar 15 2010 10 26 Aug 24 2012 Jkt 226006 PO 00000 Frm 00291 Fmt 8090 Sfmt 8090 Y SGML 226006T XXX 226006T EO 13587 Title 3—The President PM–ISE to provide expert full-time sustained focus on responsible sharing and safeguarding of classified information on computer networks Staff of the CISSO shall include detailees as needed and appropriate from agencies represented on the Steering Committee Sec 4 2 The responsibilities of CISSO shall include a providing staff support for the Steering Committee b advising the Executive Agent for Safeguarding Classified Information on Computer Networks and the Insider Threat Task Force on the development of an effective program to monitor compliance with established policies and standards needed to achieve classified information sharing and safeguarding goals and c consulting with the Departments of State Defense and Homeland Security the ISOO the Office of the Director of National Intelligence and others as appropriate to ensure consistency with policies and standards under Executive Order 13526 of December 29 2009 Executive Order 12829 of January 6 1993 as amended Executive Order 13549 of August 18 2010 and Executive Order 13556 of November 4 2010 Sec 5 Executive Agent for Safeguarding Classified Information on Computer Networks Sec 5 1 The Secretary of Defense and the Director National Security Agency shall jointly act as the Executive Agent for Safeguarding Classified Information on Computer Networks the ‘‘Executive Agent’’ exercising the existing authorities of the Executive Agent and National Manager for national security systems respectively under National Security Directive NSD–42 of July 5 1990 as supplemented by and subject to this order Sec 5 2 The Executive Agent’s responsibilities in addition to those specified by NSD–42 shall include the following a developing effective technical safeguarding policies and standards in coordination with the Committee on National Security Systems CNSS as re-designated by Executive Orders 13286 of February 28 2003 and 13231 of October 16 2001 that address the safeguarding of classified information within national security systems as well as the safeguarding of national security systems themselves b referring to the Steering Committee for resolution any unresolved issues delaying the Executive Agent’s timely development and issuance of technical policies and standards c reporting at least annually to the Steering Committee on the work of CNSS including recommendations for any changes needed to improve the timeliness and effectiveness of that work and erowe on DSK2VPTVN1PROD with d conducting independent assessments of agency compliance with established safeguarding policies and standards and reporting the results of such assessments to the Steering Committee Sec 6 Insider Threat Task Force Sec 6 1 There is established an interagency Insider Threat Task Force that shall develop a Government-wide program insider threat program for deterring detecting and mitigating insider threats including the safeguarding of classified information from exploitation compromise or other unauthorized disclosure taking into account risk levels as well as the distinct 278 VerDate Mar 15 2010 10 26 Aug 24 2012 Jkt 226006 PO 00000 Frm 00292 Fmt 8090 Sfmt 8090 Y SGML 226006T XXX 226006T Executive Orders EO 13587 needs missions and systems of individual agencies This program shall include development of policies objectives and priorities for establishing and integrating security counterintelligence user audits and monitoring and other safeguarding capabilities and practices within agencies Sec 6 2 The Task Force shall be co-chaired by the Attorney General and the Director of National Intelligence or their designees Membership on the Task Force shall be composed of officers of the United States from and designated by the heads of the Departments of State Defense Justice Energy and Homeland Security the Office of the Director of National Intelligence the Central Intelligence Agency and the ISOO as well as such additional agencies as the co-chairs of the Task Force may designate It shall be staffed by personnel from the Federal Bureau of Investigation and the Office of the National Counterintelligence Executive ONCIX and other agencies as determined by the co-chairs for their respective agencies and to the extent permitted by law Such personnel must be officers or full-time or permanent part-time employees of the United States To the extent permitted by law ONCIX shall provide an appropriate work site and administrative support for the Task Force Sec 6 3 The Task Force’s responsibilities shall include the following a developing in coordination with the Executive Agent a Governmentwide policy for the deterrence detection and mitigation of insider threats which shall be submitted to the Steering Committee for appropriate review b in coordination with appropriate agencies developing minimum standards and guidance for implementation of the insider threat program’s Government-wide policy and within 1 year of the date of this order issuing those minimum standards and guidance which shall be binding on the executive branch c if sufficient appropriations or authorizations are obtained continuing in coordination with appropriate agencies after 1 year from the date of this order to add to or modify those minimum standards and guidance as appropriate d if sufficient appropriations or authorizations are not obtained recommending for promulgation by the Office of Management and Budget or the ISOO any additional or modified minimum standards and guidance developed more than 1 year after the date of this order e referring to the Steering Committee for resolution any unresolved issues delaying the timely development and issuance of minimum standards f conducting in accordance with procedures to be developed by the Task Force independent assessments of the adequacy of agency programs to implement established policies and minimum standards and reporting the results of such assessments to the Steering Committee erowe on DSK2VPTVN1PROD with g providing assistance to agencies as requested including through the dissemination of best practices and h providing analysis of new and continuing insider threat challenges facing the United States Government Sec 7 General Provisions a For the purposes of this order the word ‘‘agencies’’ shall have the meaning set forth in section 6 1 b of Executive Order 13526 of December 29 2009 279 VerDate Mar 15 2010 10 26 Aug 24 2012 Jkt 226006 PO 00000 Frm 00293 Fmt 8090 Sfmt 8090 Y SGML 226006T XXX 226006T EO 13587 Title 3—The President b Nothing in this order shall be construed to change the requirements of Executive Orders 12333 of December 4 1981 12829 of January 6 1993 12968 of August 2 1995 13388 of October 25 2005 13467 of June 30 2008 13526 of December 29 2009 13549 of August 18 2010 and their successor orders and directives c Nothing in this order shall be construed to supersede or change the authorities of the Secretary of Energy or the Nuclear Regulatory Commission under the Atomic Energy Act of 1954 as amended the Secretary of Defense under Executive Order 12829 as amended the Secretary of Homeland Security under Executive Order 13549 the Secretary of State under title 22 United States Code and the Omnibus Diplomatic Security and Antiterrorism Act of 1986 the Director of ISOO under Executive Orders 13526 and 12829 as amended the PM–ISE under Executive Order 13388 or the Intelligence Reform and Terrorism Prevention Act of 2004 as amended the Director Central Intelligence Agency under NSD–42 and Executive Order 13286 as amended the National Counterintelligence Executive under the Counterintelligence Enhancement Act of 2002 or the Director of National Intelligence under the National Security Act of 1947 as amended the Intelligence Reform and Terrorism Prevention Act of 2004 as amended NSD–42 and Executive Orders 12333 as amended 12968 as amended 13286 as amended 13467 and 13526 d Nothing in this order shall authorize the Steering Committee CISSO CNSS or the Task Force to examine the facilities or systems of other agencies without advance consultation with the head of such agency nor to collect information for any purpose not provided herein e The entities created and the activities directed by this order shall not seek to deter detect or mitigate disclosures of information by Government employees or contractors that are lawful under and protected by the Intelligence Community Whistleblower Protection Act of 1998 Whistleblower Protection Act of 1989 Inspector General Act of 1978 or similar statutes regulations or policies f With respect to the Intelligence Community the Director of National Intelligence after consultation with the heads of affected agencies may issue such policy directives and guidance as the Director of National Intelligence deems necessary to implement this order g Nothing in this order shall be construed to impair or otherwise affect 1 the authority granted by law to an agency or the head thereof or 2 the functions of the Director of the Office of Management and Budget relating to budgetary administrative or legislative proposals h This order shall be implemented consistent with applicable law and appropriate protections for privacy and civil liberties and subject to the availability of appropriations i This order is not intended to and does not create any right or benefit substantive or procedural enforceable at law or in equity by any party against the United States its departments agencies or entities its officers employees or agents or any other person erowe on DSK2VPTVN1PROD with BARACK OBAMA The White House October 7 2011 280 VerDate Mar 15 2010 10 26 Aug 24 2012 Jkt 226006 PO 00000 Frm 00294 Fmt 8090 Sfmt 8090 Y SGML 226006T XXX 226006T