Who this is for: Defense contractors, DoD AI program managers, ISSMs, C3PAOs, intelligence community compliance officers, and legal counsel advising on national security AI obligations.
Status: Signed June 5, 2026. NSPM-11 replaces NSM-25 (Biden era). Four pillars: Adoption, Adaptation, Assurance, Accountability. Binding on DoD and IC agencies; flows to contractors via DFARS and procurement clauses.
Contents
1. Overview -- NSPM-11's Four Pillars 2. Obligation Mapping 3. Procedure Detail Cards 4. Quick Reference -- Examiner Questions 5. Quick Start 6. References and Related Guides1. Overview -- NSPM-11's Four Pillars
NSPM-11 establishes the policy framework for AI adoption across the national security enterprise. It replaces Biden-era NSM-25 and shifts the posture from cautious governance to accelerated deployment with accountability guardrails. The memorandum is organized around four pillars:
Pillar 1: Adoption
Accelerated AI deployment across DoD and the intelligence community. Agencies must identify priority AI projects and treat obstacles to AI deployment as operational risks. The memorandum frames bureaucratic delay as a national security vulnerability, requiring agencies to actively remove barriers to fielding AI capabilities.
Pillar 2: Adaptation
Workforce and infrastructure must evolve with AI. NSPM-11 imposes data federation requirements and references the DoD Data Decrees mandating federated data catalogues. Agencies must ensure that personnel, training pipelines, and data infrastructure keep pace with AI system capabilities as they mature in operational environments.
Pillar 3: Assurance
AI systems must be tested, evaluated, and verified before and during deployment. Systems cannot be disabled or altered without government approval. Testing and evaluation frameworks are required for all AI systems operating in national security contexts, with continuous monitoring obligations that extend beyond initial deployment authorization.
Pillar 4: Accountability
Clear lines of responsibility for AI outcomes. NSPM-11 explicitly prohibits AI systems from censoring free speech, embedding ideological bias, or conducting unauthorized surveillance. Accountability flows from the system owner through the chain of command, and evidence of compliance must be auditable.
2. Obligation Mapping
| NSPM-11 Requirement | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| AI system cannot be disabled/altered without approval | AI-SAFE.1 | Safe state transition | Trigger code, actions suspended, recovery status |
| Testing and evaluation | AI-PERF.1 | Performance validation | Metrics evaluated, benchmark type |
| Adversarial robustness | AI-ROBUST.1 | Robustness evaluation | Perturbations tested, survival count |
| Model integrity verification | AI-MDL.1 | Model weight integrity | Model hash matches approved registry |
| Agent identity for AI agents | AI-ID.1 | Agent identity binding | Agent identity bound to every inference |
| Cybersecurity controls | AI-CYBER.1 | Security assessment | Security assessment against frameworks |
| Inference provenance | AI-INF.1 | Inference chain | Model hash, prompt hash, response hash |
| Transparency/explainability | AI-TRANS.1 + AI-EXPL.1 | Disclosure and explanation | Disclosure type, explanation method |
| Drift monitoring | AI-DRIFT.1 | Drift detection | Metrics evaluated, drift count, type |
| Lifecycle management | AI-LCM.1 | Lifecycle transition | Lifecycle stage, model version, chain linkage |
| Audit trail integrity | AI-AUDIT.1 | Audit chain verification | Entry count, tamper detection |
| Supply chain security | AI-SBOM.1 | AI bill of materials | Component count, hash, format |
The mapping covers all four pillars. Assurance requirements (testing, robustness, integrity) produce the densest evidence chain. Accountability requirements (identity, provenance, audit trail) create the traceability that NSPM-11 demands for clear lines of responsibility.
3. Procedure Detail Cards
System Integrity and Tamper Protection
What NSPM-11 requires: AI systems deployed in national security contexts cannot be disabled or altered without government approval. This is one of the sharpest requirements in the memorandum -- it applies to both the operational system and the underlying model weights.
How SWT3 addresses it: AI-SAFE.1 witnesses safe state transitions, recording the trigger code (who or what initiated the change), the count of actions suspended during the transition, and the recovery status. AI-MDL.1 witnesses model integrity by verifying weight hashes against an approved registry at every deployment and at runtime checkpoints. Together, these anchors create a tamper-evident chain: any unauthorized modification or shutdown produces either a FAIL anchor or a gap in the expected anchor sequence.
Query AI-MDL.1 anchors to demonstrate continuous model integrity verification. The model hash in each anchor must match the government-approved baseline. For AI-SAFE.1, show that every state transition has an anchor with a valid trigger code traceable to an authorized individual or process. Gaps in the anchor chain indicate periods where the system was altered without producing evidence -- flag these for investigation.
Inference Provenance and Agent Identity
What NSPM-11 requires: The Accountability pillar demands clear lines of responsibility for AI outcomes. Every AI-generated output must be traceable to a specific system, model version, and operational context. AI agents acting autonomously must carry identity that links their actions to an accountable owner.
How SWT3 addresses it: AI-INF.1 records the model hash, prompt hash, and response hash for every inference, creating a cryptographic chain from input to output. AI-ID.1 binds agent identity to every inference, ensuring that autonomous AI actions are attributable. The combination means that any AI output in the national security enterprise can be traced backward through the evidence chain to determine what model produced it, what input triggered it, and which agent identity was responsible.
Demonstrate that every AI-INF.1 anchor has a corresponding AI-ID.1 anchor with matching timestamps. The agent_id factor in AI-ID.1 must resolve to a registered identity in the organization's agent registry. For classified environments, show that clearing levels are applied correctly -- inference provenance at Level 2 (Sensitive) or Level 3 (Classified) should redact prompt and response content while preserving the hash chain.
Assurance Testing Chain
What NSPM-11 requires: The Assurance pillar mandates that AI systems be tested, evaluated, and verified. This includes performance benchmarking, adversarial robustness testing, and cybersecurity assessment against applicable frameworks. Testing must occur before deployment authorization and continue throughout the system lifecycle.
How SWT3 addresses it: AI-PERF.1 witnesses performance validation events, recording the metrics evaluated and benchmark type. AI-ROBUST.1 witnesses adversarial robustness testing, recording perturbation types tested and survival count. AI-CYBER.1 witnesses cybersecurity assessments against frameworks such as NIST 800-53 or the CMMC model. The three procedures create layered assurance evidence: the system performs correctly (PERF), resists adversarial manipulation (ROBUST), and meets security baselines (CYBER).
Present the three procedure anchors as a unified assurance package. AI-PERF.1 anchors should show recurring benchmark evaluations with consistent or improving metrics. AI-ROBUST.1 anchors should demonstrate that adversarial testing covers the threat profile relevant to the system's operational context. AI-CYBER.1 anchors should reference the specific security framework required by the ATO package. All three should show recent timestamps -- stale assurance evidence undermines the continuous monitoring requirement.
Adaptation Evidence
What NSPM-11 requires: The Adaptation pillar requires that AI systems and their supporting infrastructure evolve with operational needs. Systems must be monitored for performance degradation, and lifecycle transitions (training, deployment, retraining, retirement) must be documented and authorized.
How SWT3 addresses it: AI-DRIFT.1 witnesses drift detection events, recording the metrics evaluated, drift count, and drift type (data drift, concept drift, model decay). AI-LCM.1 witnesses lifecycle transitions with chain linkage, connecting each stage (development, staging, production, retirement) into a verifiable sequence. Together, these procedures prove that the system is being actively monitored for degradation and that every lifecycle change is documented with cryptographic evidence linking back to the previous state.
AI-DRIFT.1 anchors should appear at regular intervals matching the organization's monitoring cadence. FAIL verdicts indicate detected drift -- cross-reference with AI-LCM.1 anchors to show that drift triggered an appropriate lifecycle action (retraining, rollback, or retirement). The chain linkage in AI-LCM.1 is critical: each lifecycle anchor should reference the previous anchor's fingerprint, creating an unbroken chain from initial deployment through every subsequent change.
4. Quick Reference -- Examiner Questions
| Examiner Question | Where to Look |
|---|---|
| Can AI systems be modified without authorization? | AI-SAFE.1 + AI-MDL.1 anchors -- every state change and model hash verification is recorded with trigger identity |
| How do you verify AI system performance? | AI-PERF.1 anchors -- benchmark type, metrics evaluated, and pass/fail verdict for each evaluation cycle |
| Who is accountable for AI agent actions? | AI-ID.1 anchors -- agent identity bound to every inference, traceable to registered owner |
| Can you trace an AI output to its inputs? | AI-INF.1 anchors -- model hash, prompt hash, response hash form a cryptographic provenance chain |
| How is adversarial robustness demonstrated? | AI-ROBUST.1 anchors -- perturbation types, survival count, and test framework referenced |
| What happens when model drift is detected? | AI-DRIFT.1 + AI-LCM.1 anchors -- drift detection triggers lifecycle action with chain linkage |
| Is there a complete audit trail for AI operations? | AI-AUDIT.1 anchors -- entry count and tamper detection verify audit chain integrity |
| What components make up the AI system? | AI-SBOM.1 anchors -- component count, format, and hash of the AI bill of materials |
5. Quick Start
pip install swt3-ai
# Initialize with defense profile
swt3 init --profile defense-govcon --tenant YOUR_TENANT
# Run the demo
python -m swt3_ai.demo
# TypeScript
npm install @tenova/swt3-ai
npx swt3-init --profile defense-govcon
Full SDK documentation: sovereign.tenova.io/docs
Create a free account: sovereign.tenova.io/signup