Navigating the New Presidential Memorandum on Transnational Cyber-Enabled Crime

Cyber-enabled crime continues to create real challenges for businesses, government agencies and the people they serve. A new White House National Security Presidential Memorandum (NSPM) aims to expand how the U.S. works with qualified private organizations to disrupt foreign cybercriminal groups.

This is what the policy could mean for security leaders, risk teams and organizations preparing for what comes next.

The NSPM memorandum establishes a framework that enables qualified private organizations to support government-directed efforts to disrupt foreign cybercriminal organizations, also known as cyber-enabled transnational criminal organizations (CE-TCOs). According to the White House, the initiative is intended to strengthen U.S. capacity to combat ransomware groups, fraud networks, cyber-enabled financial crime and other transnational criminal threats.

CDW’s Global Security Strategy Office (GSSO) views this initiative as part of a broader shift in U.S. cyber strategy, bringing together federal authority and specialized private-sector expertise.

While participation will likely be limited to a relatively small group of organizations capable of meeting stringent operational, security and oversight requirements, the impact is expected to extend across the broader cybersecurity market through heightened expectations for information sharing, supply-chain security, compliance and the need for resilience.

The memorandum directs the National Coordination Center (NCC) to establish a program that authorizes approved companies to conduct cyber surveillance operations and cyber effects operations against foreign CE-TCOs under federal supervision.

Participating organizations must enter into formal contractual agreements with the Department of Justice (DOJ) or Department of Homeland Security (DHS), complete extensive vetting processes and operate under government oversight.

The memorandum also establishes safeguards governing activities that could impact U.S. persons or domestic systems. In addition, it mandates the development of implementation procedures within 60 days after August 12, 2026, outlining operational standards, personnel requirements, facility security controls and reporting obligations necessary to support the program.

Telemetry sharing raises immediate governance questions. The most significant near-term issue for customers is telemetry sharing. Many organizations have not fully addressed these considerations within their existing governance frameworks.

Participating organizations may seek to use threat intelligence collected through normal business operations, raising questions around:

• Customer consent
• Privacy obligations
• Contractual language
• Data ownership
• Legal liability

Disruption activity could increase risk across participating entities. Increased disruption activity against criminal organizations could create displacement effects. Adversaries may redirect attacks toward suppliers, managed service providers, integrators and other organizations connected to participating entities. This possibility makes third-party risk management and supply-chain visibility increasingly important.

Implementation procedures will expand operational requirements. The implementation procedures expected in late 2026 may prove more consequential than the memorandum itself. These procedures are expected to establish operational baselines for security controls, personnel vetting, secure environments, monitoring and auditability.

There are several strategic factors driving the policy.

Rising Cybercrime Threats. From a national security perspective, ransomware groups, cyber-enabled fraud networks and other criminal organizations continue to target governments, businesses and citizens. White House materials describe cyber-enabled crime as a growing threat to U.S. interests.

Mounting Economic Losses. The economic impact is substantial. Accompanying White House materials released on August 12, 2026, report that Americans lost more than $20 billion to cyber-enabled crime in 2025. These losses reinforce the view among policymakers that cybercrime is a significant economic and national security issue.

Expanded Law Enforcement and Intelligence Options. The memorandum expands law enforcement and intelligence options by incorporating specialized private-sector capabilities and greater visibility into criminal infrastructure. From a geopolitical perspective, the policy signals a greater willingness to impose operational costs on foreign-based cybercriminal organizations that target U.S. interests.

The policy is likely to prompt organizations to revisit governance, privacy and risk management practices. Boards and executive teams may demand greater visibility into threat intelligence sharing, data governance and relationships with third-party cybersecurity providers.

Privacy and Legal: Privacy and legal teams should review telemetry-sharing practices, customer agreements and data handling requirements.

Third-Party Risk: Third-party risk programs should identify suppliers that may participate in or support the program. Organizations should then assess the resulting operational and contractual risks where third parties have access to sensitive systems or data.

Cloud and Infrastructure: Cloud and infrastructure teams should strengthen visibility across hybrid and multi-cloud environments. Criminal infrastructure can share hosting environments that also support legitimate workloads, increasing the potential for operational complexity and collateral exposure.

Organizations should watch for:

• Telemetry sharing: Review customer consent, privacy, contractual language, data ownership and legal liability.
• Third-party risk: Assess suppliers and partners that may participate in or support the program.
• Cloud and infrastructure: Improve visibility across hybrid and multi-cloud environments.
• Governance and resilience: Update incident response, data governance and supply-chain risk practices.
• Compliance readiness: Monitor new security, operational, reporting and oversight requirements.
• Executive oversight: Brief leadership on potential policy, operational and supply-chain implications.

The GSSO expects increased demand across several cybersecurity disciplines, including threat intelligence, managed detection and response, identity security, cloud security, cyber resilience, governance, compliance and third-party risk management.

Organizations supporting government cybersecurity initiatives may also face increased demand for secure enclaves, hardened environments, long-term logging and audit-ready controls.

The GSSO recommends that organizations closely monitor the implementation procedures expected to be released in late 2026. These procedures will provide the clearest indication of future operational and compliance requirements.

Organizations should also review telemetry-sharing policies, privacy notices, customer agreements and data governance practices. Security leaders should reassess third-party risk programs, update incident response plans, improve visibility across cloud and on-premises environments, and brief executive leadership on potential supply-chain implications.

The memorandum represents an important development in U.S. cyber strategy. While direct participation in cyber operations will likely remain limited to a small number of specialized organizations, the broader cybersecurity ecosystem may experience changes around intelligence sharing, governance expectations, supply-chain risk management, privacy considerations and resilience planning.

The implementation procedures expected in October 2026 will be a critical near-term milestone. Organizations that strengthen their governance, visibility, cyber resilience and third-party risk management now will be better positioned to adapt as additional guidance emerges.

CDW’s GSSO will continue to monitor developments and help organizations align their security programs with an evolving cyber policy environment.

CDW can help organizations assess cyber risk, strengthen governance, improve resilience, modernize security architectures and gain greater visibility across complex technology environments.

Our capabilities span identity security, threat detection, incident response planning, regulatory compliance and third-party risk management.

By addressing risks across technology, people, processes and external dependencies, CDW helps organizations reduce risk exposure, strengthen operational readiness and build a more resilient, scalable security posture.