President Obama has done what Congress has not — extend whistleblower protections to national security and intelligence employees.

A Presidential Policy Directive issued Wednesday says employees “who are eligible for access to classified information can effectively report waste, fraud, and abuse while protecting classified national security information. It prohibits retaliation against employees for reporting waste, fraud, and abuse.”

Whistleblower protections for employees of intelligence and national security agencies were not included, as advocates had hoped, in the Whistleblower Protection Enhancement Act that passed the House last month and now awaits action in the Senate.

Obama instructed agencies, including the CIA, to establish a review process, within 270 days, that allows employees to appeal actions in conflict with the directive that affect their access to classified information.

Angela Canterbury, director of public policy for the Project On Government Oversight , an advocacy group, said “this unprecedented Presidential Policy Directive is leveled at the endemic culture of secrecy in the intelligence community (IC) and the dearth of accountability it fosters. The directive prohibits retaliation for protected disclosures by IC employees; prohibits retaliatory actions related to security clearances and eligibility for access to classified information and directs agencies to create a review process for related reprisal claims; mandates that each intelligence agency create a review process for claims of retaliation consistent with the policies and procedures in the Whistleblower Protection Act (WPA); provides significant remedies where retaliation is substantiated, including reinstatement and compensatory damages; and creates a review board of Inspectors General (IGs) where IC whistleblowers can appeal agency decisions.”

But for all it does, the directive “only is a landmark breakthrough in principle,” according to another organization, the Government Accountability Project (GAP).

“Until agencies adopt implementing regulations, no one whose new rights are violated will have any due process to enforce them,” said Tom Devine, GAP’s legal director. “Further, there are only false due process teeth on the horizon,” because, according to GAP, regulations to enforce whistleblower rights will be written by the same agencies that routinely are the defendants in whistleblower retaliation lawsuits.

Both Canterbury and Devine praised Obama’s action, while calling on Congress to do more. “President Obama has kept his promise to national security whistleblowers,” Devine said.

But the directive “is no substitute for congressional action to make the rights permanent, comprehensive, and enforceable through due-process teeth,” Devine added. “President Obama has done his share. Congress needs to finish what he started.”