ExecutiveOrdersEO
EO 14144Executive OrderBiden · D Quiet signal

Executive Order 14144

Strengthening and Promoting Innovation in the Nation's Cybersecurity

This executive order mandates comprehensive cybersecurity reforms across the federal government, focusing on securing software supply chains, hardening federal systems and communications, combating identity fraud, and integrating AI into cyber defense. It establishes numerous deadlines for agencies to implement technical requirements including encrypted DNS, routing security, post-quantum cryptography, and enhanced threat-hunting capabilities. The order builds on EO 14028 and the National Cybersecurity Strategy with specific procurement rule changes and operational directives.

Federal Register Open PDF 90 FR 6755

Impact dates

  1. OMB Circular A-130 revision guidance

  2. Post-quantum cryptography TLS 1.3 support deadline

  3. AI energy sector pilot assessment (180 days after challenge completion - date approximate)

  4. FAR Council review routing security recommendations

  5. NIST minimum cybersecurity practices guidance

  6. DOD AI cyber defense program; NIST remote digital identity verification guidance

  7. FAR Council review space cybersecurity recommendations

  8. NIST preliminary SSDF update; CISA concept of operations for EDR access; BGP security guidance; encrypted DNS enablement; email server TLS requirement; voice/video encryption requirements; PQC TLS 1.3 requirements; space cybersecurity contract recommendations; AI energy sector pilot launch

  9. FCEB agencies create Route Origin Authorizations; routing security contract language to FAR Council; email client-server encryption enforced; OMB space ground systems compliance steps

  10. NIST update SP 800-53 patch guidance; FCEB agencies register internet number resources; FedRAMP cloud baseline policies; space ground systems study to OMB; CISA encrypted DNS template; digital identity grant consideration; AI vulnerability management integration; AI research prioritization

  11. CISA evaluate machine-readable attestation methods; NIST establish secure software consortium

  12. OMB/CISA/NIST recommend software attestation contract language to FAR Council

Key directives

  • Require software providers to submit machine-readable secure software development attestations and artifacts to CISA's RSAA
  • Mandate CISA continuous validation of software attestations with public posting of results
  • Establish NIST-led industry consortium for secure software development guidance
  • Update NIST SP 800-53 and SSDF with secure delivery practices
  • Require agencies to comply with NIST SP 800-161 supply chain risk management
  • Issue recommendations on open source software security assessments and patching
  • Deploy phishing-resistant authentication (WebAuthn) across FCEB agencies
  • Develop CISA concept of operations for centralized EDR data access and threat hunting
  • Require FCEB agency enrollment in CISA Persistent Access Capability
  • Develop FedRAMP cloud security configuration baselines
  • Establish tiered cybersecurity requirements for civil space systems
  • Mandate encrypted DNS, email transport encryption, and end-to-end encryption for communications

Who is ordered

Timeline

Immediate

  • FCEB agencies begin phishing-resistant authentication pilots (WebAuthn)
  • CISA threat-hunting access provisions take effect

Near term (90d)

  • OMB/CISA/NIST recommendations to FAR Council on software attestation contract language (30 days)
  • CISA evaluation of machine-readable attestation methods (60 days)
  • NIST establishment of secure software development consortium (60 days)
  • FCEB agencies register internet number resources (90 days)
  • CISA encrypted DNS template contract language (90 days)
  • OMB study on space ground systems (120 days)
  • NIST update SP 800-53 patch guidance (90 days)
  • NIST preliminary SSDF update (180 days)
  • CISA concept of operations for EDR data access (180 days)
  • FCEB agencies list sensitive systems for CISA (90 days)
  • FedRAMP cloud security baseline policies (90 days)
  • Space system cybersecurity contract requirements review (180 days)
  • Post-quantum cryptography product category list (180 days)
  • TLS 1.3 requirements for NSS and non-NSS (180 days)
  • BGP security guidance (180 days)
  • Encrypted DNS enablement (180 days)
  • Email transport encryption enforcement (120-180 days)
  • OMB requirements for voice/video encryption (180 days)
  • Digital identity guidance for states/grants consideration (90 days)
  • NIST remote digital identity verification guidance (270 days)
  • AI cyber defense pilot for energy sector (180 days after DARPA challenge)
  • DOD AI cyber defense program (270 days)
  • NIST/DOE/DHS/NSF research prioritization (150 days)
  • AI vulnerability management integration (150 days)
  • NIST minimum cybersecurity practices guidance (240 days)

Long term

  • Final SSDF update and OMB incorporation (300 days total)
  • FAR amendments for software attestation (120 days after OMB recommendations)
  • FAR amendments for space cybersecurity (180 days after recommendations)
  • FAR amendments for routing security (270 days)
  • FedRAMP cryptographic key management updates (60 days after NIST guidelines)
  • OMB Circular A-130 revision (3 years)
  • Post-quantum cryptography full transition (by January 2, 2030)
  • Continuous CISA attestation validation program

Risks & tensions

  • Implementation complexity: numerous interdependent deadlines create coordination challenges across OMB, NIST, CISA, DOD, and FAR Council
  • Privacy and surveillance tension: CISA's expanded EDR access to agency data raises civil liberties concerns, with special protections for DOJ and restricted data noted but not fully defined
  • Vendor burden: software providers face new attestation and artifact requirements that may disadvantage smaller contractors
  • Open source ambiguity: recommendations for open source security are non-binding and lack enforcement mechanism
  • Post-quantum timeline tension: January 2030 deadline for TLS 1.3 may be difficult for legacy systems; CRQC threat timeline uncertain
  • AI integration risks: rapid AI deployment for cyber defense may introduce new vulnerabilities; security of AI-generated code remains unproven
  • Digital identity equity concerns: emphasis on mobile driver's licenses and digital documents may exclude populations without smartphone access, despite stated intent to preserve broad access
  • International friction: PQC diplomatic engagement and routing security requirements for overseas operations may create trade and alliance tensions
Executive Order 14144: Strengthening and Promoting Innovation in the Nation's Cybersecurity · Executive Orders