ExecutiveOrdersEO
EO 14306Executive OrderTrump 47 · R Quiet signal

Executive Order 14306

Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144

AI & TechnologyAI & TechnologyDefense & SecurityDefense & SecurityFederal WorkforceFederal WorkforceDemocracy & GovernanceDemocracy & Governance

In simple terms

This executive order amends two prior cybersecurity orders: it narrows the scope of sanctions under EO 13694 to target only foreign persons, and substantially revises EO 14144 by removing several Biden-era provisions while adding new deadlines for NIST guidance, post-quantum cryptography transition, AI vulnerability management, and Federal Acquisition Regulation updates for IoT security labeling.

Federal Register Open PDF 90 FR 24723

Record & deadlines

  1. Signed

    Signed by the President

  2. FR published

    Published in the Federal Register · 90 FR 24723

    Federal Register PDF

  3. FAR IoT Cyber Trust Mark labeling effective for federal vendors

  4. OMB Circular A-130 guidance revision

  5. Agencies must support TLS 1.3 or successor

  6. Rules-as-code pilot establishment

  7. Final SSDF update (within 120 days of preliminary)

  8. Preliminary SSDF update; PQC product category list; TLS 1.3 requirements issued

  9. AI cyber defense datasets accessible to researchers; AI vulnerability management incorporated

  10. NIST SP 800-53 update on patch deployment

  11. NIST consortium for secure software development guidance

Market exposure

Policy exposure mapping — not investment advice. Illustrative public companies are incomplete and not recommendations.

Sectors

Technology & softwareSemiconductorsDefense primesOther industrial

Mechanisms

ProcurementLicensingSubsidy / incentive

Role pressure

  • MixedDownstream manufacturer — IoT manufacturers gain clarity on federal labeling requirement but face January 2027 compliance deadline; software developers face updated SSDF and patch guidance requirements
  • ProtectiveEquipment supplier — Post-quantum cryptography transition creates demand for new cryptographic products and TLS 1.3 support; CISA product category list will signal market readiness
  • UncertainProject developer — Rules-as-code pilot and A-130 revision may change compliance automation approaches but specifics undefined
  • MixedDomestic producer — NIST consortium participation offers influence over standards but removes prior hardware roots of trust mandate

Geographies

US

Exposure dates

  • — NIST consortium for secure software development guidance
  • — NIST SP 800-53 update on patch deployment
  • — AI cyber defense datasets accessible to researchers; AI vulnerability management incorporated
  • — Preliminary SSDF update; PQC product category list; TLS 1.3 requirements issued
  • — FAR IoT Cyber Trust Mark labeling effective for federal vendors
  • — Agencies must support TLS 1.3 or successor

Illustrative public companies

Curated watchlist matches by sector/role — incomplete; not a recommendation.

MMM3MGOOGLAlphabetAAPLAppleAMATApplied MaterialsASMLASMLBABoeingAVGOBroadcomCATCaterpillarFCXFreeport-McMoRanGEVGE VernovaGDGeneral DynamicsHONHoneywellINTCIntelQQQInvesco QQQ TrustLMTLockheed MartinMETAMeta PlatformsMUMicron TechnologyMSFTMicrosoftNOCNorthrop GrummanNVDANVIDIAORCLOracleRTXRTXSPYSPDR S&P 500 ETFTSMTSMC

Confidence: medium · Policy alerts

Key directives

  • NIST to establish industry consortium for secure software development guidance by August 1, 2025
  • NIST to update SP 800-53 on patch deployment by September 2, 2025
  • NIST to publish preliminary SSDF update by December 1, 2025; final within 120 days
  • CISA and NSA to release PQC product category list by December 1, 2025
  • NSA and OMB to issue TLS 1.3 requirements for agencies by December 1, 2025, with compliance by January 2, 2030
  • Commerce, Energy, DHS, NSF to make cyber defense datasets accessible by November 1, 2025
  • DOD, DHS, DNI to incorporate AI vulnerability management by November 1, 2025
  • OMB to issue A-130 guidance within 3 years
  • NIST, CISA, OMB to establish rules-as-code pilot within 1 year
  • FAR Council to amend FAR for IoT Cyber Trust Mark labeling by January 4, 2027
  • Narrow EO 13694 sanctions from 'any person' to 'any foreign person'

Who is ordered

Prior policyRollback

  • amendEO 14144
  • amendEO 13694

Related orders

What to expect

Immediate

  • EO 13694 sanctions narrowed to 'foreign persons' only
  • Multiple sections of EO 14144 struck (software development provisions, threat-sharing language, specific technical requirements)

Near term (90d)

  • August 1, 2025: NIST consortium for secure software development guidance
  • September 2, 2025: NIST SP 800-53 update on patch deployment
  • November 1, 2025: AI cyber defense datasets accessible to researchers
  • November 1, 2025: AI vulnerability management incorporated into agency processes

Long term

  • December 1, 2025: Preliminary SSDF update; PQC product category list
  • By 120 days after Dec 1, 2025: Final SSDF update (approx. April 2026)
  • January 2, 2030: TLS 1.3 or successor required for agencies
  • January 4, 2027: FAR IoT Cyber Trust Mark labeling requirement for federal vendors
  • Within 1 year: FAR Council pilot on rules-as-code
  • Within 3 years: OMB Circular A-130 revision on modern security architectures

Risks & tensions

  • Narrowing EO 13694 sanctions to 'foreign persons' may reduce leverage against domestic enablers of malicious cyber activity
  • Removal of specific technical provisions (hardware roots of trust, intrusion detection, BGP security language) may weaken baseline security expectations
  • Vague 'as appropriate and consistent with applicable law' qualifier on FAR Council action creates implementation uncertainty
  • 2030 TLS deadline provides long runway but may delay urgent post-quantum readiness
  • Striking Biden-era threat-sharing provisions between DOD/DHS without replacement may create information-sharing gaps
Executive Order 14306: Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144 · Executive Orders