Executive Order 14028 on Improving the Nation's Cybersecurity

On 12 May 2021, President Biden signed Executive Order 14028, establishing sweeping cybersecurity requirements for federal agencies and their contractors. The order, issued in the wake of the SolarWinds and Colonial Pipeline incidents, mandates zero trust architecture adoption, software supply chain security measures, standardized incident response playbooks, and improved logging requirements. While directly applicable to federal systems, the order sets expectations that influence private sector security practices.

Key requirements and timelines

The order establishes multiple workstreams with aggressive timelines. Federal agencies must develop zero trust architecture setup plans within 60 days and adopt multi-factor authentication and encryption for data at rest and in transit within 180 days. CISA is tasked with developing a cloud security technical reference architecture to guide agency migrations.

Software supply chain requirements direct NIST to publish guidelines for secure software development practices, including criteria for software bills of materials (SBOMs). Agencies must require vendors to provide SBOMs and attest to secure development practices. The order also sets up a Cyber Safety Review Board to analyze significant cyber incidents affecting federal systems.

Logging and detection improvements

The order mandates significant improvements to federal logging capabilities, recognizing that inadequate log retention hampered investigation of the SolarWinds compromise. Agencies must maintain logs for specified retention periods, implement centralized log analysis, and share threat information with CISA. OMB Memorandum M-21-31 then established specific logging requirements including event types, retention periods, and access controls.

Endpoint detection and response (EDR) capabilities must be deployed across federal civilian networks, with centralized visibility enabling government-wide threat hunting. These requirements set up a baseline that federal contractors and suppliers are now expected to meet.

Implications for federal contractors

Organizations selling software to the federal government face new requirements around secure development practices and transparency. Software vendors must attest to following secure development practices aligned with NIST guidance and provide SBOMs upon request. Critical software—defined to include software with elevated privileges or network functions—faces additional scrutiny.

Contractors should evaluate their software development practices against NIST's Secure Software Development Framework (SSDF) and prepare to generate and maintain SBOMs for products sold to government customers. The requirements are flowing into contract language and will now become baseline expectations for federal procurement.

Policy Development and Analysis

Policy analysis should assess the implications of this development for organizational operations, compliance obligations, and strategic positioning. Impact assessments should consider both direct requirements and indirect effects through industry practices, customer expectations, and competitive dynamics.

Policy development processes should engage relevant teams to ensure full consideration of diverse perspectives and practical setup constraints. Feedback mechanisms should capture lessons learned and drive policy refinements based on operational experience.

Policy Implementation Monitoring

Policy teams should track setup progress and monitor for developments that may affect requirements or interpretation. Stakeholder engagement should ensure relevant parties understand policy implications and their responsibilities for compliance. Documentation should support audit and examination processes by demonstrating timely awareness and appropriate response to policy developments.

Regular reviews should assess ongoing compliance status and identify any gaps requiring additional attention or resource allocation.

More on this topic

Further reading from our research library.

Policy · Credibility 71/100 · May 12, 2021

U.S. EO 14028 on Improving the Nation’s Cybersecurity signed

President Biden signed Executive Order 14028 on 12 May 2021, mandating federal zero trust roadmaps, software bill of materials requirements, and incident sharing under new playbooks.

Policy · Credibility 71/100 · October 30, 2023

U.S. Executive Order 14110 on Safe, Secure, and Trustworthy AI

Biden's AI executive order is the most aggressive federal AI action yet. Foundation model developers now have to report to the government when they start training runs above certain compute thresholds, share safety test…

Policy · Credibility 94/100 · January 29, 2026

U.S. Executive Order on AI Infrastructure Prioritizes Federal Data-Center Capacity and Energy Policy

The White House has issued an executive order directing federal agencies to accelerate permitting for AI data-center construction, streamline access to federal power resources, and establish interagency coordination on…

Policy · Credibility 91/100 · April 29, 2021

UK National Security and Investment Act Passed

The UK National Security and Investment Act received Royal Assent on 29 April 2021, introducing mandatory notifications for 17 sensitive sectors, expansive call-in powers, and rigorous post-completion remedies for…

Policy · Credibility 90/100 · April 29, 2021

Ransomware Task Force releases full framework

On 29 April 2021 the Institute for Security and Technology's Ransomware Task Force released a full report with 48 recommendations to combat ransomware through coordinated government and private sector action.

Continue in the Policy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• AI Policy Implementation Guide

  Coordinate governance, safety, and reporting programmes that meet EU Artificial Intelligence Act timelines and U.S. National AI Initiative Act mandates while sustaining product…

• Digital Markets Compliance Guide

  Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…

• Semiconductor Industrial Strategy Policy Guide

  Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.

Coverage intelligence

Published

May 12, 2021

Coverage pillar

Policy

Source credibility

95/100 — high confidence

Topics

executive order · zero trust · software supply chain · federal cybersecurity

Sources cited

3 sources (hitehouse.gov, cvedetails.com, iso.org)

Reading time

5 min

Source material

1. Executive Order on Improving the Nation's Cybersecurity — The White House
2. CVE Details - Vulnerability Database — CVE Details
3. ISO 31000:2018 — Risk Management Guidelines — International Organization for Standardization