Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144

This order rewrites and tightens Executive Order 14144 on national‑cybersecurity innovation, adds quantum‑resilience and AI‑security mandates, and revises the cyber‑sanctions framework in EO 13694. It sets firm deadlines for NIST, CISA, NSA, OMB and others to update secure‑software and patching standards, publish post‑quantum product lists, make research data sets public, embed AI‑vulnerability management, pilot machine‑readable “rules‑as‑code,” and launch a Federal purchasing rule that requires the U.S. Cyber Trust Mark on IoT products—while instructing OMB to overhaul Federal cyber‑risk guidance within three years.

• Department of Commerce (NIST)
• Department of Homeland Security (CISA, Science & Technology)
• National Security Agency (NSA)
• Office of Management and Budget (OMB)
• Office of the National Cyber Director (ONCD)
• Department of Defense (DoD)
• Office of the Director of National Intelligence (ODNI)
• Department of Energy (DOE)
• National Science Foundation (NSF)
• FAR Council agencies (DoD, GSA, NASA)

See deliverable list for specific dates.

Aug 1 2025 — Commerce / NIST: Launch NCCoE consortium and publish guidance draft for secure‑software practices (SSDF).  Sep 2 2025 — Commerce / NIST: Issue updated NIST SP 800‑53 on secure patching and updates.  Dec 1 2025 — Commerce / NIST: Publish preliminary SSDF update covering secure development & delivery; final update due 120 days later.  Dec 1 2025 — DHS / CISA (with NSA): Release and maintain list of product categories already supporting post‑quantum cryptography.  Dec 1 2025 — NSA (for NSS) & OMB (for non‑NSS): Issue agency requirements to enable TLS 1.3+ no later than Jan 2 2030.  Nov 1 2025 — Commerce / NIST, DOE, DHS (S&T), NSF: Make existing cyber‑defense research datasets accessible to academia, respecting security and confidentiality.  Nov 1 2025 — DoD, DHS, ODNI (with EOP offices): Integrate AI‑software vulnerability management into existing interagency cyber‑vulnerability processes.  Within 1 year of EO — Commerce / NIST, DHS / CISA, OMB: Stand up pilot “rules‑as‑code” program for machine‑readable cybersecurity policy.  Within 1 year of EO — FAR Council agencies: Start FAR change requiring vendors’ consumer IoT devices to carry U.S. Cyber Trust Mark by Jan 4 2027.  Within 3 years of EO — OMB: Issue updated Circular A‑130‑style guidance to modernize risk management across Federal information systems and networks.

Trump’s New Cybersecurity Executive Order: What Contractors Need to Know

No known legal challenges.