Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144

The order amends EO 14144 by deleting several provisions from the Biden-era cybersecurity order and replacing them with updated directives. It replaces the policy statement to name the People's Republic of China as the most active cyber threat, alongside Russia, Iran, and North Korea. It then sets a series of agency deadlines: NIST must establish an industry consortium for secure software development guidance, update patch-deployment guidance in NIST SP 800-53, and publish a revised Secure Software Development Framework (SSDF). CISA must release a list of product categories where post-quantum cryptography products are available. NSA and OMB must issue requirements for agencies to adopt TLS 1.3 or a successor by January 2, 2030. Agencies must integrate AI software vulnerability management into existing processes, and the FAR Council must amend procurement rules to require US Cyber Trust Mark labeling on consumer IoT products sold to the federal government by January 4, 2027.

The order also amends EO 13694, the long-standing cyber sanctions authority, by replacing "any person" with "any foreign person" in two subsections — narrowing the sanctions authority so it no longer formally reaches domestic actors. General provisions confirm no new enforceable rights are created and implementation is subject to available appropriations.

Federal agencies with cybersecurity responsibilities, particularly NIST, CISA, NSA, OMB, the Department of Defense, and the FAR Council. Commercial vendors selling consumer IoT products to the federal government face new labeling requirements. Foreign persons engaged in malicious cyber activity face a sanctions regime whose scope is now explicitly limited to non-U.S. actors.

Federal agencies must meet a cascade of hard deadlines through 2025 and 2027 to update software security standards, prepare encrypted systems for quantum computing threats, and adopt AI-based vulnerability tracking. Companies selling connected devices to the government will need US Cyber Trust Mark certification. The narrowing of cyber sanctions to foreign persons removes domestic actors from formal coverage under EO 13694.

Implementation runs in parallel tracks. NIST leads the software standards work — establishing an industry consortium by August 2025, updating patch guidance by September 2025, and publishing a revised SSDF by December 2025 with a final version 120 days later. CISA and NSA run the post-quantum cryptography track toward a 2030 compliance target. OMB oversees a separate three-year cycle to revise federal IT management guidance. The FAR Council has one year to begin amending procurement rules, with vendor compliance due by January 2027. No dedicated enforcement mechanism beyond existing agency authority is established.