[Federal Register Volume 90, Number 11 (Friday, January 17, 2025)]
[Presidential Documents]
[Pages 6755-6771]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2025-01470]
Presidential Documents
Federal Register / Vol. 90, No. 11 / Friday, January 17, 2025 /
Presidential Documents
[[Page 6755]]
Executive Order 14144 of January 16, 2025
Strengthening and Promoting Innovation in the
Nation's Cybersecurity
By the authority vested in me as President by the
Constitution and the laws of the United States of
America, including the International Emergency Economic
Powers Act (50 U.S.C. 1701 et seq.), the National
Emergencies Act (50 U.S.C. 1601 et seq.), section
212(f) of the Immigration and Nationality Act of 1952
(8 U.S.C. 1182(f)), and section 301 of title 3, United
States Code, it is hereby ordered as follows:
Section 1. Policy. Adversarial countries and criminals
continue to conduct cyber campaigns targeting the
United States and Americans, with the People's Republic
of China presenting the most active and persistent
cyber threat to United States Government, private
sector, and critical infrastructure networks. These
campaigns disrupt the delivery of critical services
across the Nation, cost billions of dollars, and
undermine Americans' security and privacy. More must be
done to improve the Nation's cybersecurity against
these threats.
Building on the foundational steps I directed in
Executive Order 14028 of May 12, 2021 (Improving the
Nation's Cybersecurity), and the initiatives detailed
in the National Cybersecurity Strategy, I am ordering
additional actions to improve our Nation's
cybersecurity, focusing on defending our digital
infrastructure, securing the services and capabilities
most vital to the digital domain, and building our
capability to address key threats, including those from
the People's Republic of China. Improving
accountability for software and cloud service
providers, strengthening the security of Federal
communications and identity management systems, and
promoting innovative developments and the use of
emerging technologies for cybersecurity across
executive departments and agencies (agencies) and with
the private sector are especially critical to
improvement of the Nation's cybersecurity.
Sec. 2. Operationalizing Transparency and Security in
Third-Party Software Supply Chains. (a) The Federal
Government and our Nation's critical infrastructure
rely on software providers. Yet insecure software
remains a challenge for both providers and users and
makes Federal Government and critical infrastructure
systems vulnerable to malicious cyber incidents. The
Federal Government must continue to adopt secure
software acquisition practices and take steps so that
software providers use secure software development
practices to reduce the number and severity of
vulnerabilities in software they produce.
(b) Executive Order 14028 directed actions to improve
the security and integrity of software critical to the
Federal Government's ability to function. Executive
Order 14028 directed the development of guidance on
secure software development practices and on generating
and providing evidence in the form of artifacts--
computer records or data that are generated manually or
by automated means--that demonstrate compliance with
those practices. Additionally, it directed the Director
of the Office of Management and Budget (OMB) to require
agencies to use only software from providers that
attest to using those secure software development
practices. In some instances, providers of software to
the Federal Government commit to following
cybersecurity practices, yet do not fix well-known
exploitable vulnerabilities in their software, which
puts the Government at risk of compromise. The
[[Page 6756]]
Federal Government needs to adopt more rigorous third-
party risk management practices and greater assurance
that software providers that support critical
Government services are following the practices to
which they attest.
(i) Within 30 days of the date of this order, the Director of OMB, in
consultation with the Secretary of Commerce, acting through the Director of
the National Institute of Standards and Technology (NIST), and the
Secretary of Homeland Security, acting through the Director of the
Cybersecurity and Infrastructure Security Agency (CISA), shall recommend to
the Federal Acquisition Regulatory Council (FAR Council) contract language
requiring software providers to submit to CISA through CISA's Repository
for Software Attestation and Artifacts (RSAA):
(A) machine-readable secure software development attestations;
(B) high-level artifacts to validate those attestations; and
(C) a list of the providers' Federal Civilian Executive Branch (FCEB)
agency software customers.
(ii) Within 120 days of the receipt of the recommendations described in
subsection (b)(i) of this section, the FAR Council shall review the
recommendations and, as appropriate and consistent with applicable law, the
Secretary of Defense, the Administrator of General Services, and the
Administrator of the National Aeronautics and Space Administration (the
agency members of the FAR Council) shall jointly take steps to amend the
Federal Acquisition Regulation (FAR) to implement those recommendations.
The agency members of the FAR Council are strongly encouraged to consider
issuing an interim final rule, as appropriate and consistent with
applicable law.
(iii) Within 60 days of the date of the issuance of the recommendations
described in subsection (b)(i) of this section, the Secretary of Homeland
Security, acting through the Director of CISA, shall evaluate emerging
methods of generating, receiving, and verifying machine-readable secure
software development attestations and artifacts and, as appropriate, shall
provide guidance for software providers on submitting them to CISA's RSAA
website, including a common data schema and format.
(iv) Within 30 days of the date of any amendments to the FAR described in
subsection (b)(ii) of this section, the Secretary of Homeland Security,
acting through the Director of CISA, shall develop a program to centrally
verify the completeness of all attestation forms. CISA shall continuously
validate a sample of the complete attestations using high-level artifacts
in the RSAA.
(v) If CISA finds that attestations are incomplete or artifacts are
insufficient for validating the attestations, the Director of CISA shall
notify the software provider and the contracting agency. The Director of
CISA shall provide a process for the software provider to respond to CISA's
initial determination and shall duly consider the response.
(vi) For attestations that undergo validation, the Director of CISA shall
inform the National Cyber Director, who shall publicly post the results,
identifying the software providers and software version. The National Cyber
Director is encouraged to refer attestations that fail validation to the
Attorney General for action as appropriate.
(c) Secure software development practices are not
sufficient to address the potential for cyber incidents
from resourced and determined nation-state actors. To
mitigate the risk of such incidents occurring, software
providers must also address how software is delivered
and the security of the software itself. The Federal
Government must identify a coordinated set of practical
and effective security practices to require when it
procures software.
(i) Within 60 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, shall establish a consortium with
industry at the National Cybersecurity Center of Excellence to develop
[[Page 6757]]
guidance, informed by the consortium as appropriate, that demonstrates the
implementation of secure software development, security, and operations
practices based on NIST Special Publication 800-218 (Secure Software
Development Framework (SSDF)).
(ii) Within 90 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, shall update NIST Special Publication
800-53 (Security and Privacy Controls for Information Systems and
Organizations) to provide guidance on how to securely and reliably deploy
patches and updates.
(iii) Within 180 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, in consultation with the heads of such
agencies as the Director of NIST deems appropriate, shall develop and
publish a preliminary update to the SSDF. This update shall include
practices, procedures, controls, and implementation examples regarding the
secure and reliable development and delivery of software as well as the
security of the software itself. Within 120 days of publishing the
preliminary update, the Secretary of Commerce, acting through the Director
of NIST, shall publish a final version of the updated SSDF.
(iv) Within 120 days of the final update to the SSDF described in
subsection (c)(iii) of this section, the Director of OMB shall incorporate
select practices for the secure development and delivery of software
contained in NIST's updated SSDF into the requirements of OMB Memorandum M-
22-18 (Enhancing the Security of the Software Supply Chain through Secure
Software Development Practices) or related requirements.
(v) Within 30 days of the issuance of OMB's updated requirements described
in subsection (c)(iv) of this section, the Director of CISA shall prepare
any revisions to CISA's common form for Secure Software Development
Attestation to conform to OMB's requirements and shall initiate any process
required to obtain clearance of the revised form under the Paperwork
Reduction Act, 44 U.S.C. 3501 et seq.
(d) As agencies have improved their cyber defenses,
adversaries have targeted the weak links in agency
supply chains and the products and services upon which
the Federal Government relies. Agencies need to
integrate cybersecurity supply chain risk management
programs into enterprise-wide risk management
activities. Within 90 days of the date of this order,
the Director of OMB, in coordination with the Secretary
of Commerce, acting through the Director of NIST, the
Administrator of General Services, and the Federal
Acquisition Security Council (FASC), shall take steps
to require, as the Director deems appropriate, that
agencies comply with the guidance in NIST Special
Publication 800-161 (Cybersecurity Supply Chain Risk
Management Practices for Systems and Organizations (SP
800-161 Revision 1)). OMB shall require agencies to
provide annual updates to OMB as they complete
implementation. Consistent with SP 800-161 Revision 1,
OMB's requirements shall address the integration of
cybersecurity into the acquisition lifecycle through
acquisition planning, source selection, responsibility
determination, security compliance evaluation, contract
administration, and performance evaluation.
(e) Open source software plays a critical role in
Federal information systems. To help the Federal
Government continue to reap the innovation and cost
benefits of open source software and contribute to the
cybersecurity of the open source software ecosystem,
agencies must better manage their use of open source
software. Within 120 days of the date of this order,
the Secretary of Homeland Security, acting through the
Director of CISA, and the Director of OMB, in
consultation with the Administrator of General Services
and the heads of other agencies as appropriate, shall
jointly issue recommendations to agencies on the use of
security assessments and patching of open source
software and best practices for contributing to open
source software projects.
Sec. 3. Improving the Cybersecurity of Federal Systems.
(a) The Federal Government must adopt proven security
practices from industry--to include
[[Page 6758]]
in identity and access management--in order to improve
visibility of security threats across networks and
strengthen cloud security.
(b) To prioritize investments in the innovative
identity technologies and processes of the future and
phishing-resistant authentication options, FCEB
agencies shall begin using, in pilot deployments or in
larger deployments as appropriate, commercial phishing-
resistant standards such as WebAuthn, building on the
deployments that OMB and CISA have developed and
established since the issuance of Executive Order
14028. These pilot deployments shall be used to inform
future directions for Federal identity, credentialing,
and access management strategies.
(c) The Federal Government must maintain the
ability to rapidly and effectively identify threats
across the Federal enterprise. In Executive Order
14028, I directed the Secretary of Defense and the
Secretary of Homeland Security to establish procedures
to immediately share threat information to strengthen
the collective defense of Department of Defense and
civilian networks. To enable identification of threat
activity, CISA's capability to hunt for and identify
threats across FCEB agencies under 44 U.S.C. 3553(b)(7)
must be strengthened.
(i) The Secretary of Homeland Security, acting through the Director of
CISA, in coordination with the Federal Chief Information Officer (CIO)
Council and Federal Chief Information Security Officer (CISO) Council,
shall develop the technical capability to gain timely access to required
data from FCEB agency endpoint detection and response (EDR) solutions and
from FCEB agency security operation centers to enable:
(A) timely hunting and identification of novel cyber threats and
vulnerabilities across the Federal civilian enterprise;
(B) identification of coordinated cyber campaigns that simultaneously
target multiple agencies and move laterally across the Federal enterprise;
and
(C) coordination of Government-wide efforts on information security
policies and practices, including compilation and analysis of information
about incidents that threaten information security.
(ii) Within 180 days of the date of this order, the Secretary of Homeland
Security, acting through the Director of CISA, in coordination with the
Federal CIO and CISO Councils, shall develop and release a concept of
operations that enables CISA to gain timely access to required data to
achieve the objectives described in subsection (c)(i) of this section. The
Director of OMB shall oversee the development of this concept of operations
to account for agency perspectives and the objectives outlined in this
section and shall approve the final concept of operations. This concept of
operations shall include:
(A) requirements for FCEB agencies to provide CISA with data of
sufficient completeness and on the timeline required to enable CISA to
achieve the objectives described in subsection (c)(i) of this section;
(B) requirements for CISA to provide FCEB agencies with advanced
notification when CISA directly accesses agency EDR solutions to obtain
required telemetry;
(C) specific use cases for which agencies may provide telemetry data
subject to the requirements in subsection (c)(ii)(A) of this section as
opposed to direct access to EDR solutions by CISA;
(D) high-level technical and policy control requirements to govern CISA
access to agency EDR solutions that conform with widely accepted
cybersecurity principles, including role-based access controls, ``least
privilege,'' and separation of duties;
(E) specific protections for highly sensitive agency data that is subject
to statutory, regulatory, or judicial restrictions to protect
confidentiality or integrity; and
[[Page 6759]]
(F) an appendix to the concept of operations that identifies and
addresses certain types of specific use cases under subsection (c)(ii)(C)
of this section that apply to the Department of Justice, including certain
categories of information described in subsections (c)(vi) and (c)(vii) of
this section, and requires the Department of Justice's concurrence on the
terms of the appendix prior to implementation of the concept of operations
on the Department of Justice's or its subcomponents' networks.
(iii) In undertaking the activities described in subsection (c) of this
section, the Secretary of Homeland Security, acting through the Director of
CISA, shall only make a change to an agency network, system, or data when
such change is required for threat hunting by CISA, including access to the
EDR tools described in subsection (c)(ii) of this section, or in
furtherance of its authority to conduct threat hunting as authorized under
44 U.S.C. 3553(b)(7), unless otherwise authorized by the agency.
(iv) Within 30 days of the release of the concept of operations described
in subsection (c)(ii) of this section, the Secretary of Homeland Security,
acting through the Director of CISA, shall establish working groups, open
to all agencies, to develop and release specific technical controls that
achieve the objectives set forth in subsection (c)(ii) of this section and
to work with EDR solution providers to implement those controls in FCEB
agency deployments of EDR solutions. The Secretary of Homeland Security,
acting through the Director of CISA, shall, at a minimum, establish a
working group for each EDR solution authorized by CISA for use in the CISA
Continuous Diagnostic and Mitigation Program. Each working group shall be
open to all agencies and include at least one representative from an FCEB
agency employing the designated EDR solution.
(v) Within 180 days of the release of the technical controls described in
subsection (c)(iv) of this section, the heads of FCEB agencies shall enroll
endpoints using an EDR solution covered by those controls in the CISA
Persistent Access Capability program.
(vi) Within 90 days of the date of this order, and periodically thereafter
as needed, the heads of FCEB agencies shall provide to CISA a list of
systems, endpoints, and data sets that require additional controls or
periods of non-disruption to ensure that CISA's threat-hunting activities
do not disrupt mission-critical operations, along with an explanation of
those operations.
(vii) In cases in which agency data is subject to statutory, regulatory, or
judicial access restrictions, the Director of CISA shall comply with agency
processes and procedures required to access such data or work with the
agency to develop an appropriate administrative accommodation consistent
with any such restrictions so that the data is not subject to unauthorized
access or use.
(viii) Nothing in this order requires an agency to provide access to
information that is protected from non-disclosure by court order or
otherwise required to be kept confidential in connection with a judicial
proceeding.
(d) The security of Federal information systems
relies on the security of the Government's cloud
services. Within 90 days of the date of this order, the
Administrator of General Services, acting through the
Director of the Federal Risk and Authorization
Management Program (FedRAMP), in coordination with the
Secretary of Commerce, acting through the Director of
NIST, and the Secretary of Homeland Security, acting
through the Director of CISA, shall develop FedRAMP
policies and practices to incentivize or require cloud
service providers in the FedRAMP Marketplace to produce
baselines with specifications and recommendations for
agency configuration of agency cloud-based systems in
order to secure Federal data based on agency
requirements.
(e) As cybersecurity threats to space systems
increase, these systems and their supporting digital
infrastructure must be designed to adapt to evolving
cybersecurity threats and operate in contested
environments. In light of
[[Page 6760]]
the pivotal role space systems play in global critical
infrastructure and communications resilience, and to
further protect space systems and the supporting
digital infrastructure vital to our national security,
including our economic security, agencies shall take
steps to continually verify that Federal space systems
have the requisite cybersecurity capabilities through
actions including continuous assessments, testing,
exercises, and modeling and simulation.
(i) Within 180 days of the date of this order, the Secretary of the
Interior, acting through the Director of the United States Geological
Survey; the Secretary of Commerce, acting through the Under Secretary of
Commerce for Oceans and Atmosphere and the Administrator of the National
Oceanic and Atmospheric Administration; and the Administrator of the
National Aeronautics and Space Administration shall each review the civil
space contract requirements in the FAR and recommend to the FAR Council and
other appropriate agencies updates to civil space cybersecurity
requirements and relevant contract language. The recommended cybersecurity
requirements and contract language shall use a risk-based, tiered approach
for all new civil space systems. Such requirements shall be designed to
apply at minimum to the civil space systems' on-orbit segments and link
segments. The requirements shall address the following elements for the
highest-risk tier and, as appropriate, other tiers:
(A) protection of command and control of the civil space system,
including backup or failover systems, by:
(1) encrypting commands to protect the confidentiality of communications;
(2) ensuring commands are not modified in transit;
(3) ensuring an authorized party is the source of commands; and
(4) rejecting unauthorized command and control attempts;
(B) establishment of methods to detect, report, and recover from
anomalous network or system activity; and
(C) use of secure software and hardware development practices, consistent
with the NIST SSDF or any successor documents.
(ii) Within 180 days of receiving the recommended contract language
described in subsection (e)(i) of this section, the FAR Council shall
review the proposal and, as appropriate and consistent with applicable law,
the agency members of the FAR Council shall jointly take steps to amend the
FAR.
(iii) Within 120 days of the date of this order, the National Cyber
Director shall submit to OMB a study of space ground systems owned,
managed, or operated by FCEB agencies. This study shall include:
(A) an inventory of space ground systems;
(B) whether each space ground system is classified as a major information
system under 44 U.S.C. 3505(c), labeled ``Inventory of major information
systems''; and
(C) recommendations to improve the cyber defenses and oversight of such
space ground systems.
(iv) Within 90 days of the submission of the study described in subsection
(e)(iii) of this section, the Director of OMB shall take appropriate steps
to help ensure that space ground systems owned, managed, or operated by
FCEB agencies comply with relevant cybersecurity requirements issued by
OMB.
Sec. 4. Securing Federal Communications. (a) To improve
the security of Federal Government communications
against adversarial nations and criminals, the Federal
Government must implement, to the extent practicable
and consistent with mission needs, strong identity
authentication and encryption using modern,
standardized, and commercially available algorithms and
protocols.
[[Page 6761]]
(b) The security of internet traffic depends on
data being correctly routed and delivered to the
intended recipient network. Routing information
originated and propagated across the internet,
utilizing the Border Gateway Protocol (BGP), is
vulnerable to attack and misconfiguration.
(i) Within 90 days of the date of this order, FCEB agencies shall take
steps to ensure that all of their assigned internet number resources
(internet Protocol (IP) address blocks and Autonomous System Numbers) are
covered by a Registration Services Agreement with the American Registry for
internet Numbers or another appropriate regional internet registry.
Thereafter, FCEB agencies shall annually review and update in their
regional internet registry accounts organizational identifiers related to
assigned number resources such as organization names, points of contact,
and associated email addresses.
(ii) Within 120 days of the date of this order, all FCEB agencies that hold
IP address blocks shall create and publish Route Origin Authorizations in
the public Resource Public Key Infrastructure repository hosted or
delegated by the American Registry for internet Numbers or the appropriate
regional internet registry for the IP address blocks they hold.
(iii) Within 120 days of the date of this order, the National Cyber
Director, in coordination with the heads of other agencies as appropriate,
shall recommend contract language to the FAR Council to require contracted
providers of internet services to agencies to adopt and deploy internet
routing security technologies, including publishing Route Origin
Authorizations and performing Route Origin Validation filtering. The
recommended language shall include requirements or exceptions, as
appropriate, for agency contracts regarding overseas operations and
overseas local service providers. Within 270 days of receiving these
recommendations, the FAR Council shall review the recommended contract
language and, as appropriate and consistent with applicable law, the agency
members of the FAR Council shall jointly take steps to amend the FAR.
Pending any such amendments to the FAR, individual agencies are encouraged
to include such requirements in future contracts, consistent with
applicable law.
(iv) Within 180 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, shall publish updated guidance to
agencies on deployment of current, operationally viable BGP security
methods for Federal Government networks and service providers. The
Secretary of Commerce, acting through the Director of NIST, shall also
provide updated guidance on other emerging technologies to improve internet
routing security and resilience, such as route leak mitigation and source
address validation.
(c) Encrypting Domain Name System (DNS) traffic in
transit is a critical step to protecting both the
confidentiality of the information being transmitted
to, and the integrity of the communication with, the
DNS resolver.
(i) Within 90 days of the date of this order, the Secretary of Homeland
Security, acting through the Director of CISA, shall publish template
contract language requiring that any product that acts as a DNS resolver
(whether client or server) for the Federal Government support encrypted DNS
and shall recommend that language to the FAR Council. Within 120 days of
receiving the recommended language, the FAR Council shall review it, and,
as appropriate and consistent with applicable law, the agency members of
the FAR Council shall jointly take steps to amend the FAR.
(ii) Within 180 days of the date of this order, FCEB agencies shall enable
encrypted DNS protocols wherever their existing clients and servers support
those protocols. FCEB agencies shall also enable such protocols within 180
days of any additional clients and servers supporting such protocols.
(d) The Federal Government must encrypt email
messages in transport and, where practical, use end-to-
end encryption in order to protect messages from
compromise.
[[Page 6762]]
(i) Within 120 days of the date of this order, each FCEB agency shall
technically enforce encrypted and authenticated transport for all
connections between the agency's email clients and their associated email
servers.
(ii) Within 180 days of the date of this order, the Director of OMB shall
establish a requirement for expanded use of authenticated transport-layer
encryption between email servers used by FCEB agencies to send and receive
email.
(iii) Within 90 days of the establishment of the requirement described in
subsection (d)(ii) of this section, the Secretary of Homeland Security,
acting through the Director of CISA, shall take appropriate steps to assist
agencies in meeting that requirement, including by issuing implementing
directives, as well as technical guidance to address any identified
capability gaps.
(e) Modern communications such as voice and video
conferencing and instant messaging are usually
encrypted at the link level but often are not encrypted
end-to-end. Within 180 days of the date of this order,
to advance the security of internet-based voice and
video conferencing and instant messaging, the Director
of OMB, in coordination with the Secretary of Homeland
Security, acting through the Director of CISA; the
Secretary of Defense, acting through the Director of
the National Security Agency (NSA); the Secretary of
Commerce, acting through the Director of NIST; the
Archivist of the United States, acting through the
Chief Records Officer for the United States Government;
and the Administrator of General Services shall take
appropriate steps to require agencies to:
(i) enable transport encryption by default; and
(ii) where technically supported, use end-to-end encryption by default
while maintaining logging and archival capabilities that allow agencies to
fulfill records management and accountability requirements.
(f) Alongside their benefits, quantum computers
pose significant risk to the national security,
including the economic security, of the United States.
Most notably, a quantum computer of sufficient size and
sophistication--also known as a cryptanalytically
relevant quantum computer (CRQC)--will be capable of
breaking much of the public-key cryptography used on
digital systems across the United States and around the
world. In National Security Memorandum 10 of May 4,
2022 (Promoting United States Leadership in Quantum
Computing While Mitigating Risks to Vulnerable
Cryptographic Systems), I directed the Federal
Government to prepare for a transition to cryptographic
algorithms that would not be vulnerable to a CRQC.
(i) Within 180 days of the date of this order, the Secretary of Homeland
Security, acting through the Director of CISA, shall release and thereafter
regularly update a list of product categories in which products that
support post-quantum cryptography (PQC) are widely available.
(ii) Within 90 days of a product category being placed on the list
described in subsection (f)(i) of this section, agencies shall take steps
to include in any solicitations for products in that category a requirement
that products support PQC.
(iii) Agencies shall implement PQC key establishment or hybrid key
establishment including a PQC algorithm as soon as practicable upon support
being provided by network security products and services already deployed
in their network architectures.
(iv) Within 90 days of the date of this order, the Secretary of State and
the Secretary of Commerce, acting through the Director of NIST and the
Under Secretary for International Trade, shall identify and engage foreign
governments and industry groups in key countries to encourage their
transition to PQC algorithms standardized by NIST.
(v) Within 180 days of the date of this order, to prepare for transition to
PQC, the Secretary of Defense with respect to National Security Systems
(NSS), and the Director of OMB with respect to non-NSS, shall each
[[Page 6763]]
issue requirements for agencies to support, as soon as practicable, but not
later than January 2, 2030, Transport Layer Security protocol version 1.3
or a successor version.
(g) The Federal Government should take advantage of
commercial security technologies and architectures,
such as hardware security modules, trusted execution
environments, and other isolation technologies, to
protect and audit access to cryptographic keys with
extended lifecycles.
(i) Within 270 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, in consultation with the Secretary of
Homeland Security, acting through the Director of CISA, and the
Administrator of General Services shall develop guidelines for the secure
management of access tokens and cryptographic keys used by cloud service
providers.
(ii) Within 60 days of the publication of the guidelines described in
subsection (g)(i) of this section, the Administrator of General Services,
acting through the FedRAMP Director, in consultation with the Secretary of
Commerce, acting through the Director of NIST, and the Secretary of
Homeland Security, acting through the Director of CISA, shall develop
updated FedRAMP requirements, incorporating the guidelines described in
subsection (g)(i) of this section, as appropriate and consistent with
guidance issued by the Director of OMB, concerning cryptographic key
management security practices.
(iii) Within 60 days of the publication of the guidelines described in
subsection (g)(i) of this section, the Director of OMB, in consultation
with the Secretary of Commerce, acting through the Director of NIST; the
Secretary of Homeland Security, acting through the Director of CISA; and
the Administrator of General Services shall take appropriate steps to
require FCEB agencies to follow best practices concerning the protection
and management of hardware security modules, trusted execution
environments, or other isolation technologies for access tokens and
cryptographic keys used by cloud service providers in the provision of
services to agencies.
Sec. 5. Solutions to Combat Cybercrime and Fraud. (a)
The use of stolen and synthetic identities by criminal
syndicates to systemically defraud public benefits
programs costs taxpayers and wastes Federal Government
funds. To help address these crimes it is the policy of
the executive branch to strongly encourage the
acceptance of digital identity documents to access
public benefits programs that require identity
verification, so long as it is done in a manner that
preserves broad program access for vulnerable
populations and supports the principles of privacy,
data minimization, and interoperability.
(i) Within 90 days of the date of this order, agencies with grantmaking
authority are encouraged to consider, in coordination with OMB and the
National Security Council staff, whether Federal grant funding is available
to assist States in developing and issuing mobile driver's licenses that
achieve the policies and principles described in this section.
(ii) Within 270 days of the date of this order, the Secretary of Commerce,
acting through the Director of NIST, shall issue practical implementation
guidance, in collaboration with relevant agencies and other stakeholders
through the National Cybersecurity Center of Excellence, to support remote
digital identity verification using digital identity documents that will
help issuers and verifiers of digital identity documents advance the
policies and principles described in this section.
(iii) Agencies should consider accepting digital identity documents as
digital identity verification evidence to access public benefits programs,
but only if the use of these documents is consistent with the policies and
principles described in this section.
(iv) Agencies should, consistent with applicable law, seek to ensure that
digital identity documents accepted as digital identity verification
evidence to access public benefits programs:
[[Page 6764]]
(A) are interoperable with relevant standards and trust frameworks, so
that the public can use any standards-compliant hardware or software
containing an official Government-issued digital identity document,
regardless of manufacturer or developer;
(B) do not enable authorities that issue digital identity documents,
device manufacturers, or any other third party to surveil or track
presentation of the digital identity document, including user device
location at the time of presentation; and
(C) support user privacy and data minimization by ensuring only the
minimum information required for a transaction--often a ``yes'' or ``no''
response to a question, such as whether an individual is older than a
specific age--is requested from the holder of the digital identity
document.
(b) The use of ``Yes/No'' validation services, also
referred to as attribute validation services, can
enable more privacy-preserving means to reduce identity
fraud. These services allow programs to confirm, via a
privacy-preserving ``yes'' or ``no'' response, that
applicant-provided identity information is consistent
with information already contained in official records,
without needing to share the contents of those official
records. To support the use of such services, the
Commissioner of Social Security, and the head of any
other agency designated by the Director of OMB, shall,
as appropriate and consistent with applicable law,
consider taking steps to develop or modify services--
including through, as appropriate, the initiation of a
proposed rulemaking or the publication of a notice of a
new or significantly modified routine use of records--
related to Government-operated identity verification
systems and public benefits programs, with
consideration given to having such systems and programs
submit applicant-provided identity information to the
agency providing the service and receive a ``yes'' or
``no'' response as to whether the applicant-provided
identity information is consistent with the information
on file with the agency providing the service. In doing
so, the heads of these agencies shall specifically
consider seeking to ensure, consistent with applicable
law, that:
(i) any applicant-provided identity information submitted to the services
and any ``yes'' or ``no'' response provided by the services are used only
to assist with identity verification, program administration, anti-fraud
operations, or investigation and prosecution of fraud related to the public
benefits program for which the identity information was submitted;
(ii) the services are made available, to the maximum extent permissible and
as appropriate, to public benefits programs; Government-operated identity
verification systems, including shared-service providers; payment integrity
programs; and United States-regulated financial institutions; and
(iii) the agencies, public benefits programs, or institutions using the
services provide reimbursement to appropriately cover costs and support the
ongoing maintenance, improvement, and broad accessibility of the services.
(c) The Secretary of the Treasury, in consultation
with the Administrator of General Services, shall
research, develop, and conduct a pilot program for
technology that notifies individuals and entities when
their identity information is used to request a payment
from a public benefits program, gives individuals and
entities the option to stop potentially fraudulent
transactions before they occur, and reports fraudulent
transactions to law enforcement entities.
Sec. 6. Promoting Security with and in Artificial
Intelligence. Artificial intelligence (AI) has the
potential to transform cyber defense by rapidly
identifying new vulnerabilities, increasing the scale
of threat detection techniques, and automating cyber
defense. The Federal Government must accelerate the
development and deployment of AI, explore ways to
improve the cybersecurity of critical infrastructure
using AI, and accelerate research at the intersection
of AI and cybersecurity.
(a) Within 180 days of the date of the completion
of the Defense Advanced Research Projects Agency's 2025
Artificial Intelligence Cyber Challenge, the Secretary
of Energy, in coordination with the Secretary of
Defense, acting
[[Page 6765]]
through the Director of the Defense Advanced Research
Projects Agency, and the Secretary of Homeland
Security, shall launch a pilot program, involving
collaboration with private sector critical
infrastructure entities as appropriate and consistent
with applicable law, on the use of AI to enhance cyber
defense of critical infrastructure in the energy
sector, and conduct an assessment of the pilot program
upon its completion. This pilot program, and
accompanying assessment, may include vulnerability
detection, automatic patch management, and the
identification and categorization of anomalous and
malicious activity across information technology (IT)
or operational technology systems.
(b) Within 270 days of the date of this order, the
Secretary of Defense shall establish a program to use
advanced AI models for cyber defense.
(c) Within 150 days of the date of this order, the
Secretary of Commerce, acting through the Director of
NIST; the Secretary of Energy; the Secretary of
Homeland Security, acting through the Under Secretary
for Science and Technology; and the Director of the
National Science Foundation (NSF) shall each prioritize
funding for their respective programs that encourage
the development of large-scale, labeled datasets needed
to make progress on cyber defense research, and ensure
that existing datasets for cyber defense research have
been made accessible to the broader academic research
community (either securely or publicly) to the maximum
extent feasible, in consideration of business
confidentiality and national security.
(d) Within 150 days of the date of this order, the
Secretary of Commerce, acting through the Director of
NIST; the Secretary of Energy; the Secretary of
Homeland Security, acting through the Under Secretary
for Science and Technology; and the Director of the NSF
shall prioritize research on the following topics:
(i) human-AI interaction methods to assist defensive cyber analysis;
(ii) security of AI coding assistance, including security of AI-generated
code;
(iii) methods for designing secure AI systems; and
(iv) methods for prevention, response, remediation, and recovery of cyber
incidents involving AI systems.
(e) Within 150 days of the date of this order, the
Secretary of Defense, the Secretary of Homeland
Security, and the Director of National Intelligence, in
coordination with the Director of OMB, shall
incorporate management of AI software vulnerabilities
and compromises into their respective agencies'
existing processes and interagency coordination
mechanisms for vulnerability management, including
through incident tracking, response, and reporting, and
by sharing indicators of compromise for AI systems.
Sec. 7. Aligning Policy to Practice. (a) IT
infrastructure and networks that support agencies'
critical missions need to be modernized. Agencies'
policies must align investments and priorities to
improve network visibility and security controls to
reduce cyber risks.
(i) Within 3 years of the date of this order, the Director of OMB shall
issue guidance, including any necessary revision to OMB Circular A-130, to
address critical risks and adapt modern practices and architectures across
Federal information systems and networks. This guidance shall, at a
minimum:
(A) outline expectations for agency cybersecurity information sharing and
exchange, enterprise visibility, and accountability for enterprise-wide
cybersecurity programs by agency CISOs;
(B) revise OMB Circular A-130 to be less technically prescriptive in key
areas, where appropriate, to more clearly promote the adoption of evolving
cybersecurity best practices across Federal systems, and to include
migration to zero trust architectures and implementation of critical
elements such as EDR capabilities, encryption, network segmentation, and
phishing-resistant multi-factor authentication; and
[[Page 6766]]
(C) address how agencies should identify, assess, respond to, and
mitigate risks to mission essential functions presented by concentration of
IT vendors and services.
(ii) The Secretary of Commerce, acting through the Director of NIST; the
Secretary of Homeland Security, acting through the Director of CISA; and
the Director of OMB shall establish a pilot program of a rules-as-code
approach for machine-readable versions of policy and guidance that OMB,
NIST, and CISA publish and manage regarding cybersecurity.
(b) Managing cybersecurity risks is now a part of
everyday industry practice and should be expected for
all types of businesses. Minimum cybersecurity
requirements can make it costlier and harder for threat
actors to compromise networks. Within 240 days of the
date of this order, the Secretary of Commerce, acting
through the Director of NIST, shall evaluate common
cybersecurity practices and security control outcomes
that are commonly used or recommended across industry
sectors, international standards bodies, and other risk
management programs, and based on that evaluation issue
guidance identifying minimum cybersecurity practices.
In developing this guidance, the Secretary of Commerce,
acting through the Director of NIST, shall solicit
input from the Federal Government, the private sector,
academia, and other appropriate actors.
(c) Agencies face multiple cybersecurity risks when
purchasing products and services. While agencies have
already made significant advances to improve their
supply chain risk management, additional actions are
needed to keep pace with the evolving threat landscape.
Within 180 days of the issuance of the guidance
described in subsection (b) of this section, the FAR
Council shall review the guidance and, as appropriate
and consistent with applicable law, the agency members
of the FAR Council shall jointly take steps to amend
the FAR to:
(i) require that contractors with the Federal Government follow applicable
minimum cybersecurity practices identified in NIST's guidance pursuant to
subsection (b) of this section with respect to work performed under agency
contracts or when developing, maintaining, or supporting IT services or
products that are provided to the Federal Government; and
(ii) adopt requirements for agencies to, by January 4, 2027, require
vendors to the Federal Government of consumer internet-of-Things products,
as defined by 47 CFR 8.203(b), to carry United States Cyber Trust Mark
labeling for those products.
Sec. 8. National Security Systems and Debilitating
Impact Systems. (a) Except as specifically provided for
in section 4(f)(v) of this order, sections 1 through 7
of this order shall not apply to Federal information
systems that are NSS or are otherwise identified by the
Department of Defense or the Intelligence Community as
debilitating impact systems.
(b) Within 90 days of the date of this order, to
help ensure that NSS and debilitating impact systems
are protected with the most advanced security measures,
the Secretary of Defense, acting through the Director
of NSA as the National Manager for National Security
Systems (National Manager), in coordination with the
Director of National Intelligence and the Committee on
National Security Systems (CNSS), and in consultation
with the Director of OMB and the Assistant to the
President for National Security Affairs (APNSA), shall
develop requirements for NSS and debilitating impact
systems that are consistent with the requirements set
forth in this order, as appropriate and consistent with
applicable law. The Secretary of Defense may grant
exceptions to such requirements in circumstances
necessitated by unique mission needs. Such requirements
shall be incorporated into a proposed National Security
Memorandum, to be submitted to the President through
the APNSA.
(c) To help protect space NSS with cybersecurity
measures that keep pace with emerging threats, within
210 days of the date of this order, the CNSS shall
review and update, as appropriate, relevant policies
and guidance regarding space system cybersecurity. In
addition to appropriate
[[Page 6767]]
updates, the CNSS shall identify and address
appropriate requirements to implement cyber defenses on
Federal Government-procured space NSS in the areas of
intrusion detection, use of hardware roots of trust for
secure booting, and development and deployment of
security patches.
(d) To enhance the effective governance and
oversight of Federal information systems, within 90
days of the date of this order, the Director of OMB
shall issue guidance as appropriate requiring agencies
to inventory all major information systems and provide
the inventory to CISA, the Department of Defense, or
the National Manager, as applicable, which shall each
maintain a registry of agency inventories within their
purview. CISA, the Department of Defense CIO, and the
National Manager will share their inventories as
appropriate to identify gaps or overlaps in oversight
coverage. This guidance shall not apply to elements of
the Intelligence Community.
(e) Nothing in this order alters the authorities
and responsibilities granted in law or policy to the
Director of National Intelligence, the Secretary of
Defense, and the National Manager over applicable
systems pursuant to the National Security Act of 1947
(Public Law 80-253), the Federal Information Security
Modernization Act of 2014 (Public Law 113-283),
National Security Directive 42 of July 5, 1990
(National Policy for the Security of National Security
Telecommunications and Information Systems), or
National Security Memorandum 8 of January 19, 2022
(Improving the Cybersecurity of National Security,
Department of Defense, and Intelligence Community
Systems).
Sec. 9. Additional Steps to Combat Significant
Malicious Cyber-Enabled Activities. Because I find that
additional steps must be taken to deal with the
national emergency with respect to significant
malicious cyber-enabled activities declared in
Executive Order 13694 of April 1, 2015 (Blocking the
Property of Certain Persons Engaging in Significant
Malicious Cyber-Enabled Activities), as amended by
Executive Order 13757 of December 28, 2016 (Taking
Additional Steps to Address the National Emergency With
Respect to Significant Malicious Cyber-Enabled
Activities), and further amended by Executive Order
13984 of January 19, 2021 (Taking Additional Steps to
Address the National Emergency With Respect to
Significant Malicious Cyber-Enabled Activities), to
protect against the growing and evolving threat of
malicious cyber-enabled activities against the United
States and United States allies and partners, including
the increasing threats by foreign actors of
unauthorized access to critical infrastructure,
ransomware, and cyber-enabled intrusions and sanctions
evasion, I hereby order that section 1(a) of Executive
Order 13694 is further amended to read as follows:
``Section 1. (a) All property and interests in
property that are in the United States, that hereafter
come within the United States, or that are or hereafter
come within the possession or control of any United
States person of the following persons are blocked and
may not be transferred, paid, exported, withdrawn, or
otherwise dealt in:
(i) the persons listed in the Annex to this order;
(ii) any person determined by the Secretary of the Treasury, in
consultation with the Attorney General and the Secretary of State, to be
responsible for or complicit in, or to have engaged in, directly or
indirectly, cyber-enabled activities originating from, or directed by
persons located, in whole or in substantial part, outside the United States
that are reasonably likely to result in, or have materially contributed to,
a threat to the national security, foreign policy, or economic health or
financial stability of the United States, and that have the purpose of or
involve:
(A) harming, or otherwise compromising the provision of services by, a
computer or network of computers that support one or more entities in a
critical infrastructure sector;
(B) compromising the provision of services by one or more entities in a
critical infrastructure sector;
[[Page 6768]]
(C) causing a disruption to the availability of a computer or network of
computers or compromising the integrity of the information stored on a
computer or network of computers;
(D) causing a misappropriation of funds or economic resources,
intellectual property, proprietary or business confidential information,
personal identifiers, or financial information for commercial or
competitive advantage or private financial gain;
(E) tampering with, altering, or causing a misappropriation of
information with the purpose of or that involves interfering with or
undermining election processes or institutions; or
(F) engaging in a ransomware attack, such as extortion through malicious
use of code, encryption, or other activity to affect the confidentiality,
integrity, or availability of data or a computer or network of computers,
against a United States person, the United States, a United States ally or
partner or a citizen, national, or entity organized under the laws thereof;
or
(iii) any person determined by the Secretary of the Treasury, in
consultation with the Attorney General and the Secretary of State:
(A) to be responsible for or complicit in, or to have engaged in,
directly or indirectly, the receipt or use for commercial or competitive
advantage or private financial gain, or by a commercial entity, outside the
United States of funds or economic resources, intellectual property,
proprietary or business confidential information, personal identifiers, or
financial information misappropriated through cyber-enabled means, knowing
they have been misappropriated, where the misappropriation of such funds or
economic resources, intellectual property, proprietary or business
confidential information, personal identifiers, or financial information is
reasonably likely to result in, or has materially contributed to, a threat
to the national security, foreign policy, or economic health or financial
stability of the United States;
(B) to be responsible for or complicit in, or to have engaged in,
directly or indirectly, activities related to gaining or attempting to gain
unauthorized access to a computer or network of computers of a United
States person, the United States, a United States ally or partner or a
citizen, national, or entity organized under the laws thereof, where such
efforts originate from or are directed by persons located, in whole or
substantial part, outside the United States and are reasonably likely to
result in, or have materially contributed to, a significant threat to the
national security, foreign policy, or economic health or financial
stability of the United States;
(C) to have materially assisted, sponsored, or provided financial,
material, or technological support for, or goods or services to or in
support of, any activity described in subsections (a)(ii) or (a)(iii)(A) or
(B) of this section or any person whose property and interests in property
are blocked pursuant to this order;
(D) to be owned or controlled by, or to have acted or purported to act
for or on behalf of, directly or indirectly, any person whose property and
interests in property are blocked pursuant to this order or that has
engaged in any activity described in subsections (a)(ii) or (a)(iii)(A)-(C)
of this section;
(E) to have attempted to engage in any of the activities described in
subsections (a)(ii) and (a)(iii)(A)-(D) of this section; or
(F) to be or have been a leader, official, senior executive officer, or
member of the board of directors of any person whose property and interests
in property are blocked pursuant to this order or that has engaged in any
activity described in subsections (a)(ii) or (a)(iii)(A) - (E) of this
section.''
Sec. 10. Definitions. For purposes of this order:
[[Page 6769]]
(a) The term ``agency'' has the meaning ascribed to
it under 44 U.S.C. 3502(1), except for the independent
regulatory agencies described in 44 U.S.C. 3502(5).
(b) The term ``artifact'' means a record or data
that is generated manually or by automated means and
may be used to demonstrate compliance with defined
practices, including for secure software development.
(c) The term ``artificial intelligence'' or ``AI''
has the meaning set forth in 15 U.S.C. 9401(3).
(d) The term ``AI system'' means any data system,
software, hardware, application, tool, or utility that
operates in whole or in part using AI.
(e) The term ``authentication'' means the process
of determining the validity of one or more
authenticators, such as a password, used to claim a
digital identity.
(f) The term ``Border Gateway Protocol'' or ``BGP''
means the control protocol used to distribute and
compute paths between the tens of thousands of
autonomous networks that constitute the internet.
(g) The term ``consumer internet-of-Things
products'' means internet-of-Things products intended
primarily for consumer use, rather than enterprise or
industrial use. Consumer internet-of-Things products do
not include medical devices regulated by the United
States Food and Drug Administration or motor vehicles
and motor vehicle equipment regulated by the National
Highway Traffic Safety Administration.
(h) The term ``cyber incident'' has the meaning
given to the term ``incident'' under 44 U.S.C.
3552(b)(2).
(i) The term ``debilitating impact systems'' means
systems as described by 44 U.S.C. 3553(e)(2) and
3553(e)(3) for Department of Defense and Intelligence
Community purposes, respectively.
(j) The term ``digital identity document'' means an
electronic, reusable, cryptographically verifiable
identity credential issued by a Government source, such
as a State-issued mobile driver's license or an
electronic passport.
(k) The term ``digital identity verification''
means identity verification that a user performs
online.
(l) The term ``endpoint'' means any device that can
be connected to a computer network creating an entry or
exit point for data communications. Examples of
endpoints include desktop and laptop computers,
smartphones, tablets, servers, workstations, virtual
machines, and consumer internet-of-Things products.
(m) The term ``endpoint detection and response''
means cybersecurity tools and capabilities that combine
real-time continuous monitoring and collection of
endpoint data (for example, networked computing device
such as workstations, mobile phones, servers) with
rules-based automated response and analysis
capabilities.
(n) The term ``Federal Civilian Executive Branch
agencies'' or ``FCEB agencies'' includes all agencies
except for the agencies and other components in the
Department of Defense and agencies in the Intelligence
Community.
(o) The term ``Federal information system'' means
an information system used or operated by an agency, a
contractor of an agency, or another organization on
behalf of an agency.
(p) The term ``Government-operated identity
verification system'' means a system owned and operated
by a Federal, State, local, Tribal, or territorial
Government entity that performs identity verification,
including single-agency systems and shared services
that provide service to multiple agencies.
(q) The term ``hardware root of trust'' means an
inherently trusted combination of hardware and firmware
that helps to maintain the integrity of information.
[[Page 6770]]
(r) The term ``hybrid key establishment'' means a
key establishment scheme that is a combination of two
or more components that are themselves cryptographic
key-establishment schemes.
(s) The term ``identity verification'' means the
process of collecting identity information or evidence,
validating its legitimacy, and confirming that it is
associated with the real person providing it.
(t) The term ``Intelligence Community'' has the
meaning given to it under 50 U.S.C. 3003(4).
(u) The term ``key establishment'' means the
process by which a cryptographic key is securely shared
between two or more entities.
(v) The term ``least privilege'' means the
principle that a security architecture is designed so
that each entity is granted the minimum system
resources and authorizations that the entity needs to
perform its function.
(w) The term ``machine-readable'' means that the
product output is in a structured format that can be
consumed by another program using consistent processing
logic.
(x) The term ``national security systems'' or
``NSS'' has the meaning given to it under 44 U.S.C.
3552(b)(6).
(y) The term ``patch'' means a software component
that, when installed, directly modifies files or device
settings related to a different software component
without changing the version number or release details
for the related software component.
(z) The term ``rules-as-code approach'' means a
coded version of rules (for example, those contained in
legislation, regulation, or policy) that can be
understood and used by a computer.
(aa) The term ``secure booting'' means a security
feature that prevents malicious software from running
when a computer system starts up. The security feature
performs a series of checks during the boot sequence
that helps ensure only trusted software is loaded.
(bb) The term ``security control outcome'' means
the results of the performance or non-performance of
safeguards or countermeasures prescribed for an
information system or an organization to protect the
confidentiality, integrity, and availability of the
system and its information.
(cc) The term ``zero trust architecture'' has the
meaning given to it in Executive Order 14028.
Sec. 11. General Provisions. (a) Nothing in this order
shall be construed to impair or otherwise affect:
(i) the authority granted by law to an executive department or agency, or
the head thereof; or
(ii) the functions of the Director of the Office of Management and Budget
relating to budgetary, administrative, or legislative proposals.
(b) This order shall be implemented in a manner
consistent with applicable law and subject to the
availability of appropriations.
[[Page 6771]]
(c) This order is not intended to, and does not,
create any right or benefit, substantive or procedural,
enforceable at law or in equity by any party against
the United States, its departments, agencies, or
entities, its officers, employees, or agents, or any
other person.
(Presidential Sig.)
THE WHITE HOUSE,
January 16, 2025.
[FR Doc. 2025-01470
Filed 1-16-25; 2:00 pm]
Billing code 3395-F4-P