Technology and cybersecurity

Executive Order 14028: Improving the Nation's Cybersecurity

President: Joseph R. Biden Jr.

Required stronger federal cloud and zero-trust security, incident information sharing, secure-software practices, endpoint detection, logging and a Cyber Safety Review Board.

Status: Superseded. Is Executive Order 14028 still in effect? No. Executive Order 14028 was superseded. See Federal Register record.

A shield encloses government systems and connected servers, surrounded by staff, alerts and network motifs.
Federal cybersecurity responsibilities, illustrated symbolically; not evidence that particular systems are secure or that every deadline was met. EO Explained · site-generated editorial illustration · not documentary evidence.

What does Executive Order 14028 do?

The order set staged tasks for OMB, NIST, Commerce and Homeland Security on cloud systems, software, incident reporting and logging.

Administration position: The order’s findings and policy rationale were the Biden administration’s positions. This guide distinguishes them from implementation records and judicial rulings.
SignedMay 12, 2021
Lead officialsHomeland Security/CISA, OMB, Commerce/NIST, Defense, Justice and agencies
Express timingMultiple deadlines from 30 to 360 days

Before and after

Before the order

Federal cybersecurity requirements and contractor incident sharing were fragmented, and software-supply-chain assurance lacked common federal standards.

After the order

OMB, CISA and NIST issued zero-trust, logging, software-attestation and supply-chain guidance; the Review Board examined major incidents. EO 14144 added and superseded provisions, and EO 14306 retained selected later cybersecurity measures while amending that successor framework.

Who had to do what

Agency / officeActionTiming / position
OMB and agenciesAdopt cloud and zero-trust architecture60-day plans / ongoing
NIST and CommerceDevelop secure-software and labeling guidance30–360 days
DHS/CISA and agenciesImprove incident sharing, detection and loggingStaged deadlines

What happened next

EO 14028 signed.

EO 14144 supplemented and superseded parts of the framework.

EO 14306 amended the successor cybersecurity order while retaining selected efforts.