Technology and cybersecurity

Executive Order 13636: Improving Critical Infrastructure Cybersecurity

President: Barack Obama

Directed NIST to create a voluntary risk framework and improved cyber-threat information sharing with critical-infrastructure owners.

Status: In effect. Is Executive Order 13636 still in effect? Yes. Executive Order 13636 remains an unrevoked cybersecurity framework. Executive Order 13800 of May 11, 2017 expressly used its section 9 critical-infrastructure designations, and NIST continues to maintain the Cybersecurity Framework that the order directed it to develop. Sources: Federal Register 2013 executive order disposition table, EO 13636; Signed Executive Order 13636; Executive Order 13800, May 11, 2017; NIST, Executive Order 13636 implementation.

What does Executive Order 13636 do?

EO 13636 launched the NIST Cybersecurity Framework, expanded government sharing of unclassified cyber-threat information and required agencies to identify especially critical infrastructure and review existing regulation. Congress reinforced NIST’s role in 2014 and later information-sharing laws and cyber orders added new tools. NIST released CSF 2.0 in 2024 for organizations of every size and sector, while the order remains an important foundation.

Administration position: The NIST framework was designed as flexible risk guidance, not a universal regulation requiring every private organization to implement identical controls.
SignedFebruary 12, 2013
Framework leadNIST
First CSFFebruary 2014
Current versionCSF 2.0 issued February 2024

Before and after

Before the order

Critical-infrastructure sectors used varied cybersecurity practices without a common federal risk-management framework.

After the order

NIST developed a shared framework and agencies built voluntary adoption, information-sharing and sector-risk programs around it.

Who had to do what

Agency / officeActionTiming / position
NISTMaintain and update the Cybersecurity FrameworkContinuing
DHS and sector risk agenciesShare threats and support infrastructure ownersContinuing under later law
Critical-infrastructure ownersUse the framework according to risk and applicable lawGenerally voluntary

What happened next

EO 13636 issued.

NIST released CSF 1.0.

Executive Order 13800 directed agencies to support critical-infrastructure entities identified under section 9 of Executive Order 13636. Official source.

NIST released CSF 2.0.