Technology and cybersecurity executive orders

What this topic covers

Technology and cybersecurity orders address federal computer networks, critical infrastructure, software and communications supply chains, incident reporting, data protection, and artificial intelligence. Many assign standards and deadlines to agencies, especially the Office of Management and Budget, the Cybersecurity and Infrastructure Security Agency, and the National Institute of Standards and Technology. An order may require the government to modernize its own systems or direct a review of a vendor risk; it does not itself create a universal privacy law or replace Congress’s authority over interstate commerce and federal spending.

Clinton’s administration began federal policy coordination around the emerging national information infrastructure. George W. Bush emphasized protection of information systems and critical infrastructure. Obama’s EO 13636 established a framework for sharing cyber-threat information and developing voluntary cybersecurity standards for critical-infrastructure sectors. Trump’s first term followed with EO 13800 on federal networks and critical infrastructure, and EO 13873 on risks in the information and communications technology supply chain. These orders built different kinds of executive coordination rather than one comprehensive cybersecurity statute.

Biden’s EO 14028 required improvements to federal cybersecurity, including stronger software security practices and incident response. EO 14144 later promoted additional cybersecurity innovation and federal coordination. The orders affected procurement, agency operations, and information sharing, while private-sector obligations still depended on the relevant statutory or regulatory authority. This distinction helps explain why the same technology can be subject to several legal regimes without one executive order controlling every operator.

Trump’s second term has changed the federal policy baseline through EO 14179 on AI leadership, EO 14306 amending selected cybersecurity provisions, and EO 14365 establishing a national AI policy framework. EO 14352 addressed TikTok and national-security concerns under a separate legal route. The 2025–26 shift has been from Biden-era AI and cyber directives toward revisions, rescissions, and a new national framework. The signed texts and agency implementation records show which deadlines and controls remain; a policy announcement is not itself proof of deployment or a final technical standard.

The Supreme Court’s decision in TikTok Inc. v. Garland (2025) upheld the federal divest-or-restrict statute challenged in that case. It did not decide the validity of every executive order about technology or resolve all First Amendment and data-security questions in other settings. Loper Bright Enterprises v. Raimondo also matters when agencies rely on statutory delegations to regulate new technologies: courts must independently interpret the statute. Review the Loper Bright opinion, each guide’s Federal Register citation, and the National Archives disposition tables before treating a past directive as current policy.

Landmark orders and turning points

• EO 13636 (2013) launched a federal framework for critical-infrastructure cyber risk and public-private information sharing.
• EO 13800 (2017) directed modernization and security improvements for federal networks and infrastructure.
• EO 13873 (2019) created a review process for information and communications technology transactions presenting national-security risks.
• EO 14028 (2021) drove federal software-security, logging, incident-response, and cloud-modernization requirements.
• EO 14144 (2025) extended the Biden administration’s cybersecurity policy through additional federal requirements.
• EO 14179, EO 14306, and EO 14365 (2025) reset AI leadership and amend parts of the federal cyber framework.
• EO 14352 (2025) addresses one high-profile technology-security dispute through a distinct statutory and national-security path.

Read how EO Explained checks sources and status.