Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
President: Donald J. Trump
Directed federal agencies to strengthen cybersecurity risk management, modernize federal networks and improve critical-infrastructure coordination.
Status: In effect. Is Executive Order 13800 still in effect? Yes. Executive Order 13800 remains in effect; later cybersecurity orders and implementation measures supplement its risk-management framework.
What does Executive Order 13800 do?
EO 13800 made the heads of federal agencies accountable for cybersecurity risk, including accepted risks from aging systems and unpatched vulnerabilities. It required agencies to use the NIST cybersecurity framework immediately, connect risk decisions with budgets and operational planning, and describe both their current risk choices and an implementation plan. The practical audience was agency leadership, not just individual information-technology staff. Official source.
The order also addressed critical infrastructure operated outside the federal government. It required assessments of assistance for infrastructure at greatest risk, market transparency, botnet attacks, prolonged electricity outages and the defense industrial base. These were distinct reporting and coordination assignments. The signed text supported private operators through existing federal capabilities; it did not itself impose a single mandatory cybersecurity standard on every private company. Official source.
A third section covered deterrence, international cooperation and the cybersecurity workforce. State was assigned a diplomatic strategy while Commerce and Homeland Security examined workforce development. Defense and the Director of National Intelligence handled the separate national-security-system requirements, reflecting the statutory distinction between those systems and ordinary civilian agency networks. Official source.
Before and after
Before the order
Agencies already had information-security responsibilities under federal law, and NIST had published its framework. The order added a common presidential reporting cycle and made risk acceptance visible to OMB and Homeland Security. Existing agency-specific systems were therefore brought into an executive-branch-wide assessment rather than replaced overnight. Official source.
After the order
Agency heads had to submit risk reports within 90 days and favor shared services where lawful. OMB and Homeland Security were to assess the reports and propose remedial, budgetary and recurring-review measures. The resulting process tied cybersecurity to leadership decisions and modernization. The Botnet Report released May 30, 2018 documents one required output; publication of that report does not demonstrate that every other assignment was fulfilled. Official source.
Who had to do what
| Agency / office | Action | Timing / position |
|---|---|---|
| Agency heads | Use the NIST framework; submit risk reports; prefer shared IT services; supply modernization information. | Framework immediately; risk reports within 90 days. |
| OMB Director | Jointly assess agency reports with Homeland Security; submit determination and remedial plan, supported by Commerce and GSA. | Within 60 days after receiving agency reports. |
| Homeland Security Secretary | Coordinate civilian risk assessment, high-risk infrastructure assistance, transparency and botnet work. | Transparency 90 days; infrastructure report 180 days and annually thereafter. |
| Commerce Secretary | Co-lead botnet report and workforce review; consult relevant stakeholders. | Botnet preliminary report 240 days; final report one year; workforce report 120 days. |
| American Technology Council Director / GSA Administrator | Coordinate and contribute to the federal IT modernization report with OMB and Homeland Security. | Within 90 days. |
| Defense Secretary / Director of National Intelligence | Implement national-security-system provisions; assess military capabilities and defense industrial-base cybersecurity with Homeland Security and FBI. | National-security report 150 days; defense assessment 90 days. |
| Energy Secretary | Assess prolonged cyber-related electricity disruption with Homeland Security and intelligence consultation. | Within 90 days. |
| Attorney General / FBI Director / sector-specific agencies | Consult on high-risk infrastructure and botnets; FBI contributes defense-industrial-base assessment. | Applicable 90-day, 180-day and botnet reporting periods. |
| FCC and FTC Chairs | Consult in the Commerce–Homeland Security botnet process. | During report preparation. |
| State Secretary | Coordinate international-cooperation recommendations and submit a cyber engagement strategy. | Recommendations 45 days; strategy 90 days thereafter. |
| National Security Adviser / Homeland Security and Counterterrorism Adviser | Receive the coordinated cyber-deterrence and other assigned reports for the President. | Deterrence report within 90 days. |
| Treasury Secretary / United States Trade Representative | Treasury joins international cooperation priorities and the strategic deterrence report; USTR joins strategic deterrence reporting. | International priorities 45 days; deterrence report 90 days. |
| Labor Secretary / Education Secretary / OPM Director | Consult Commerce and Homeland Security on domestic cybersecurity education, training and apprenticeship capacity. | Within the 120-day workforce-report period. |
| Director of National Intelligence | Review foreign cyber peers’ workforce development practices and report findings. | Within 60 days. |
| Defense Secretary, coordinating Commerce, Homeland Security and DNI | Assess maintenance or expansion of the United States national-security cyber-capability advantage and report findings. | Within 150 days. |
What happened next
EO 13800 establishes the cybersecurity reporting and risk-management framework. Official source
Commerce and Homeland Security release their report on resilience against botnets. Official source
EO 14028 adds federal incident sharing, software-security and other cybersecurity measures. Official source
Legal and source detail
Sources by type
The civilian reporting framework expressly operates under the federal information-security provisions in title 44, chapter 35, subchapter II. It also references the Homeland Security Act and preexisting infrastructure policies. Classified reports were allowed where appropriate, so a missing public report alone does not establish noncompliance. The order preserved agency authority and OMB functions and subjected implementation to law and appropriations; procurement preferences consequently remained bounded by applicable acquisition requirements. Official source.
Primary and official sources
How we checked this
Last checked against the sources above on September 15, 2026. How we research →
Agency heads were directed to assess network risks under the NIST framework and report on federal and critical-infrastructure cybersecurity. Completion of every review is not established here.