Technology and cybersecurity

Executive Order 13984: Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber- Enabled Activities

President: Donald J. Trump

Directed Commerce to propose identity-verification and special-measure rules for foreign users of United States cloud infrastructure services to address malicious cyber activity.

Status: In effect. Is Executive Order 13984 still in effect? Yes. The March 24, 2026 presidential notice continued the cyber emergency for one year beyond April 1, 2026 and expressly retained Executive Order 13984 among its measures. This does not mean its proposed customer-identification regulations have become final. See Continuation of the Cyber National Emergency, March 24, 2026; Commerce 2026 Unified Agenda.

What does Executive Order 13984 do?

EO 13984 directed measures to identify foreign cyber actors using U.S. infrastructure-as-a-service products and authorized related sanctions.

Later primary evidence reviewed September 24, 2026: Commerce issued an advance notice seeking comment on regulations to implement this order's cloud-service identity-verification and special-measures provisions; the notice was a proposal-development step, not a final rule. Official source. The cited steps do not establish every downstream effect.

Administration position: Any policy rationale or projected benefit in the order is the administration’s position. This index record does not treat those claims as independently established facts.

The contemplated identification system concerns foreign persons obtaining or maintaining accounts with U.S. infrastructure providers. Section 5 includes trial offerings, virtual private servers, dedicated servers and managed or unmanaged infrastructure within its definition when the specified computing characteristics are met. It is not a statement that every internet user immediately had to provide a passport. Section 1 calls for rules covering identification records, payment/contact information and access logs, while also restricting third-party access as law permits and considering providers’ burdens. EO 13984, sections 1 and 5.

Special measures are a separate mechanism from routine customer identification. The Commerce Secretary must make the findings and consultations specified in section 2 and consider effects on legitimate business, competition, national security, investigations and foreign policy. The tools concern prohibitions or conditions on opening or maintaining relevant IaaS accounts. They should not be described as an automatic ban on every foreign customer or as a completed designation of every foreign jurisdiction. The order invokes IEEPA, the National Emergencies Act and presidential delegation authority; section 7 preserves applicable law, appropriations and authorized intelligence, military and law-enforcement activities. EO 13984, preamble and sections 2 and 7.

Actual rulemaking is distinguishable from those directions. Commerce’s January 29, 2024 notice was a proposed rule with comments due April 29, 2024; it also proposed AI-training reporting under the separate EO 14110. The 2026 Unified Agenda and Reginfo timetable list RIN 0694-AJ35 as withdrawn on December 16, 2025 under “Completed Actions.” That category does not mean the proposed customer-identification requirements became final. The March 24, 2026 emergency-continuation notice separately lists EO 13984 while expressly noting EO 14110’s revocation. The underlying order’s status and the fate of a particular implementing proposal therefore should not be collapsed into one label. 2024 proposed rule, summary and dates; 2026 agenda, entry 184; Reginfo timetable; 2026 continuation notice.

SignedJanuary 19, 2021
IssuerPresident Donald J. Trump
TermFirst presidential term
EO 13984 signing-based work, special-measures waiting period, withdrawn proposal and continued emergency
Original source-based diagram. “Completed Actions” in a rulemaking agenda is not the same as a final customer-identification rule. EO 13984, sections 1–3; 2026 agenda, entry 184; 2026 continuation notice.

Before and after

Before the order

Earlier cyber-sanctions and information-security rules preceded these cloud-service identification directions.

After the order

Commerce issued an advance notice seeking comment on regulations to implement this order's cloud-service identity-verification and special-measures provisions; the notice was a proposal-development step, not a final rule.

Who had to do what

Agency / officeActionTiming / position
Commerce Secretary: customer identificationPropose identity-verification regulations for foreign customers’ IaaS accounts, including secure records, access limits, burden considerations and exemption procedures.Section 1: propose for notice and comment within 180 days of January 19, 2021; this is not a deadline requiring every customer to submit documents that day.
Commerce Secretary: special measuresPropose rules for restrictions or conditions on specified foreign jurisdictions/persons after findings and consultation; consider legitimate-business, burden and national-security factors.Section 2(a): proposal within 180 days of signing. Section 2(e): may not impose the specified special-measures requirements earlier than 180 days after issuance of section 1 final regulations.
Attorney GeneralWith Homeland Security and coordinating with Commerce, obtain industry feedback and submit recommendations to the President on sharing, liability protections and detection.Sections 3(a)–(c): industry engagement within 120 days; report within 240 days of signing, considering existing sharing mechanisms and legal/policy gaps.
Homeland Security SecretaryJointly lead the section 3 industry engagement/report with the Attorney General; consult on exemptions and special-measures findings.Sections 3(a)–(c): the same 120-day and 240-day clocks, not a separate clock triggered by Commerce’s final rule.
Defense Secretary and Director of National IntelligenceConsult with Commerce on identity-rule exemptions and special-measures findings.Sections 1(c), 2(a): consultation roles; no independent numerical report deadline.
State SecretaryConsult on special-measures findings and on Treasury’s national-emergency reporting to Congress.Sections 2(a), 6: consultation, not independent authority here to impose every account restriction.
Treasury SecretaryConsult on special-measures findings; authorized to submit recurring/final national-emergency reports to Congress, consulting State, Justice and Commerce.Sections 2(a), 6: reporting consistent with NEA section 401(c) and IEEPA section 204(c); no new numerical report clock stated in this amendment.
Commerce Secretary: resources and implementationIdentify funding requirements and include them in annual OMB submissions; may use delegated IEEPA powers and lawfully redelegate within Commerce.Sections 4, 7(a): annual budget process; rulemaking/delegation authority does not itself appropriate funds.
OMB Director and other agency headsOMB receives Commerce budget submissions; other heads consult as specified and agencies take appropriate lawful implementation measures within their authority.Sections 4, 7: recipient/consultation/implementation roles, not a new standalone OMB report deadline.
U.S. IaaS providers and account holdersAre the intended subjects of the contemplated identification/special-measures regulations, including foreign-account and reseller-account coverage.Sections 1–2, 5: distinguish proposed rules from final operative requirements; do not treat an elapsed proposal deadline as proof of a final compliance rule.

The order contains two different 180-day references. Sections 1 and 2(a) set signing-based proposal deadlines. Section 2(e) instead limits when Commerce may impose special-measures requirements: at least 180 days after issuance of the section 1 final regulations. Replacing both with “180 days after signing” would remove a material legal safeguard. Signed sections 1–2.

What happened next

Executive Order 13984 signed.

The Federal Register published the January 19 order. Signing-based proposal, engagement and report clocks differ from publication and from the later final-rule waiting period. Official source.

Commerce published an advance notice soliciting implementation comments, as documented in the later proposed rule’s section III. This was not a final customer-identification regulation. Official source.

Commerce published its proposed IaaS rule, with an April 29, 2024 comment deadline. The notice also addressed separate EO 14110 AI-reporting directions. Official source.

Commerce’s 2026 Unified Agenda and Reginfo timetable record the RIN 0694-AJ35 action as withdrawn on this date. “Completed Actions” is not evidence the proposal became a final rule. Official source.

The President continued the cyber national emergency for one year beyond April 1, 2026; the notice lists EO 13984 and expressly identifies EO 14110 as revoked. It was published March 27. Official source.

Later primary evidence reviewed: Commerce issued an advance notice seeking comment on regulations to implement this order's cloud-service identity-verification and special-measures provisions; the notice was a proposal-development step, not a final rule.