US Executive Order 14028 - Improving the Nation's Cybersecurity
Executive Order 14028 of 12 May 2021, the US Federal cybersecurity order: service providers collect, preserve and share incident data and report incidents to agencies and CISA; agencies plan cloud adoption and Zero Trust Architecture, adopt multi-factor authentication and encryption, deploy EDR, give CISA CDM data, follow a standard incident response playbook and meet logging requirements with log integrity; and software sold to agencies is developed under ten secure development practices with an SBOM, vulnerability disclosure and attestation. In force and unamended; EO 14144, as amended by EO 14306, builds on it.
US Executive Order 14028 - Improving the Nation's Cybersecurity is a compliance framework from United States (Federal executive branch) with 6 domains and 37 controls. The largest domains are Sec. 4 Enhancing software supply chain security – US Executive Order 14028 - Improving the Nation's Cybersecurity (15 controls), Sec. 3 Modernizing Federal Government cybersecurity – US Executive Order 14028 - Improving the Nation's Cybersecurity (8 controls), Sec. 2 Removing barriers to sharing threat information – US Executive Order 14028 - Improving the Nation's Cybersecurity (7 controls). Every control below carries what it requires and what an assessor expects to see.
Get the official standard. This page is a source-grounded companion to the published text, not a replacement for it.
Visit federalregister.govFramework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Sec. 2 Removing barriers to sharing threat information – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::2(c)(i) | Sec. 2(c)(i) Collect and preserve cybersecurity event data |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(c)(ii) | Sec. 2(c)(ii) Share incident data with the contracting agency |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(c)(iii) | Sec. 2(c)(iii) Collaborate in federal investigations and response |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(c)(iv) | Sec. 2(c)(iv) Share threat information in industry-recognized formats |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(f)(i) | Sec. 2(f)(i) Promptly report incidents involving products or services supplied |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(f)(ii) | Sec. 2(f)(ii) Also report to CISA |
| us-executive-order-14028-improving-the-nations-cybersecurity::2(k) | Sec. 2(k) Remove duplicative agency-specific cybersecurity requirements |
Sec. 3 Modernizing Federal Government cybersecurity – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::3(b)(i) | Sec. 3(b)(i) Update agency plans to prioritize cloud adoption |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(b)(ii) | Sec. 3(b)(ii) Develop a Zero Trust Architecture implementation plan |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(b)(iii) | Sec. 3(b)(iii) Report the cloud and zero trust plans to OMB and the APNSA |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(c) | Sec. 3(c) Adopt Zero Trust Architecture in cloud migration |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(c)(iv) | Sec. 3(c)(iv) Evaluate unclassified data sensitivity and report |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(d) | Sec. 3(d) Adopt multi-factor authentication and encryption of data at rest and in transit |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(d)(i) | Sec. 3(d)(i) Report MFA and encryption progress every 60 days |
| us-executive-order-14028-improving-the-nations-cybersecurity::3(d)(iii) | Sec. 3(d)(iii) Written rationale where MFA and encryption are not fully adopted |
Sec. 4 Enhancing software supply chain security – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(i) | Sec. 4(e)(i) Secure software development environments |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(ii) | Sec. 4(e)(ii) Generate and provide conformance artifacts |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(iii) | Sec. 4(e)(iii) Maintain trusted source code supply chains with automated tools |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(iv) | Sec. 4(e)(iv) Check for and remediate vulnerabilities before release |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(ix) | Sec. 4(e)(ix) Attest to secure software development practices |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(v) | Sec. 4(e)(v) Provide tool execution artifacts and publish risk summaries |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(vi) | Sec. 4(e)(vi) Maintain provenance data and controls on components, with recurring audits |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(vii) | Sec. 4(e)(vii) Provide a Software Bill of Materials |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(viii) | Sec. 4(e)(viii) Participate in a vulnerability disclosure program |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(e)(x) | Sec. 4(e)(x) Ensure and attest to open source integrity and provenance |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(j) | Sec. 4(j) Comply with the critical software security measures |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(k) | Sec. 4(k) Comply with the software supply chain guidance for software procured |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(n) | Sec. 4(n) Suppliers comply with and attest to the requirements (contract language) |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(p) | Sec. 4(p) Remove non-conforming software from contract vehicles |
| us-executive-order-14028-improving-the-nations-cybersecurity::4(q) | Sec. 4(q) Bring legacy software into compliance or plan remediation |
Sec. 6 Standardizing the incident and vulnerability response playbook – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::6(b)(ii) | Sec. 6(b)(ii) Use the standard incident and vulnerability response playbook |
| us-executive-order-14028-improving-the-nations-cybersecurity::6(d) | Sec. 6(d) Deviate from the playbook only after consultation and demonstration |
Sec. 7 Improving detection on Federal Government networks – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::7(b) | Sec. 7(b) Deploy an Endpoint Detection and Response initiative |
| us-executive-order-14028-improving-the-nations-cybersecurity::7(f) | Sec. 7(f) Establish or update the CDM Memorandum of Agreement with CISA |
Sec. 8 Investigative and remediation capabilities (logging) – US Executive Order 14028 - Improving the Nation's Cybersecurity
| Code | Title |
|---|---|
| us-executive-order-14028-improving-the-nations-cybersecurity::8(a) | Sec. 8(a) Collect and maintain logs and provide them to CISA and the FBI |
| us-executive-order-14028-improving-the-nations-cybersecurity::8(b) | Sec. 8(b) Protect log integrity cryptographically and retain lawfully |
| us-executive-order-14028-improving-the-nations-cybersecurity::8(c) | Sec. 8(c) Meet the logging, retention and log management requirements with centralized SOC access |
What is US Executive Order 14028 - Improving the Nation's Cybersecurity and who does it apply to?
US Executive Order 14028 - Improving the Nation's Cybersecurity is a compliance framework from United States (Federal executive branch) with 6 domains and 37 controls. Executive Order 14028 of 12 May 2021, the US Federal cybersecurity order: service providers collect, preserve and share incident data and report incidents to agencies and CISA; agencies plan cloud adoption and Zero Trust Architecture, adopt multi-factor authentication and encryption, deploy EDR, give CISA CDM data, follow a standard incident response playbook and meet logging requirements with log integrity; and software sold to agencies is developed under ten secure development practices with an SBOM, vulnerability disclosure and attestation. In force and unamended; EO 14144, as amended by EO 14306, builds on it. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does US Executive Order 14028 - Improving the Nation's Cybersecurity actually require?
US Executive Order 14028 - Improving the Nation's Cybersecurity has 37 controls organised across 6 domains. The largest domains are Sec. 4 Enhancing software supply chain security – US Executive Order 14028 - Improving the Nation's Cybersecurity (15 controls), Sec. 3 Modernizing Federal Government cybersecurity – US Executive Order 14028 - Improving the Nation's Cybersecurity (8 controls), Sec. 2 Removing barriers to sharing threat information – US Executive Order 14028 - Improving the Nation's Cybersecurity (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of US Executive Order 14028 - Improving the Nation's Cybersecurity do I already cover?
US Executive Order 14028 - Improving the Nation's Cybersecurity does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement US Executive Order 14028 - Improving the Nation's Cybersecurity?
Start your US Executive Order 14028 - Improving the Nation's Cybersecurity compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about US Executive Order 14028 - Improving the Nation's Cybersecurity requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required