--- title: 'Biden’s Executive Order on Cybersecurity Highlights Zero Trust, Software Security' url: 'https://blog.datum-consulting.com/blog/cybersecurity-exec-order' markdown: 'https://blog.datum-consulting.com/blog/cybersecurity-exec-order.md' date: '2021-05-17' description: 'By Phil Goldstein at FedTech On the evening of May 12, President Joe Biden signed a much anticipated executive order on cybersecurity, a signal that federal agencies need to rapidly ramp up their IT security efforts across a wide range of concerns. The order comes in the wake of several headline-gr…' taxonomy: category: - blog tag: - cybersecurity - 'multi-factor authentication' - ransomware month: - May archives_month: - may_2021 archives_year: - '2021' --- # Biden’s Executive Order on Cybersecurity Highlights Zero Trust, Software Security [ Home ](https://blog.datum-consulting.com/) Biden’s Executive Order on Cybersecurity Highlights Zero Trust, Software Security ## [Biden’s Executive Order on Cybersecurity Highlights Zero Trust, Software Security](https://blog.datum-consulting.com/blog/cybersecurity-exec-order) 17th May 2021 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [multi-factor authentication](https://blog.datum-consulting.com/tag:multi-factor%20authentication#body-wrapper) [ransomware](https://blog.datum-consulting.com/tag:ransomware#body-wrapper) *By [Phil Goldstein](https://fedtechmagazine.com/author/phil-goldstein) at FedTech* On the evening of May 12, President Joe Biden signed a much anticipated [executive order on cybersecurity](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/), a signal that federal agencies need to rapidly ramp up their IT security efforts across a wide range of concerns. The order [comes in the wake](https://www.washingtonpost.com/national-security/biden-executive-order-cybersecurity/2021/05/12/9269e932-acd5-11eb-acd3-24b44a57093a_story.html) of several headline-grabbing cyberattacks that have affected government agencies, [including the so-called SolarWinds breach](https://fedtechmagazine.com/article/2021/03/cybersecurity-officials-call-network-visibility-software-assurance-after-russian-hack), which the Biden administration has attributed to Russian state-sponsored actors. As part of the order, in direct response to that attack, IT providers entering into contracts with agencies must promptly report to agencies “when they discover a cyber incident involving a software product or service provided to such agencies or involving a support system for a software product or service provided to such agencies.” “Incremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes and significant investments in order to defend the vital institutions that underpin the American way of life,” Biden says in the order. “The Federal Government must bring to bear the full scope of its authorities and resources to protect and secure its computer systems, whether they are cloud-based, on-premises, or hybrid,” he says. “The scope of protection and security must include systems that process data (information technology (IT)) and those that run the vital machinery that ensures our safety (operational technology (OT)).” The executive order outlines several steps that agencies and contractors will need to take in the next few months: - Within 60 days, agency heads need to “update existing agency plans to prioritize resources for the adoption and use of cloud technology” and develop a plan to [implement zero-trust architecture](https://fedtechmagazine.com/article/2020/11/what-does-it-mean-start-deploying-zero-trust). - Within six months, the National Institute of Standards and Technology is required to publish guidelines on software security for software sold to federal agencies. Those guidelines are required include “criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices.” - Also within six months, agencies must adopt [multi-factor authentication](activate-two-factor-authentication) and encryption for data at rest and in transit, “to the maximum extent consistent with Federal records laws and other applicable laws.” The order also creates a new Cyber Safety Review Board to review significant cyber incidents, akin to the National Transportation Safety Board’s role following major transportation accidents. Speaking at an event May 13 at George Washington University, Brandon Wales, the acting director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, said that “There is far more focus in the current White House in terms of getting positive outcomes out of this executive order ... there is a lot more diligence in terms of follow-up.” Wales also acknowledged that the executive order is “ambitious, but it’s ambitious because what we have seen is we don’t have the time to continue to wait.” [ Previous Post](https://blog.datum-consulting.com/blog/teams-approval-features) [Next Post ](https://blog.datum-consulting.com/blog/texas-signs-cybersecurity-compliance-law) #### Related Posts - 100 [How to Keep Your Company Safe from Russian Hacks](https://blog.datum-consulting.com/blog/russian-hacks-safety "How to Keep Your Company Safe from Russian Hacks") - 100 [Backup Is Feeble Protection Against Ransomware](https://blog.datum-consulting.com/blog/backup-is-feeble-protection-against-ransomware "Backup Is Feeble Protection Against Ransomware") - 100 [Justice Department Adds Fellowship Program to Boost Legal Efforts Against Cybercrime](https://blog.datum-consulting.com/blog/doj-fellowship-program "Justice Department Adds Fellowship Program to Boost Legal Efforts Against Cybercrime") - 100 [Texas Gov. Abbott Signs Cybersecurity Compliance Law After Colonial Pipeline Hack](https://blog.datum-consulting.com/blog/texas-signs-cybersecurity-compliance-law "Texas Gov. Abbott Signs Cybersecurity Compliance Law After Colonial Pipeline Hack") - 100 [October is Cybersecurity Awareness Month](https://blog.datum-consulting.com/blog/cybersecurity-awareness-month "October is Cybersecurity Awareness Month") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [Texas Gov. Abbott Signs Cybersecurity Compliance Law After Colonial Pipeline Hack](https://blog.datum-consulting.com/blog/texas-signs-cybersecurity-compliance-law.md) - Next: [Streamline Requests With New Approval Features in Microsoft Teams](https://blog.datum-consulting.com/blog/teams-approval-features.md)