ExecutiveOrdersEO
EO 13800Executive OrderTrump 45 · R Quiet signal

Executive Order 13800

Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

This executive order mandates federal agencies to adopt the NIST Cybersecurity Framework and modernize IT infrastructure, while directing multiple cabinet departments to assess and report on cybersecurity risks to critical infrastructure, deterrence strategies, international cooperation, and workforce development. It establishes accountability for agency heads in managing cybersecurity risk and requires extensive reports on federal IT modernization, botnet resilience, electricity grid vulnerabilities, and defense industrial base risks.

Federal Register Open PDF 82 FR 22391

Impact dates

  1. Annual updated critical infrastructure reports (recurring)

  2. Commerce/DHS botnet resilience final report to President

  3. Commerce/DHS botnet resilience preliminary report (public)

  4. DHS critical infrastructure support report to President

  5. OMB determination and plan due to President (60 days after agency reports received)

  6. DOD/DNI National Security Systems implementation report

  7. Defense national security cyber capabilities assessment

  8. State Department international engagement strategy (90 days after priority reports)

  9. Commerce/DHS workforce development report

  10. Agency risk management reports due to DHS and OMB

  11. Federal IT modernization report due to President

  12. DHS/Commerce critical infrastructure transparency report

  13. Energy/DHS electricity disruption assessment

  14. Defense/DHS/FBI defense industrial base cybersecurity report

  15. Interagency deterrence and protection report

  16. DNI foreign workforce development review

  17. International cybersecurity priority reports

Key directives

  • Agency heads shall use NIST Cybersecurity Framework effective immediately
  • Agency heads shall provide risk management report to DHS and OMB within 90 days
  • OMB Director shall submit determination and plan to President within 60 days of receiving agency reports
  • American Technology Council shall coordinate federal IT modernization report within 90 days
  • Secretary of Defense and DNI shall provide implementation report for National Security Systems within 150 days
  • DHS Secretary shall provide critical infrastructure support report within 180 days, with annual updates thereafter
  • DHS and Commerce Secretaries shall provide critical infrastructure transparency report within 90 days
  • Commerce and DHS Secretaries shall make botnet resilience preliminary report publicly available within 240 days and final report within 1 year
  • Energy and DHS Secretaries shall provide electricity disruption assessment within 90 days
  • Defense, DHS, and FBI shall provide defense industrial base cybersecurity report within 90 days
  • State, Treasury, Defense, AG, Commerce, DHS, and USTR shall submit deterrence report within 90 days
  • State, Treasury, Defense, Commerce, and DHS shall submit international priority reports within 45 days; State shall provide engagement strategy within 90 days of those submissions

Who is ordered

Timeline

Immediate

  • Agency heads must use NIST Framework for cybersecurity risk management
  • Policy established to prefer shared IT services in procurement
  • Agency heads held accountable for cybersecurity risk

Near term (90d)

  • Agency risk management reports due to DHS and OMB
  • Federal IT modernization report due
  • Critical infrastructure transparency report due
  • Electricity disruption assessment due
  • Defense industrial base cybersecurity report due
  • Deterrence and protection strategic options report due
  • International cybersecurity priority reports due
  • Secretary of State engagement strategy for international cooperation due

Long term

  • Annual updated reports on critical infrastructure support
  • Botnet resilience preliminary report due at 240 days
  • Botnet resilience final report due at 1 year
  • Workforce development recommendations due at 120 days
  • National security cyber capabilities assessment due at 150 days

Risks & tensions

  • Classification provisions may limit public accountability for implementation
  • Preference for shared IT services and cloud migration creates centralized targets
  • DOD/DNI exemption for National Security Systems may create inconsistent security postures across government
  • Vague 'to the extent permitted by law' qualifiers may weaken procurement mandates
  • Heavy reporting burden (17+ distinct reports) may strain agency capacity for actual risk mitigation
  • No explicit enforcement mechanism beyond presidential accountability for agency heads
Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure · Executive Orders