Improving the Nation's Cybersecurity

May 12, 2021

Issued in response to the SolarWinds supply chain attack and other major cyber incidents, Executive Order 14028 mandated federal agencies adopt zero-trust security architectures, established software supply chain security requirements including a Software Bill of Materials for vendors selling to the government, created standardized breach notification procedures, and modernized federal cybersecurity standards. The order operated primarily within the executive's authority over federal IT procurement and operations. Constitutional significance was moderate: the order largely directed internal federal operations, but its requirements for government contractors and software vendors effectively set industry-wide security standards, raising questions about whether the executive was creating de facto regulation through procurement power.