Biden Signs Cybersecurity Executive Order: Software Vendors Must Prove Secure Development, China Named Most Persistent Cyber Threat
President Joe Biden signed the executive order "Strengthening and Promoting Innovation in the Nation's Cybersecurity" in Washington on January 16, 2025, four days before leaving office, tightening cybersecurity requirements for the federal government and its software suppliers. The order opens by stating that adversarial countries and criminals continue to conduct cyber campaigns targeting the United States and Americans, with China presenting "the most active and persistent cyber threat" to U.S. Government, private sector, and critical infrastructure networks, disrupting critical services, costing billions of dollars, and undermining Americans' security and privacy.
The order builds on Executive Order 14028 of May 12, 2021, and the National Cybersecurity Strategy, focusing on defending digital infrastructure, securing the services and capabilities most vital to the digital domain, and building the capability to address key threats including those from China. Its central levers are improving accountability for software and cloud service providers, strengthening the security of federal communications and identity management systems, and promoting innovative uses of emerging technologies, including super intelligence (SI), for cyber defense.
For the software supply chain, the order imposes verifiable requirements: within 30 days, the director of the Office of Management and Budget, consulting the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA), must recommend contract language to the Federal Acquisition Regulatory Council requiring software providers to submit to CISA, through its Repository for Software Attestation and Artifacts (RSAA), machine-readable secure software development attestations, high-level artifacts to validate them, and a list of their federal civilian agency customers; validation results may be publicly posted and failed attestations referred to the attorney general.
For the federal government's own defenses, the order directs federal civilian agencies to begin using phishing-resistant commercial standards such as WebAuthn in pilot or larger deployments, and strengthens CISA's capability to hunt for and identify novel cyber threats across the federal civilian enterprise using agency endpoint detection and security operations data. Anne Neuberger, the deputy national security advisor for cyber and emerging technology, told reporters the order's goal was to make it "costlier and harder for China, Russia, Iran and ransomware criminals to hack."
The order came as the U.S. Treasury Department's systems had just been breached, an intrusion the United States later tied to sanctions on a Chinese hacker and a Sichuan network company.
Related: 财政部制裁中国黑客与四川网络公司：涉入侵财政部网络及「盐台风」电信窃密
(Source: The White House)
Source: The White House
Published by GSM · USA (original Chinese edition)
Photo: 图：美国国土安全部总部大楼航拍（圣伊丽莎白园区）。该部的网络安全与基础设施安全局（CISA）是这项行政令的主要执行机构之一。（Michael Hvozda 摄，美国海岸警卫队，公共领域） / Photo: Aerial view of the U.S. Department of Homeland Security headquarters at the St. Elizabeths campus; the department's Cybersecurity and Infrastructure Security Agency (CISA) is a principal implementing agency under the order. (Photo by Michael Hvozda, U.S. Coast Guard, public domain)
