EO 14028

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-01-23 OMB memo M-26-05 rescinded the government-wide secure software attestation policy (M-22-18 and M-23-16)
2. 2025-06-06 Executive Order 14306 amended Executive Order 14144, the follow-on cybersecurity order
3. 2025-01-16 Executive Order 14144 ordered further cybersecurity actions, building on Executive Order 14028
4. 2021-05-12 Executive Order 14028 signed

1. 2021-05-12
   Executive Order 14028 (86 FR 26633) Major versionCurrent

   Ordered federal action on threat information sharing, zero trust and secure cloud, software supply chain security, a Cyber Safety Review Board, a standard incident playbook, endpoint detection and logging. source

   More

   • Section 4 called for NIST guidance on secure software development, including providing an SBOM and attesting to secure development practices.
   • It asked the FAR Council to amend the FAR so software suppliers comply with, and attest to, those requirements.
   • It set the policy that ICT service providers contracting with agencies must promptly report cyber incidents involving their products or services.

Binds federal agencies directly and reaches private suppliers through the contract terms and acquisition rules written to implement it.

Federal agencies

Federal Civilian Executive Branch agencies must, among other things, advance toward zero trust architecture, move to secure cloud services and deploy endpoint detection and response. source

Service providers

IT and OT service providers, including cloud providers, are to share threat and incident information and collect and keep logs, under contract terms the order asked to be updated. source

Software suppliers

Suppliers of software sold to agencies were to comply with and attest to secure development requirements through FAR amendments; non-compliant products were to be removed from contract vehicles. source

Software attestation now

OMB rescinded M-22-18 and M-23-16 in January 2026; agencies may still use the Secure Software Development Attestation Form or require an SBOM on request. source

Later orders

The Federal Register's notes for Executive Order 14028 list Executive Orders 14141 and 14144 under "See"; Executive Order 14306 amends Executive Order 14144. source source

Agencies assure the software and hardware they use through risk-based policies, drawing on the guidance developed under the order.

Agency assurance

Each agency head is responsible for assuring the security of software and hardware on the agency's network and should validate providers based on a risk assessment. source

Inventory

Agencies must keep a complete inventory of software and hardware and set assurance policies that match their risk determinations. source

Reference practices

Agencies can draw on NIST SP 800-218 (SSDF), CISA's SBOM minimum elements and CISA's hardware bill of materials framework. source

The order creates no rights enforceable at law; obligations reach companies only through the contracts and regulations that implement it.

No private rights

The order does not create any right or benefit enforceable at law or in equity by any party against the United States or any other person. source

Contract vehicles

After a FAR amendment, agencies were to remove software products that do not meet its requirements from IDIQ contracts, Federal Supply Schedules, Government-wide Acquisition Contracts, Blanket Purchase Agreements and Multiple Award Contracts. source

1. Law text Executive Order 14028 – Improving the Nation's Cybersecurity
2. Law text Executive Order 14144 – Strengthening and Promoting Innovation in the Nation's Cybersecurity
3. Law text Executive Order 14306 – Sustaining Select Efforts to Strengthen the Nation's Cybersecurity
4. Guidance OMB M-26-05 – Adopting a Risk-based Approach to Software and Hardware Security

1. NIST SSDF

   NIST SP 800-218 (SSDF) is the secure development practice set; Executive Order 14028 is the order that called for such guidance and for supplier attestation.

2. CISA SSDAF

   The CISA Secure Software Development Attestation Form is the supplier form built under the order's implementing memos; the order itself sets policy for agencies.

3. NIST SP 800-207

   NIST SP 800-207 describes zero trust architecture; Executive Order 14028 directed agencies to advance toward it.

4. FAR 52.204-21

   FAR 52.204-21 sets basic safeguarding for contractor systems; Executive Order 14028 directed new FAR terms on incident reporting and software security.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to EO 14028 (RSS)