Key Updates from the 13694 and 14144 Executive Orders

Quick answer: On June 6, 2025, President Trump signed an executive order (EO 14306) amending Executive Orders 13694 and 14144, streamlining Biden-era cybersecurity requirements while preserving core priorities in secure software development, post-quantum cryptography, and AI-driven cyber defense. It matters because it sets concrete federal deadlines, including PQC product category tracking by December 2025 and TLS 1.3 support by January 2030, though these were later superseded by the much stricter deadlines in June 2026’s Executive Order 14409. The recommended action is to track both orders together, since EO 14409 now sets the binding PQC migration deadlines (2030 for key establishment, 2031 for signatures) that supersede the softer 2030 TLS target in the 2025 order.

Key Takeaways

• The June 2025 order (EO 14306) removed prescriptive elements from Biden’s EO 14144, including the digital identity verification provisions and federal contractor software attestation requirements.
• EO 13694 sanctions authority was narrowed to apply only to “foreign persons,” removing broader applicability to any person.
• A year later, Executive Order 14409 (June 22, 2026) set much harder PQC deadlines: key establishment migration by December 31, 2030, and digital signatures by December 31, 2031, for high-value and high-impact federal systems.
• National Security Systems and systems with debilitating-impact classification are exempted from certain provisions in both orders to prioritize resources appropriately.
• The consumer IoT Cyber Trust Mark procurement requirement and the SSDF guidance updates remain on their original 2025-2027 timelines from the June 2025 order.

Overview of the Amendments

In June, 2025, significant amendments were made to Executive Orders 13694 and 14144, reinforcing the United States’ commitment to bolstering national cybersecurity in an evolving threat landscape. These updates reflect a strategic recalibration to address persistent cyber threats from state and non-state actors, with a particular emphasis on advancing secure software practices, quantum readiness, and leveraging artificial intelligence (AI) for defense.

Refined Policy Focus and Threat Prioritization

The amended Executive Order 14144 sharpens its focus by explicitly naming foreign adversaries such as China, Russia, Iran, and North Korea as persistent cybersecurity threats. It underscores the imperative to strengthen defenses around critical digital infrastructure and services to counter disruptive cyber campaigns that impact national security, economic stability, and citizens’ privacy.

Accelerated Secure Software Development and Patch Management

A clear timeline is set for enhancing secure software development practices, anchored by the National Institute of Standards and Technology (NIST). By August 1, 2025, a consortium led by NIST will develop industry-informed guidance on the Secure Software Development Framework (SSDF), followed by an updated release of NIST’s SSDF by the end of the year. Additionally, updated guidance for securely deploying software patches will be issued by September 2, 2025, aiming to mitigate risks from vulnerable or misconfigured software components.

Quantum Computing and Cryptographic Transition

Recognizing the emerging threat posed by quantum computing to existing encryption methods, the Executive Order directs agencies to take tangible steps towards post-quantum cryptography (PQC) adoption. By December 1, 2025, a comprehensive list of product categories with PQC support will be published and regularly updated. Furthermore, federal agencies must support Transport Layer Security (TLS) version 1.3 or its successor by January 2, 2030, facilitating a secure migration path away from cryptographic algorithms vulnerable to quantum attacks.

A year later, this baseline was superseded by a much harder deadline. On June 22, 2026, the White House signed Executive Order 14409, Securing the Nation Against Advanced Cryptographic Attacks, requiring agencies to migrate all high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum digital signatures by December 31, 2031, four to five years earlier than the 2035 target set by the 2022 National Security Memorandum 10. Each agency must name a PQC migration lead within 30 days of the order, and OMB must issue guidance within 90 days requiring agencies to review their cryptographic inventories and submit migration plans. A proposed FAR rule would extend the same December 31, 2030, deadline to federal contractors.

Harnessing Artificial Intelligence for Cyber Defense

The Order also positions AI as a critical force multiplier in cybersecurity operations. By November 1, 2025, multiple federal agencies are tasked with expanding access to cyber defense datasets for academic research, while also integrating AI vulnerability management into their existing cyber incident response frameworks. This aims to enhance threat detection capabilities and automate defense mechanisms at scale.

Strengthening Policy Implementation and Vendor Accountability

Further amendments address alignment of policy with operational practice. Within three years, the Office of Management and Budget (OMB) will provide updated guidance to modernize federal information system security architectures. Pilots will launch within one year for machine-readable “rules-as-code” to streamline policy compliance. Additionally, new procurement requirements will mandate consumer Internet-of-Things (IoT) devices sold to the federal government to carry the United States Cyber Trust Mark by January 4, 2027, elevating security standards across federal supply chains.

Continued Refinement of Cybersecurity Frameworks

The amendments also streamline existing Executive Order provisions, removing redundancies and updating language to better reflect current cybersecurity challenges and federal responsibilities. Importantly, National Security Systems (NSS) and systems identified as having debilitating impact are explicitly exempted from certain provisions to ensure appropriate prioritization of resources.

What This Means for the Cybersecurity Landscape

These Executive Order amendments highlight a strategic, multi-pronged approach to national cybersecurity, emphasizing proactive risk management, secure software development, quantum readiness, AI integration, and enhanced vendor accountability. The government is signaling a clear intent to modernize defense posture while promoting collaboration across agencies, industry, and academia.

How Encryption Consulting Can Support Your Quantum and Cybersecurity Journey

Encryption Consulting is ready to assist organizations navigating these evolving federal cybersecurity directives. Our Post-Quantum Cryptography (PQC) Advisory Services provide expert guidance on assessing quantum risks, developing transition roadmaps, and implementing quantum-resistant cryptographic solutions aligned with NIST and federal standards. We help you stay ahead of regulatory requirements, secure cryptographic infrastructure, and build resilience against emerging cyber threats.

Read More: https://www.whitehouse.gov/presidential-actions/2025/06/sustaining-select-efforts-to-strengthen-the-nations-cybersecurity-and-amending-executive-order-13694-and-executive-order-14144/

Frequently Asked Questions

What did the June 2025 executive order actually change?

It removed prescriptive elements from Biden’s EO 14144, including digital identity verification measures and federal contractor software attestation requirements, while narrowing EO 13694 sanctions authority to apply only to foreign persons. It preserved core priorities in secure software development, post-quantum cryptography, and AI-driven cyber defense.

Does this order still set the binding PQC deadlines for federal agencies?

No. Its TLS 1.3 support deadline of January 2, 2030, has been superseded by Executive Order 14409 (June 22, 2026), which sets harder, more specific deadlines: post-quantum key establishment by December 31, 2030, and post-quantum digital signatures by December 31, 2031, for high-value and high-impact systems.

Are National Security Systems covered by these executive orders?

No. National Security Systems and systems identified as having debilitating impact are explicitly exempted from certain provisions in both the June 2025 order and Executive Order 14409, so that resources can be prioritized appropriately.

What is the Cyber Trust Mark requirement, and when does it take effect?

Consumer Internet-of-Things devices sold to the federal government must carry the United States Cyber Trust Mark by January 4, 2027, under new procurement requirements established by the June 2025 order.

What role does AI play under these executive orders?

The June 2025 order positions AI as a force multiplier for cyber defense, tasking federal agencies with expanding access to cyber defense datasets for academic research and integrating AI vulnerability management into existing incident response frameworks by November 1, 2025.

Which order should organizations follow for post-quantum migration planning?

Executive Order 14409 is now the authoritative source for federal PQC deadlines, since it was issued a year after the June 2025 amendments and sets specific, binding dates: December 31, 2030, for key establishment and December 31, 2031, for digital signatures, both well ahead of the earlier 2035 target.