On June 6, 2025, President Trump issued a new executive order, “Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144” (EO), signaling the construction of a fortified cyber defense across federal operations. This directive updates the nation’s digital stronghold, modernizing risk management, defending against quantum and artificial intelligence (AI) threats, and drawing sharper lines in the battle against foreign cyber adversaries. For technology companies and federal suppliers, this is a clarion call to reinforce their digital walls and sharpen their defenses. Agencies will soon build these secure-by-design principles into every contract and procurement decision. In this era of fortress-building, failing to meet these standards not only will leave your gates unguarded but also could bar you from the entire federal marketplace. The EO may read like ordinary policy, but don’t be misled: It’s a direct command for companies to strengthen their cyber defenses or be locked out of federal opportunities altogether.
Fortifying the Code: What Software Developers Must Know
At its core, the EO sets strict deadlines and requirements that reshape the playing field for software developers, federal contractors, and any business handling sensitive federal data. By August 1, 2025, the National Institute of Standards and Technology (NIST) will launch a public-private consortium to produce new secure software development guidance. By December 1, 2025, agencies are expected to receive a preliminary update to NIST’s Secure Software Development Framework (SP 800-218), with a final version to follow within four months. If your software development practices are not already secure by design, consider yourself on borrowed time.
Quantum-Ready Shields: Encryption and Quantum Computing Demands
The second major point of the EO addresses the looming challenge of quantum computing. For those unfamiliar with the term, quantum computing uses the unique properties of quantum mechanics to process information in ways that classical computers can’t. The technology can solve certain types of issues and problems much faster than traditional systems can, posing a serious risk to today’s encryption-based security. As quantum computers advance, businesses and governments will need to shift to post-quantum cryptography (PQC) to keep sensitive data safe, and this EO marks the beginning of that transition.
By December 1, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) will identify PQC products that are viable today. Businesses that sell or operate cryptographic services within federal systems, such as virtual private networks, data protection tools, or encryption modules, should begin evaluating their PQC readiness now.
Additionally, by January 2, 2030, federal systems must support Transport Layer Security (TLS) protocol 1.3. TLS 1.3 is the latest version of the protocol that encrypts data as it travels between computers—for example, when using a website or sending an email. Beyond reducing the number of steps needed to establish a secure connection, which speeds up connections and helps protect against eavesdropping and certain cyberattacks, TLS 1.3 incorporates modern cryptographic protections against quantum and other threats. Accordingly, the EO’s demand for agencies to support TLS 1.3 or successor protocols isn’t just a technical update; it’s a security mandate with real legal and operational implications for federal contractors and commercial vendors.
For companies working with the federal government, this push for TLS 1.3 is also closely linked to Federal Information Processing Standard (FIPS) 140-3. As many know or have encountered, FIPS 140-3 is the US government’s standard for cryptographic modules, ensuring they’re robust enough to protect sensitive data. Under federal rules, when agencies implement TLS 1.3, they must use FIPS 140-3–validated cryptographic modules, meaning that software’s encryption libraries must be certified by NIST to meet federal security standards.
Put simply, the EO’s new deadline means that if systems or products handle federal data or integrate with federal networks, companies will need to ensure that their TLS 1.3 implementation is also FIPS 140-3–compliant. This is not just an IT task; it will be a contract compliance issue and a risk management must-have for federal business.
AI in the Watchtower: AI Security
The EO also places AI at center stage, directly integrating it into the government’s cybersecurity strategy. The EO requires federal agencies to integrate AI vulnerability management and compromise response in their incident response playbooks. It also directs the opening of cybersecurity datasets for research purposes by November 1, 2025. This highlights that AI-enabled software and services are likely to face greater scrutiny, and federal contracts will almost certainly start demanding AI-specific security assurances. This represents both a risk and an opportunity, as future contract opportunities or regulatory expectations may include explicit AI security provisions, a trend the industry should watch closely.
These requirements send a clear message about the future of AI: It’s no longer a fun add-on that’s nice to have; it’s now a frontline security concern. Vendors supplying AI-enabled products or services to the federal government should be prepared to do all of the following:
- Provide transparent reporting of AI-related vulnerabilities, along with protocols for mitigation and notification.
- Demonstrate how AI systems incorporate runtime monitoring and incident logging.
- Show how models and datasets are protected against tampering, poisoning, or extraction.
- Collaborate with academic or government researchers using shared cybersecurity datasets.
Ultimately, this is both a legal demand and a market differentiator. AI-focused cybersecurity assurances are more than likely to become indispensable in federal solicitations. If businesses can move early to build demonstrable AI defense capabilities, they are likely to gain a competitive edge. Conversely, those that ignore this shift risk facing contract challenges, increased liability, or exclusion from future federal AI-related cyber initiatives.
A New Battle Plan: The ‘Rules as Code’ Paradigm
The EO also modernizes policy implementation through a new pilot addressing “rules as code,” which the EO requires to be implemented within one year. “Rules as code” is a modern approach that translates regulatory requirements, traditionally expressed as dense legal text, into machine-readable, executable code from the very beginning. Rather than having agencies or companies interpret these rules later, this approach ensures that the rules themselves are clear, precise, and automatically enforceable by computer systems.
For federal contractors and commercial businesses, this signals a significant shift: Compliance will transition from subjective interpretation to real-time, automated verification. If selling software, providing AI-enabled services, or handling sensitive data for federal agencies, expect these “machine-readable rules” to become an integral part of how compliance is assessed. For example, if a cybersecurity rule says “patch critical vulnerabilities within 15 days,” a “rules as code” framework might directly link that rule to automated vulnerability scans and patch deployment logs. Instead of an agency asking for a narrative report or PDF checklist, your systems, as well as theirs, will be able to confirm compliance instantly.
As reflected throughout the EO’s precise, technical, and evolving requirements, this new paradigm is exactly the sort of environment where “rules as code” can be most impactful. Instead of relying on periodic audits or paperwork exercises, compliance will be continually monitored, verified, and enforced through the use of automated tools and machine-readable rules. There will not be a clear way to provide additional details or explanation if you aren’t meeting the requirements in the precise manner envisioned.
Guarding the Gates: IoT Compliance
The EO also targets Internet of Things (IoT) vendors and contractors, highlighting a need for such providers to be prepared for sweeping changes. It is building on the IoT Cybersecurity Improvement Act of 2020 (Public Law 116-207), which already requires federal agencies to purchase only those IoT devices that meet security standards developed by NIST, specifically NIST SP 800-213. Yet, despite this clear mandate, actual compliance has been inconsistent across agencies. A December 2024 Government Accountability Office report found that many agencies have still not completed basic tasks, such as creating accurate IoT device inventories or establishing processes to handle compliance waivers. This patchy progress underscores a growing urgency for vendors to get ahead of federal expectations.
The new EO raises the stakes even further. It sets January 4, 2027, as the date by which all IoT devices sold to the federal government must display the US Cyber Trust Mark. This new mark is more than just a sticker. It is a clear, standardized signal that a device meets rigorous federal security standards. Rather than replacing NIST SP 800-213, this new label reinforces those guidelines and turns them into a concrete, verifiable procurement requirement. Going forward, federal buyers and the private sector will be able to use the Cyber Trust Mark as a straightforward way to ensure that the products they buy are safe and secure. If a device does not carry this mark, it will be excluded from the federal procurement process entirely.
Moreover, what sets the Cyber Trust Mark program apart is that it does not stop at device testing. It requires a comprehensive, whole-of-supply-chain approach. Vendors must demonstrate that their products are secure by design, with clear documentation of security measures and robust processes to identify and remediate vulnerabilities. Earning the Cyber Trust Mark early may provide companies and their products with a powerful competitive advantage, not just in federal procurement but also in commercial markets that value trusted security. For those that delay, the risk is not just exclusion from a key federal customer base but also the loss of future revenue.
Enemies at the Gate: Cyber Sanctions and Foreign Persons
Finally, the EO tightens the cyber sanctions regime by explicitly limiting it to “foreign persons,” refining the broad reach established under past executive orders. The cyber sanctions regime, originally outlined in Executive Order 13694 (April 1, 2015), empowers the US government to impose financial and economic penalties (like freezing assets or blocking transactions) on individuals and entities engaged in significant malicious cyber-enabled activities. This tool is designed to deter and punish cyber threats that compromise critical infrastructure, steal sensitive data, or undermine national security. The new EO also updates Executive Order 13757 (December 28, 2016), which expanded these sanctions to cover election-related interference. By narrowing the scope to foreign actors only, the EO clarifies that domestic activities, while still subject to other US laws, are outside the reach of these specific cyber sanctions.
However, this clarity raises the stakes for US businesses with overseas partners or global supply chains. Any connection to a foreign entity engaged in malicious cyber activity—whether that’s a third-party vendor providing compromised software, a foreign manufacturer introducing vulnerabilities into hardware, or even a customer using your products for cyber intrusions—could trigger serious legal and financial penalties. These range from frozen assets and blocked financial transactions to being completely cut off from the US market, with ripple effects for federal contracts and private-sector deals alike.
For contractors and commercial vendors, this means that due diligence on international partners is no longer optional. Businesses need to vet the cybersecurity posture of their overseas suppliers, ensure that they’re not indirectly tied to entities on sanctions lists, and build out supply chain monitoring capabilities to spot red flags. Even well-meaning partnerships can introduce unexpected exposure. For example, if a foreign software vendor is later linked to state-sponsored cyber espionage, any US business using that vendor’s services could face penalties or procurement exclusion. Similarly, companies that source IoT components or firmware from overseas suppliers must ensure those parts meet federal cybersecurity standards and aren’t compromised by hidden backdoors or unpatched vulnerabilities.
Ultimately, the EO signals that federal enforcement will draw sharper lines between domestic and foreign cyber accountability. US companies with global footprints must actively manage these relationships and strengthen their supply chain security, as a single weak link can trigger cascading sanctions risks and jeopardize their standing in federal markets.
Marching Orders: Key Compliance Deadlines
With these dates in mind, the next step is action:
- Conduct a Cybersecurity Compliance Assessment (Now–Q3 2025)
- Understand all deadlines and mandates in the EO: secure software updates by December 1, 2025; Achieve PQC readiness, AI vulnerability integration, and IoT Cyber Trust Mark labeling by January 4, 2027.
- Map how these requirements affect your operations, including software, hardware, and services.
- Assess your current cybersecurity posture: Confirm whether you’re using secure patching practices, whether your cryptography is FIPS 140-3 validated, and whether your AI security measures are in place.
- Identify and document any compliance gaps or areas of risk in your current practices.
- Evaluate how and where these new federal cybersecurity demands apply to your business, contracts, and technology stack.
- Update Contracts, Policies, and Technical Controls (Q3 2025–Q1 2026)
- Review and update contracts to reflect the new federal cybersecurity demands.
- Develop or update AI-specific security policies and integrate them into your incident response plans to ensure effective protection.
- Begin planning for PQC solutions if you handle federal or sensitive data.
- Start aligning IoT products with the Cyber Trust Mark labeling requirements.
- Incorporate Machine-Readable Compliance (“Rules as Code” Readiness, Q4 2025–Q2 2026)
- Identify tools or vendors to translate federal cybersecurity rules into machine-readable code.
- Integrate these rules directly into your development life cycle, patch management, and other critical workflows to ensure seamless integration.
- Set up real-time compliance dashboards to verify continuous adherence to federal cybersecurity mandates.
- Strengthen Partnerships and Supply Chain Security (Ongoing)
- Engage in federal public-private pilot programs and academic collaborations to stay ahead of evolving threats and best practices.
- Rigorously vet your supply chain and third-party partners to ensure they are ready for secure software practices, PQC, and Cyber Trust Mark labeling.
- Consider third-party security attestations, such as SOC 2 or FedRAMP, to strengthen your compliance posture.
- Monitor, Adapt, and Educate (Ongoing and Continuous)
- Track updates from agencies like NIST, CISA, and the OMB to ensure you’re responding to new standards and guidance.
- Provide ongoing security training for your teams to maintain readiness and awareness, ensuring they remain informed and prepared.
- Be prepared to demonstrate how your AI systems and broader operations protect against evolving threats and misuse.
The Final Line of Defense
For industry, the June 6, 2025 EO sounds the alarm: cybersecurity is no longer just an IT concern; it is a fortified line of defense and a strategic stronghold demanding immediate action. Businesses must reinforce their cyber walls by updating contracts, fortifying data protection protocols, and conducting thorough inspections of their vendor battlements to ensure they meet new federal standards like NIST SP 800-218 and PQC. The EO’s renewed focus on global supply chain threats and targeted foreign sanctions highlights the need to shore up defenses and scrutinize every gate and portcullis connected to international partners. Above all, this EO signals a shift from periodic compliance drills to a continuous, real-time defense posture. Those that hesitate to build their fortress will find vulnerabilities quickly exploited, while those that move decisively will hold the high ground in federal markets and beyond. In this new world, cybersecurity isn’t just a box to check; it’s the key to the kingdom. For those that delay, the future holds no mercy. Quantum threats, AI vulnerabilities, supply chain gaps—these aren’t distant siege engines anymore. They’re here. And with this EO, so is federal enforcement.
[View source.]
