Executive Order 14144 on cybersecurity signed, with new AI security provisions

What it is

Executive Order 14144, titled Strengthening and Promoting Innovation in the Nation's Cybersecurity, directs federal agencies to tighten software supply chain security and apply artificial intelligence to cyber defense work.

On January 16, 2025, President Biden issued Executive Order 14144, days before the end of his term.

The order builds on the foundational steps directed in Executive Order 14028 of May 12, 2021, on improving the nation's cybersecurity.

What it requires

The order requires software providers selling to the federal government to submit machine-readable attestations and supporting artifacts.

It also instructs agencies to transition to quantum-resistant cryptography standards by the year 2030.

On artificial intelligence, the order calls for the establishment of public-private pilot programs to use advanced AI models for cyber defense, and urges the federal government to share data with the academic community to support research into the use of AI in cyber defense.

The order's policy section singles out cyber campaigns tied to the People's Republic of China as the most active and persistent cyber threat facing government, private-sector and critical infrastructure networks.

What security leaders should do

Security leaders at companies selling software to federal agencies should review whether their secure development attestations and supporting artifacts can be produced in the machine-readable format the order anticipates. CISOs working with research institutions or critical-infrastructure operators should watch for the public-private AI pilot programs the order calls for, since early participation could shape how AI tools get vetted for cyber defense use before requirements solidify. Teams running long-lived systems should begin inventorying cryptographic dependencies now, given the quantum-resistant cryptography timeline the order sets for federal agencies. Because EO 14144 was issued at the end of an administration, security leaders should also track whether successor orders keep, narrow, or remove its AI and supply-chain provisions before anchoring long-term compliance programs to it.