The US cyber executive order, for vendors
Biden’s order on cybersecurity sets new rules for software sold to the US government. Expect them to spread.
On 12 May President Biden signed an executive order on improving US cybersecurity. Much of it is about federal agencies, but some parts will reach any company that sells software or services to government, and later probably everyone else.
The pieces worth knowing:
- MFA and encryption for federal systems within months.
- Zero trust as the target architecture.
- Software supply chain rules, including a software bill of materials (SBOM) listing what’s inside a product.
- Incident reporting obligations for IT service providers to government.
- A Cyber Safety Review Board to study major incidents, like air crash investigations.
If you sell software, start now: know your dependencies, be able to produce an SBOM, secure your build pipeline, and have MFA everywhere. Big customers will ask, government or not.