Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
Record date: 2017-05-16
( printed page 22391) Executive Order 13800 of May 11, 2017 Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure By the authority vested in me as President by the Constitution and the laws of the United States of America, and to protect American innovation and values, it is hereby ordered as follows: Section 1 . Cybersecurity of Federal Networks . (a) Policy . The executive branch operates its information technology (IT) on behalf of the American people. Its IT and data should be secured responsibly using all United States
What this record contains
- Federal Register document
- 2017-10004
- Publication date
- 2017-05-16
- Citation
- 82 FR 22391
- Issuing office
- Executive Office of the President
Official record excerpt
( printed page 22391) Executive Order 13800 of May 11, 2017 Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure By the authority vested in me as President by the Constitution and the laws of the United States of America, and to protect American innovation and values, it is hereby ordered as follows: Section 1 . Cybersecurity of Federal Networks . (a) Policy . The executive branch operates its information technology (IT) on behalf of the American people. Its IT and data should be secured responsibly using all United States Government capabilities. The President will hold heads of executive departments and agencies (agency heads) accountable for managing cybersecurity risk to their enterprises. In addition, because risk management decisions made by agency heads can affect the risk to the executive branch as a whole, and to national security, it is also the policy of the United States to manage cybersecurity risk as an executive branch enterprise. (b) Findings . (i) Cybersecurity risk management comprises the full range of activities undertaken to protect IT and data from unauthorized access and other cyber threats, to maintain awareness of cyber threats, to detect anomalies and incidents adversely affecting IT and data, and to mitigate the impact of, respond to, and recover from incidents. Information sharing facilitates and supports all of these activities. (ii) The executive branch has for too long accepted antiquated and difficult-to-defend IT. (iii) Effective risk management involves more than just protecting IT and data currently in place. It also requires planning so that maintenance, improvements, and modernization occur in a coordinated way and with appropriate regularity. (iv) Known but unmitigated vulnerabilities are among the highest cybersecurity risks faced by executive departments and agencies (agencies). Known vulnerabilities include using operating systems or hardware beyond the vendor's support lifecycle, declining to implement a vendor's security patch, or failing to execute security-specific configuration guidance. (v) Effective risk management requires agency heads to lead integrated teams of senior executives with expertise in IT, security, budgeting, acquisition, law, privacy, and human resources. (c) Risk Management . (i) Agency heads will be held accountable by the President for implementing risk management measures commensurate with the risk and magnitude of the harm that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of IT and data. They will also be held accountable by the President for ensuring that cybersecurity risk management processes are aligned with strategic, operational, and budgetary planning processes, in accordance with chapter 35, subchapter II of title 44, United States Code. ( printed page 22392) (ii) Effective immediately, each agency head shall use The Framework for Improving Critical Infrastructure Cybersecurity (the Framework) developed by the National Institute of Standards and Technology, or any successor document, to manage the agency's cybersecurity risk. Each agency head shall provide a risk management report to the Secretary of Homeland Security and the Director of the Office of Management and Budget (OMB) within 90 days of the date of this order. The risk management report shall: (A) document the risk mitigation and acceptance choices made by each agency head as of the date of this order, including: (1) the strategic, operational, and budgetary considerations that informed those choices; and (2) any accepted risk, including from unmitigated vulnerabilities; and (B) describe the agency's action plan to implement the Framework. (iii) The Secretary of Homeland Security and the Director of OMB, consistent with chapter 35, subchapter II of title 44, United States Code, shall jointly assess each agency's risk management report to determine whether the risk mitigation and acceptance choices set forth in the reports are appropriate and sufficient to manage the cybersecurity risk to the executive branch enterprise in the aggregate (the determination). (iv) The Director of OMB, in coordination with the Secretary of Homeland Security, with appropriate support from the Secretary of Commerce and the Administrator of General Services, and within 60 days of receipt of the agency risk management reports outlined in subsection (c)(ii) of this section, shall submit to the President, through the Assistant to the President for Homeland Security and Counterterrorism, the following: (A) the determination; and (B) a plan to: (1) adequately protect the executive branch enterprise, should the determination identify insufficiencies; (2) address
The excerpt is reproduced from the public federal record and may omit later sections, tables, signatures or attachments. Open the official source for the complete text.
Questions for accountability
- What legal authority does this government action cite?
- Which agencies or officials were directed to act?
- What measurable implementation, cost, deadline or later court action followed?
How to use this page
This is a source-record entry, not a truth-rating by itself. It preserves the action, date and original government publication so it can be connected to later claims, implementation records, court decisions, costs and measurable outcomes. Editorial claim reviews on this site use separate finding labels and explain the evidence for those findings.