EO 14028, 14144, 14306 and 14412: the federal cybersecurity deadlines still ahead

Four federal cybersecurity deadlines are still ahead: agencies must require consumer internet-of-things vendors to carry United States Cyber Trust Mark labeling by January 4, 2027; federal systems broadly must support Transport Layer Security (TLS) 1.3 or a successor by January 2, 2030; and a newer, narrower pair of post-quantum cryptography (PQC) dates applies specifically to agencies' highest-value and highest-impact systems — key-establishment cryptography by December 31, 2030, and digital-signature cryptography by December 31, 2031. These trace back through four executive orders issued across five years and three signings: Executive Order 14028 (May 12, 2021), Executive Order 14144 (January 16, 2025), Executive Order 14306 (June 6, 2025), which struck large parts of 14144 just five months after it was signed, and Executive Order 14412 (June 22, 2026), which added the two newer PQC dates.

What did Executive Order 14028 require, and is any of it still binding?

EO 14028, Improving the Nation's Cybersecurity, is the foundational order: it directed the software bill of materials (SBOM) requirement, the push toward Zero Trust Architecture, mandatory multi-factor authentication and encryption for federal data, the Cyber Safety Review Board, a government-wide endpoint detection and response (EDR) initiative, and the first consumer IoT and software labeling pilot that later became the Cyber Trust Mark. Every one of its numbered deadlines fell between 30 and 360 days after May 12, 2021, so all of them are now historical — agencies' systems should already reflect these requirements, and later orders built on top of EO 14028 rather than replacing it.

Neither EO 14144 nor EO 14306 amended EO 14028 directly. EO 14144's own text describes itself as built on the foundational steps of EO 14028, and EO 14306 amends only EO 14144 and the unrelated cyber-sanctions order, EO 13694. That makes EO 14028 the one order in this chain whose text has never been struck or redesignated. EO 14412, signed a year later, is a freestanding order: its text does not amend, cite or otherwise reference EO 14028, 14144 or 14306 at all, and covers a narrower topic — post-quantum cryptography migration — rather than the broader cybersecurity-modernization ground the earlier three share.

What did Executive Order 14144 add in January 2025?

EO 14144, signed four days before the end of the Biden administration, layered on specific, higher-tempo mandates: a CISA repository (RSAA) where software vendors had to submit machine-readable security attestations and artifacts; a CISA program giving it direct, timely access to telemetry from FCEB agencies' own EDR tools and security operations centers; cybersecurity requirements for civil space systems; internet routing security (publishing Route Origin Authorizations against BGP hijacking) and encrypted DNS and email transport for federal systems; a list of product categories required to support post-quantum cryptography, with the TLS 1.3 deadline of January 2, 2030 written into the order from the start; digital-identity anti-fraud technology for public benefits programs; AI-for-cyber-defense research priorities; and — in its Aligning Policy to Practice section — the first explicit deadline for the United States Cyber Trust Mark, by January 4, 2027.

What did Executive Order 14306 strike five months later?

EO 14306, signed June 6, 2025, is a surgical amendment, not a new policy framework. It struck the RSAA software-attestation-submission requirement outright, along with most of EO 14144's CISA-EDR-telemetry-access section (keeping only the renumbered core program), the general cybersecurity-modernization policy preamble, the phishing-resistant-authentication pilot mandate, the internet-routing-security and encrypted-DNS/email-transport provisions, and the entire digital-identity/public-benefits-fraud section. It also replaced the AI-for-cyber-defense section and the Aligning Policy to Practice section with shorter versions, dropping (among other things) NIST's planned minimum-cybersecurity-practices guidance for industry and the Federal Acquisition Regulation rule that would have required federal contractors to follow it.

What it left standing matters as much as what it cut. The CISA EDR-telemetry program, the FedRAMP cloud-security baselines, the civil-space-systems cybersecurity requirements, the OMB Circular A-130 revision, and — critically — both of the dates still ahead of CISOs today, the January 4, 2027 Cyber Trust Mark deadline and the January 2, 2030 TLS 1.3 deadline, survived the amendment untouched. EO 14306 also converted several of EO 14144's relative within-X-days deadlines into fixed 2025 calendar dates (for example, an SSDF consortium by August 1, 2025, and a post-quantum-cryptography product list by December 1, 2025); those fixed dates have themselves now passed, and no public, continuously updated feed from OMB or CISA reports which agencies actually met them, so this page cannot confirm compliance — only that the deadlines existed and fell due.

Separately, EO 14306 amended EO 13694 — the 2015 cyber-sanctions order that lets Treasury block the property of people behind "significant malicious cyber-enabled activities" — narrowing its blocking authority from "any person" to "any foreign person" in two subsections. That is a sanctions-policy change, not a compliance mandate, and it is the only part of this chain that touches an order outside the 14028/14144/14306 line.

What's actually still ahead for a CISO to track?

Six concrete, unstruck, future-dated deadlines, two from the earlier orders and four added by EO 14412:

• January 4, 2027 — federal agencies must require Cyber Trust Mark labeling from vendors of consumer IoT products sold to the government. Any company selling connected devices into federal procurement needs the label in place well before that date, since FAR amendments implementing the requirement take their own time to work through agencies.

• January 2, 2030 — federal systems (non-national-security systems through OMB, National Security Systems through the Secretary of Defense) must support TLS 1.3 or a successor protocol, the next concrete milestone in the government's post-quantum cryptography migration that both EO 14144 and National Security Memorandum 10 (May 4, 2022) set in motion.

• December 19, 2026 — 180 days from EO 14412's signing: NIST must have started a PQC migration pilot on a subset of its own systems, the FAR Council must have published a proposed rule requiring covered contractors to comply with NIST's PQC-related FIPS by December 31, 2030, and NIST must begin revising its Cryptographic Module Validation Program to speed up validations.

• March 19, 2027 — 270 days from EO 14412's signing: CISA and NIST must jointly publish guidance on the minimum elements of a cryptographic bill of materials, and the FAR Council must publish a separate proposed rule folding cryptographic-vulnerability testing into contractor vulnerability-disclosure programs.

• December 31, 2027 — NIST's own PQC migration pilot, launched by the December 19, 2026 deadline above, must be complete.

• December 31, 2030 and December 31, 2031 — agencies' high-value assets and high-impact systems, excluding National Security Systems, must migrate to PQC for key establishment by the first date and for digital signatures by the second; covered federal contractors face the same 2030 date for NIST's PQC-related FIPS once the FAR Council's proposed rule (due December 19, 2026, above) is finalized. This is a narrower population and a different cryptographic scope than the January 2, 2030 TLS 1.3 deadline above — TLS 1.3 covers federal systems broadly, where this pair covers only the government's own highest-value and highest-impact systems, and spans more than one protocol, not just TLS.

Everything else in this chain — the SBOM mandate, Zero Trust, the EDR program, FedRAMP baselines, space-systems cybersecurity, the Cyber Safety Review Board — is either already-elapsed policy agencies should already be executing, or guidance with no further numbered deadline of its own. The CISA EDR-telemetry-access program EO 14144 created and EO 14306 kept is a separate track from the vulnerability-remediation clock this site's KEV guide and /must-patch track: one governs how fast agencies must fix a known-exploited flaw, the other governs how much visibility CISA itself gets into agency endpoints to go hunting for threats nobody has flagged yet.

Two OMB memorandums that implement parts of this same policy chain, issued in May and June 2026, set a denser run of near-term deadlines of their own — covered below.

What does OMB's logging memo, M-26-14, require, and by when?

OMB rescinded its 2021 incident-logging directive and replaced it with a narrower, risk-based one on May 22, 2026. Memorandum M-26-14 rescinds its predecessor, M-21-31, effective immediately. M-21-31 was the SolarWinds-era directive that pushed agencies toward retaining large volumes of log data; M-26-14's own text says some of those requirements turned out to be neither operationally feasible nor cost-effective for most agencies. In its place, agencies must prioritize two objectives: Continuous Event Monitoring (real-time detection of anomalous network activity) and Threat Hunting, Investigation, Response, and Forensics (the logging depth needed to investigate a suspected compromise after the fact). Like the executive orders above, it carves out an exception for the most sensitive systems, exempting national security systems and Defense Department or Intelligence Community systems covered by 44 U.S.C. § 3553(e).

M-26-14 gave the Cybersecurity and Infrastructure Security Agency (CISA) 90 days from the memo to publish a logging reference architecture (LRA) agencies must build their plans around; CISA's own site records that it did, on August 20, 2026. Every subsequent deadline in the memo counts from that LRA publication date, not from the memo itself: agencies must submit an Agency Logging Plan within 90 days of the LRA (November 18, 2026), reach Basic (Level 1) maturity within 120 days (December 18, 2026), Intermediate (Level 2) within 180 days (February 16, 2027), and Advanced (Level 3) within 320 days (July 6, 2027).

What does OMB's post-quantum memo, M-26-15, require, and by when?

M-26-15, issued June 24, 2026, implements a separate executive order signed two days earlier, EO 14412, Securing the Nation Against Advanced Cryptographic Attacks (covered in its own right below), and OMB's own duty under the 2022 Quantum Computing Cybersecurity Preparedness Act to direct agencies to prioritize systems for migration to post-quantum cryptography (PQC). Like M-26-14, it does not apply to national security systems. Agencies must submit a PQC Migration Plan to OMB and the Office of the National Cyber Director no later than 120 days from the memo — October 22, 2026, the nearest-term deadline in this entire guide as of this page's last review — mapping a five-phase migration that runs from 2026 to 2035: strategy, planning and discovery (2026–2027); pilots and early migration (2027–2028); prioritized migration of high-value systems' key-establishment cryptography (2028–2030); digital-signature migration (2031); and full migration (2035). Separately, agencies must work to mitigate as much quantum risk as feasible by December 31, 2030.

M-26-15's own technical appendix restates the TLS 1.3 deadline above rather than setting a competing one, telling agencies to meet it as a step consistent with EO 14306. Read together, the two memos add a near-term planning deadline (the October 2026 PQC plan and the logging-maturity dates through mid-2027) on top of the two longer-range EO deadlines this guide already tracked before this page's 2026-10-18 update, rather than replacing them. M-26-15's own five-phase schedule (key-establishment migration in 2028–2030, digital-signature migration in 2031, full migration by 2035) tracks EO 14412's own statutory deadlines below closely but not exactly: EO 14412 sets December 31, 2030 and December 31, 2031 as hard dates for a narrower population (high-value assets and high-impact systems only), where M-26-15 describes a broader, longer glide path running through 2035 for the full federal system population.

What does Executive Order 14412 require, and how does it change the post-quantum cryptography picture?

EO 14412, signed June 22, 2026, is the fourth order in this chain and the only one focused solely on post-quantum cryptography (PQC). Its policy section cites the risk that an adversary with a large-scale quantum computer could break today's cryptography, including the risk that adversaries are collecting encrypted U.S. data now to decrypt later once such a computer exists. Its stated policy is to transition federal information systems to NIST-approved Federal Information Processing Standards (FIPS) for PQC and to help critical-infrastructure owners and operators do the same.

The order sets a run of deadlines counted from its own June 22, 2026 signing date, most already covered in the still-ahead list above: each agency had 30 days (by July 22, 2026) to name a PQC migration lead who reports to its chief information officer; OMB had 90 days (by September 20, 2026) to issue the guidance that sets the December 31, 2030 and 2031 dates for high-value assets and high-impact systems, explicitly excluding National Security Systems from that particular OMB-issued requirement. National Security Systems are tracked on a separate, recurring track instead: the Director of the National Security Agency, acting as National Manager for National Security Systems, must report their PQC migration status to the President every 180 days starting December 19, 2026, with no single end-date fixed in the order's own text.

The order also reaches outside the federal government directly, through two FAR Council rulemakings due 180 and 270 days after signing: a proposed rule requiring covered contractors to comply with NIST's PQC-related FIPS by the same December 31, 2030 date federal high-value systems face, and a separate proposed rule folding cryptographic-vulnerability testing into contractors' existing vulnerability-disclosure programs. Neither rule exists yet as of this page's review — the order only directs the FAR Council to publish a proposed rule by those dates, not a final one, so there is no binding contractor obligation under EO 14412 today, only a clear signal of one coming.

Does any of this bind private companies, not just federal agencies?

Not directly. These are executive orders directing the executive branch and federal civilian agencies; they are not statutes, and they create no legal right enforceable by a private party. Their reach into the private sector runs through two channels instead: Federal Acquisition Regulation amendments that bind any company selling software, cloud services or connected devices to the federal government, and NIST guidance (the Secure Software Development Framework, SP 800-161 supply-chain risk management, Zero Trust guidance) that functions as a widely cited industry benchmark well beyond companies with federal contracts, the same way NIST's other frameworks do. EO 14412's two queued FAR rulemakings, covered above, are the clearest near-term example of the first channel: once finalized, they would require any covered contractor selling to the government to meet NIST's PQC-related FIPS by December 31, 2030 and to build cryptographic-vulnerability testing into its vulnerability-disclosure program.

How should a CISO use this?

Treat the live dates as planning anchors, not news: a vendor selling connected devices into federal procurement needs Cyber Trust Mark labeling arranged well ahead of January 4, 2027, and any organization that already has a post-quantum cryptography migration plan should check it against the January 2, 2030 TLS 1.3 date and EO 14412's December 31, 2030/2031 dates as government-set reference points, even if the organization itself has no federal contract. A federal agency CISO, or a contractor tracking an agency customer's posture, has nearer dates to watch first: the October 22, 2026 PQC Migration Plan deadline, the logging-maturity dates running from November 2026 through mid-2027, and EO 14412's own December 19, 2026 and March 19, 2027 rulemaking and pilot deadlines. A contractor selling into federal procurement should also watch for the FAR Council's two EO 14412 proposed rules, due by those same dates, since they would be the first binding mechanism translating this order's PQC dates into a contract requirement. For everything dated earlier than today, read it as a description of what federal policy already requires rather than something to track going forward — the work of confirming individual agencies' actual compliance sits with inspectors general and the Government Accountability Office, not with a page like this one.