Executive Order 14028 (May 2021): Zero Trust Becomes US Federal Policy

Retrospective: this article looks back at events from May 2021, written in 2026 with the benefit of hindsight.

On May 12, 2021, President Biden signed Executive Order 14028, Improving the Nation's Cybersecurity, in response to SolarWinds, Microsoft Exchange exploitation and Colonial Pipeline. It was one of the most significant US federal cybersecurity policy actions in years.

What it required

For federal agencies and, indirectly, their suppliers:

• Zero trust architecture: agencies had to develop plans to adopt zero trust. OMB memo M-22-09 (January 2022) later set specific goals, including phishing-resistant MFA.
• MFA and encryption for data at rest and in transit within set deadlines.
• Software supply chain security: NIST developed secure software development guidance, and software sold to government would need attestations; software bills of materials (SBOMs) entered mainstream discussion.
• Cloud security: accelerating secure cloud adoption, including FedRAMP modernization.
• Incident response: a standardized federal playbook and removal of barriers to sharing threat information between providers and government.
• Cyber Safety Review Board to investigate major incidents (it later reviewed Log4j, Lapsus$ and Storm-0558).
• Endpoint detection and response across federal agencies.

Why it mattered beyond government

Federal requirements flow to contractors and influence private sector practices. Zero trust, phishing-resistant MFA and SBOMs moved from vendor marketing to policy language. Insurers, auditors and large customers began asking similar questions.

In hindsight

EO 14028's direction largely held across later policy changes, even as specific implementation guidance evolved. For mid-sized companies, its practical legacy is a common vocabulary — zero trust, phishing-resistant MFA, EDR, secure software — that customers and regulators now expect.