Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/security-measures-eo-critical-software-use-1

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Security Measures for “EO-Critical Software” Use Under Executive Order (EO) 14028 - FAQs

## Share

Facebook

Linkedin

Twitter

Email

The following FAQs provide additional information on the guidance.
                  - Are all of the security measures appropriate for all EO-critical software?

*A security measure might not be relevant for a particular situation based on the nature of the software deployment or other factors. If a particular security measure cannot be implemented, other security measures could be identified and implemented to mitigate the risk and achieve the outcome that the missing security measure was intended to address. Agencies are still expected to apply risk management activities as part of their overall cybersecurity programs.*
                  - Will this guidance be updated as more types of EO-critical software are identified? 

*Potentially. However, all of the security measures for EO-critical software are anticipated to apply to all types of EO-critical software in all deployments.*
                  - How can we implement the security measures for using cloud-based EO-critical software?

*CISA, GSA’s FedRAMP program, and OMB are currently developing a federal cloud-security strategy and cloud-security technical reference architecture documentation in support of Section 3 of the EO. The security measures for using EO-critical software could be applied to cloud-based environments by cloud service providers.*
                  -   Does NIST have additional resources on cyber supply chain risk management (C-SCRM)?

*Yes, see**NIST’s C-SCRM project website**for links to all the resources. An example is the Federal C-SCRM Forum, which NIST hosts; the Forum fosters collaboration and the exchange of C-SCRM information among federal agencies to improve the security of federal supply chains. Examples of NIST C-SCRM guidance include SP 800-161,**Supply Chain Risk Management Practices for Federal Information Systems and Organizations**and SP 800-161 Rev. 1 (Draft),**Cyber Supply Chain Risk Management Practices for Systems and Organizations*.
                  -   What is the relationship between this guidance and zero trust architecture?

*Section 3 of the EO directs each federal agency to plan to implement zero trust architecture. All of the security measures for EO-critical software defined in this guidance are also components of a zero trust architecture, although by no means are they complete. Agencies developing plans for migrating to zero trust architecture can incorporate the security measures for EO-critical software use into those plans.**For more information on zero trust architecture, see the following Federal Government resources:*
                  - DISA and NSA,  *Department of Defense (DOD) Zero Trust Reference Architecture Version 1.0*
                  - NIST,  *SP 800-207, Zero Trust Architecture*
                  - NSA,  *Embracing a Zero Trust Security Model*
                  -   Objective 2 says to “protect the confidentiality, integrity, and availability of data,” but what about cases where not all three of those are needed, like protecting the confidentiality of publicly available information?

*Agencies should continue to take risk-based approaches for protecting data, and thus should only apply the types of protection that will reduce risk for a particular scenario. For example, protecting the confidentiality of publicly available information typically will not reduce risk, and thus would not be necessary.*
                  -   SM 1.1 includes the term “verifier impersonation-resistant.” What does that mean? 

*Verifier impersonation-resistant authentication protocols and credentials ensure that when a user or administrator attempts to connect to EO-critical software or an EO-critical software platform over a network, both parties (the person and the platform) are legitimate. Verifier impersonation resistance helps prevent people from having their credentials stolen by phishing attacks, and also helps prevent attackers from using stolen authentication information to impersonate a user or administrator. There are several ways to achieve verifier impersonation resistance; an example of a verifier impersonation-resistant protocol is client-authenticated Transport Layer Security (TLS). See**Section 5.2.5 of NIST SP 800-63B**for more information.*
                  - Where can I learn more about EO-critical software?

*Additional information is available**at this webpage**. It includes a set of FAQs that provide more details and context about EO-critical software.*
                  - Is there a summary of the security measures? 

*Yes, the list below includes the first sentence of each security measure. The summary is intended to improve understanding of the security measures and is not a substitute for the formal definition of the security measures for EO-critical software use in the previous table, which contains additional details for some security measures and provides informative references for all security measures.*

**Objective 1:** Protect EO-critical software and EO-critical software platforms from unauthorized access and usage.
                    - SM 1.1: Use multi-factor authentication that is verifier impersonation-resistant for all users  and administrators  of EO-critical software and EO-critical software platforms. ( See FAQ #7 .)
                    - SM 1.2: Uniquely identify and authenticate each service  attempting to access EO-critical software or EO-critical software platforms.
                    - SM 1.3: Follow privileged access management principles for network-based administration  of EO-critical software and EO-critical software platforms.
                    - SM 1.4: Employ boundary protection techniques as appropriate  to minimize direct access to EO-critical software, EO-critical software platforms, and associated data.

**Objective 2:** Protect the confidentiality, integrity, and availability of data used by EO-critical software and EO-critical software platforms.
                    - SM 2.1: Establish and maintain a data inventory  for EO-critical software and EO-critical software platforms.
                    - SM 2.2: Use fine-grained access control  for data and resources  used by EO-critical software and EO-critical software platforms to enforce the principle of least privilege to the extent possible.
                    - SM 2.3: Protect data at rest  by encrypting the sensitive data used by EO-critical software and EO-critical software platforms consistent with NIST’s cryptographic standards.
                    - SM 2.4: Protect data in transit  by using mutual authentication whenever feasible and by encrypting sensitive data communications for EO-critical software and EO-critical software platforms consistent with NIST’s cryptographic standards.
                    - SM 2.5: Back up data, exercise backup restoration, and be prepared to recover data  used by EO-critical software and EO-critical software platforms at any time from backups.

**Objective 3:** Identify and maintain EO-critical software platforms and the software deployed to those platforms to protect the EO-critical software from exploitation.
                    - SM 3.1: Establish and maintain a software inventory  for all platforms running EO-critical software and all software (both EO-critical and non-EO-critical) deployed to each platform.
                    - SM 3.2: Use patch management practices  to maintain EO-critical software platforms and all software deployed to those platforms.
                    - SM 3.3: Use configuration management practices  to maintain EO-critical software platforms and all software deployed to those platforms.

**Objective 4:** Quickly detect, respond to, and recover from threats and incidents involving EO-critical software and EO-critical software platforms.
                    - SM 4.1: Configure logging to record the necessary information about security events  involving EO-critical software platforms and all software running on those platforms.
                    - SM 4.2: Continuously monitor the security  of EO-critical software platforms and all software running on those platforms.
                    - SM 4.3: Employ endpoint security protection  on EO-critical software platforms to protect the platforms and all software running on them.
                    - SM 4.4: Employ network security protection  to monitor the network traffic to and from EO-critical software platforms to protect the platforms and their software using networks.
                    - SM 4.5: Train all security operations personnel and incident response team members, based on their roles and responsibilities,  on how to handle incidents involving EO-critical software or EO-critical software platforms.

**Objective 5**: Strengthen the understanding and performance of humans’ actions that foster the security of EO-critical software and EO-critical software platforms.
                    - SM 5.1: Train all users of EO-critical software, based on their roles and responsibilities,  on how to securely use the software and the EO-critical software platforms.
                    - SM 5.2: Train all administrators of EO-critical software and EO-critical software platforms, based on their roles and responsibilities,  on how to securely administer the software and/or platforms.
                    - SM 5.3: Conduct frequent awareness activities  to reinforce the training for all users and administrators of EO-critical software and platforms, and to measure the training’s effectiveness for continuous improvement purposes.  

**Previous Sections:**
                    - Introduction
                    - Guidance Purpose & Scope
                    - Security Measures for EO-Critical Software Use

Information technologyCybersecurity

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov