Timeline of Executive Order 14028

Secretary of Homeland Security
5(a) Establish the Cyber Safety Review Board to review and assess significant cyber incidents affecting FCEB Information Systems or non-Federal systems, threat activity, vulnerabilities, mitigation activities, and agency responses. Membership shall include Federal officials and representatives from private sector entities.

This deadline is a guess! No date is specificed in the Order, yet there are dependent deliverables. These dates may shift in the future once we have more information.

Director of CISA
7(c) Recommend to the Director of OMB options for implementing an EDR initiative, centrally located to support host-level visibility, attribution, and response regarding FCEB Information Systems.

Secretary of Homeland Security
2(g)(i) Recommend to the FAR Council the contract language defining cyber incidents requiring reporting, the information that must be reported, National Security Systems reporting requirements, time periods, and the types of service providers covered.

Director of NSA
7(g) Recommend to the Secretary of Defense, the Director of National Intelligence, and the CNSS actions for improving detection of cyber incidents, EDR approaches, and whether such measures should be operated by agencies or through a centralized service.

Director of OMB
2(b), 2(c) Recommend updates to contract language to ensure that IT and OT service providers collect, preserve, and share with agencies information and reporting relevant to cybersecurity event prevention, detection, response, and investigation.

Director of CISA
2(i) Review current agency-specific cybersecurity requirements and recommend to the FAR Council standardized contract language.

Head of Each Agency
3(b) Update existing agency plans to prioritize resources for the adoption cloud technology, develop a plan to implement Zero Trust Architecture, including the migration steps outlined by NIST, and report to the Director of OMB and the APNSA regarding the plans.

Director of CISA
3(c)(iii) Issue for FCEB Agencies a cloud-service governance framework that identifies services and protections available based on incident severity and identifies associate data and processing activities.

Administrator of General Services
3(f) Modernize FedRAMP by:

• Establishing a training program to ensure agencies are trained and equipped to manage FedRAMP requests
• Improving communication with CSPs through automation and standardization of messages
• Incorporating automation throughout the lifecycle of FedRAMP
• Digitizing and streamlining documentation that vendors are required to complete
• Mapping relevant compliance frameworks onto requirements in the FedRAMP authorization process

Cyber Safety Review Board
5(d) Perform initial review of the SolarWinds incident.

This deadline is not specified in the Order, but two dependent deliverables are associated with the completion of this review.

Secretary of Defense and the Secretary of Homeland Security
7(j)(i) Establish procedures for the DoD and the DHS to immediately share with each other DoD Incident Response Orders or DHS Emergency Directives and Binding Operational Directives applying to their respective information networks.

Agencies
7(f) Establish or update MOA with CISA for the Continuous Diagnostics and Mitigation Program to ensure object level data, as defined in the MOA, are available and accessible to CISA.

Director of the NSA, Attorney General, Secretary of Homeland Security, Director of National Intelligence
2(g)(iii) Jointly develop procedures for ensuring that cyber incident reports are promptly and appropriately shared among agencies.

FAR Council
2(d) Preview contract language proposed by Director of OMB and publish proposed updates to the FAR for public comment.

Director of OMB
3(c)(i) Develop a cloud-security strategy and provide guidance to agencies to ensure that risks from cloud-based services are understood and addressed, and that FCEB Agencies move closer to Zero Trust Architecture.

Director of CISA
3(c)(ii) Issue, for the FCEB, cloud-security technical reference architecture documentation recommending approaches to cloud migration and data protection for data collection and reporting
3(e) Establish a framework to collaborate on cybersecurity and incident response activities related to FCEB cloud technology to ensure information sharing among agencies and CSPs.

Heads of FCEB Agencies
3(c)(iv) Evaluate the types and sensitivity of their unclassified data, and provide a report to the Director of CISA and the Director of OMB prioritizing identification of data considered to be the most sensitive and threatened, plus appropriate processing and storage solutions for it.

Secretary of Homeland Security
5(i) Provide to the President through the APNSA the recommendations of the Board based on the initial review, including:

• gaps in, and options for, the Board's composition
• proposed mission, scope, and responsibilities
• membership eligibility criteria for private sector representatives
• governance structure
• criteria for types of cyber incidents to be evaluated
• sources of information to be made available
• approach for protecting the information
• administrative and budgetary considerations

This deadline is ambiguous but appears to follow completion of the initial review.

Secretary of Defense, Director of National Intelligence, the CNSS
7(h) Review recommendations from the Director of the NSA and establish policies that effectuate those recommendations.

Director of CISA
7(i) Report to the Director of OMB and the APNSA how authorities granted to conduct threat-hunting activities on FCEB networks without prior authorization from agencies are being implemented; recommend procedures to ensure that mission-critical systems are not disrupted, procedures to notify system owners of vulnerable government systems, and the range of techniques that can be used.

All Agencies
3(d) Adopt multi-factor authentication and encryption for data at rest and in transit. Heads of FCEB Agencies shall report to the Director of CISA, the Director of OMB, and the APNSA on their progress, CISA shall take all appropriate steps to maximize adoption. Those unable to fully adopt shall provide written rationale to the Director of CISA, the Director of OMB, and the APNSA.