Executive Order 14028: How one directive made zero trust and software supply chains national policy

In December 2020, the discovery of the SolarWinds breach, a supply chain attack that compromised a widely used network management tool and gave attackers access to thousands of organizations, sent a shock through government and industry. Five months later, the White House responded with something rare in the history of cybersecurity: a single directive that translated hard-won lessons into concrete, enforceable requirements. Executive Order 14028, signed in May 2021, made zero trust, multi-factor authentication, and software bills of materials national policy. Here is what the order required and why it reshaped security programs far beyond the federal government.

The SolarWinds wake-up call

To understand the order, you have to understand the breach that prompted it. Attackers, widely attributed to a state actor, inserted malicious code into a legitimate software update for SolarWinds Orion, a network management platform used by government agencies and Fortune 500 companies alike. Because the update was signed and trusted, it slipped past normal defenses, and the attackers gained access to an enormous number of organizations through a single compromised vendor. The lesson was stark: the software supply chain, the very thing organizations trusted implicitly, had become the attack surface. Executive Order 14028 was the direct policy response.

Zero trust became the stated goal

The most consequential requirement was the mandate for federal agencies to move toward a zero trust architecture. The order directed agencies to implement a model built on the principle of never trusting and always verifying, where no user, device, or network is trusted by default. It was a formal rejection of the old perimeter-based approach, which SolarWinds had shown to be obsolete. The order did not make zero trust happen overnight, but it made it an explicit, funded, and scheduled objective rather than an aspiration. For the broader industry, the signal was unmistakable: zero trust was no longer a vendor buzzword, it was the direction of travel.

Multi-factor authentication and encryption became non-negotiable

The order was unusually specific about some controls. It required agencies to implement multi-factor authentication and encryption for data at rest and in transit, with defined timelines. The reasoning was straightforward: stolen credentials are the leading cause of breaches, and encryption limits the damage when data is exposed. By naming these controls explicitly, the order turned them from best practices into requirements, and the private sector, which serves the government and often adopts its standards, took notice. MFA, in particular, moved rapidly from recommended to expected across organizations of every size.

Software bills of materials became a requirement

Perhaps the most forward-looking provision was the requirement for a software bill of materials, or SBOM. An SBOM is a machine-readable inventory of every component, including the open source libraries, that make up a piece of software. SolarWinds had shown that organizations often did not know what was inside the software they ran, which made it impossible to know whether they were affected by a vulnerability. By requiring SBOMs for software sold to the government, the order created a powerful incentive for the entire software industry to build supply chain transparency. The concept, once obscure, became a standard part of the security vocabulary.

Why the order mattered beyond government

Executive Order 14028 technically applied to federal agencies and their contractors, but its influence spread far wider. Because the federal government is an enormous buyer of software and services, its requirements quickly became de facto standards for the industry. Vendors that wanted to sell to the government had to meet the new standards, and they often applied the same practices to their commercial products. Regulators, insurers, and auditors also began referencing the order's principles. The result was that zero trust, MFA, and supply chain transparency stopped being optional for any serious organization.

Where training and the human element fit

The order was primarily about technology and process, but it had a clear human dimension. Zero trust only works if employees understand why access is being verified more often and how to handle the new authentication requirements. Supply chain security only works if the people building and buying software understand their responsibility. And every control in the order ultimately depends on a workforce that recognizes threats and follows procedure. The organizations that succeeded in implementing the order's principles paired the technical changes with training that explained the why, not just the what.

The lasting legacy

Executive Order 14028 was a turning point because it moved cybersecurity from a matter of private best practice to a matter of public policy with deadlines and consequences. The concepts it elevated, zero trust, MFA, encryption, and software bills of materials, became the common language of security programs everywhere. The order did not solve every problem it addressed, and the work of implementing it continued for years, but it gave the industry a clear direction at a moment when one was badly needed. In that sense, SolarWinds, for all the damage it caused, produced something valuable: a shared, concrete plan for what came next.