Executive Order 13636: Improving Critical Infrastructure Cybersecurity

What happened

Recognizing the growing cyber threat to national and economic security, the U.S. government issued EO 13636. It mandated the National Institute of Standards and Technology (NIST) to lead the development of a framework to reduce cyber risks to critical infrastructure. It also directed agencies to increase the volume, timeliness, and quality of cyber threat information shared with U.S. private sector entities.

Technical mechanism

The policy mechanism involved establishing the Enhanced Cybersecurity Services program and directing DHS to expedite security clearances for appropriate personnel employed by critical infrastructure owners and operators.

Why it matters

This Executive Order laid the foundation for the NIST Cybersecurity Framework (CSF), which became a global standard for cybersecurity risk management, and established formal mechanisms for public-private cyber threat information sharing.

Impact

The order catalyzed the creation of the NIST Cybersecurity Framework (released in 2014), which has since been adopted by organizations worldwide. It formalized the partnership between the U.S. government and private sector critical infrastructure operators.

Response

NIST convened workshops with industry stakeholders to develop the Framework, while DHS expanded its information-sharing programs and established processes for identifying critical infrastructure at greatest risk.

Defensive lessons

• Adopt standardized risk management frameworks like NIST CSF to align security practices with business objectives
• Participate in public-private information sharing initiatives to receive timely threat intelligence

Evidence register

1. The White House — Executive Order -- Improving Critical Infrastructure Cybersecurity (verified)