This is the second blog in a series of Covington blogs on cybersecurity policies, executive orders (“EOs”), and other actions of the new Trump Administration. This blog describes key cybersecurity developments that took place in March 2025.
Trump Administration Executive Order on Achieving Efficiency
On March 19, 2025, the Trump Administration released an EO entitled “Achieving Efficiency Through State and Local Preparedness”. The EO shifts the focus to state and local government to prepare for cyber-attacks and extreme weather, launches a National Resilience Strategy, and “calls for a review of all infrastructure, continuity, and preparedness policies to modernize and simplify federal approaches, aligning them with the National Resilience Strategy.” This includes reviewing a number of specific EOs from the Biden Administration and earlier. The EO also creates a National Risk Register to track risks to national infrastructure and prioritize focus and spending.
The stated premise of the EO is that “commonsense approaches and investments by State and local governments across American infrastructure will enhance national security.” The EO explains that the most effective preparation comes from the State and local governments and allows citizens to benefit more immediately, suggesting that State and local governments are better positioned to anticipate needs and address unique impacts of cyber-attacks or other emergencies within local communities. In addition, the EO emphasizes efficiency and reducing taxpayer burden by providing specific cuts to federal government responsibilities. The policy overview does not provide details on how or if the federal government will support state and local governments after shifting disaster preparedness and response.
The EO mandates specific federal policy changes. The EO requires that the Assistant to the President for National Security Affairs (“APNSA”) develop a “National Resilience Strategy” within 90 days, which will be reviewed and updated at least every four years. Additionally, the APANSA is charged with reviewing and recommending revisions, recissions and replacements of all policies related to Critical Infrastructure, including National Security memorandum and EOs related to Supply Chain Resilience, Critical Infrastructure, federal preparedness and response to events and natural disasters, and food and agriculture resilience. Notably, the list of policies to review and revise includes the National Security Memorandum 22 of April 30, 2024, which in conjunction with Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”) establishes minimum resilience and security requirements and recommendations to build resilience into critical infrastructure; Executive Order 14017 of February 24, 2021 (America’s Supply Chains), which includes oversight for critical sectors and information and communications technology, including the industrial base for the development of ICT software, data, and associated services; and Executive Order 14123 of June 14, 2024 (White House Council on Supply Chain Resilience), among others.[1]
Finally, as noted above, the EO requires that the APANSA establish a “National Risk Register” to quantify natural and malign risks to national infrastructure, which will then be “used to inform the Intelligence Community, private sector investments, State investments, and Federal budget priorities.”
The EO does not elaborate, but the Fact Sheet released in conjunction with the EO explains that the review of these federal policies is aimed at “shifting national critical infrastructure policy from an “all-hazards” approach to a risk-informed approach, prioritizing resilience and action over mere information sharing.”
This EO represents a departure from the approach of prior administrations of centralizing cybersecurity risk mitigation and response in the federal government, and could result in differing approaches by state and local governments to meet these obligations, depending on policy approaches and funding and resourcing available. Additional details have yet to be provided on funding or resources for state and local governments that may face challenges identifying, assessing, and addressing cyber risks effectively without the Intelligence Community resources.
GSA Establishes FedRAMP 20x Initiative
On March 24, 2025, GSA announced the FedRAMP 20X initiative. This program seeks to modernize FedRAMP by making it easier for companies to obtain and maintain FedRAMP authorizations. As described by GSA, the intent would be to significantly reduce the amount of time that is required to obtain a FedRAMP authorization from months or even years to weeks. Initially, the program would focus on certain SaaS offerings that are hosted on existing FedRAMP authorized infrastructure, and would accomplish the objectives of rapid authorization through a number of key steps. One notable goal is to eliminate documentation requirements for the majority of FedRAMP Moderate controls (80% in total) and to replace documentation with automated validation. The initiative does not explain how this validation would occur. Another key element of the initiative is to increase reliance on existing industry certifications (e.g., ISO certificates) to avoid the need for reassessment of the same technical processes that may have been validated as part of those certifications. Finally, the program would move towards an automated process for continuous monitoring rather than a manual process that involves annual assessments. The specific timing of implementation of these goals is unclear, but GSA has created several industry working groups to discuss approaches for achieving the goals.
[1] Other listed policies for review include National Security Memorandum 32 of January 19, 2025 (National Continuity Policy); Executive Order 14146 of January 19, 2025 (Partial Revocation of Executive Order 13961); Executive Order 12656 of November 18, 1988 (Assignment of Emergency Preparedness Responsibilities); Homeland Security Presidential Directive 5 of February 28, 2003 (Management of Domestic Incidents); Presidential Policy Directive 8 of March 30, 2011 (National Preparedness); Presidential Policy Directive 22 of March 28, 2013 (National Special Security Events); and Presidential Policy Directive 44 of November 7, 2016 (Enhancing Domestic Incident Response).