Trump’s New Executive Order Slashes Cybersecurity Protections, Axing Secure Software and Quantum-Resistant Crypto

A landmark shift in U.S. cybersecurity policy arrives with a new executive order that markedly reduces several Biden-era safeguards. The White House order, issued on June 6, 2025, scales back mandates aimed at hardening government software, securing critical networks, and guiding the move toward quantum-resistant cryptography. Stakeholders in the cybersecurity community have voiced concerns that the rollback may weaken defenses against sophisticated actors, especially in the wake of high-profile supply-chain intrusions. The policy pivot is framed by its proponents as a pro-business, anti-regulation stance designed to streamline compliance and reduce perceived regulatory overhead, but critics argue it sacrifices long-term security for short-term convenience.

What the new executive order changes

The executive order introduces a sweeping reorientation of federal cybersecurity policy by removing or relaxing several high-profile requirements that had been central to the prior administration’s approach. These changes touch key areas including secure software development, cryptographic readiness for post-quantum threats, phishing-resistant authentication, Internet routing security, and the broader push for digital identity solutions. The core intention behind these deletions, according to supporters, is to reduce regulatory friction and accelerate innovation and deployment. Opponents counter that the move eliminates critical safeguards that were designed to reduce the probability of devastating compromises and to raise the bar for both government and contractor practices.

The order explicitly rolls back several measures that were previously considered foundational. First, it scales back the mandate for federal agencies and their contractors to preferentially adopt products that incorporate quantum-safe or quantum-resistant encryption as these technologies become viable in the commercial market. This shift signals a slower, more incremental approach to cryptographic modernization, rather than a proactive, agency-wide push that anticipated the advent of quantum computing and its potential to break widely used cryptographic algorithms.

Second, the order reverses the stringent Secure Software Development Framework (SSDF) requirements that had been applied to software and services used by the federal government and its contractors. Under the Biden-era framework, compliance was enforced through formal processes and attestations, ensuring that software suppliers could demonstrate adherence to a defined security standard before entering government procurement streams. The Trump-era directive directs a national standards body to craft a reference security implementation for the SSDF but removes the mandatory attestation mechanism. The intent appears to be to provide guidelines rather than enforceable, verifiable attestations at the time of procurement.

Third, the executive order scales back the push for phishing-resistant authentication methods, such as WebAuthn, to be used for logging into networks accessed by contractors and government agencies. The move is framed as reducing friction in identity verification workflows, but opponents warn that it sacrifices a layer of defense that has gained prominence for its resistance to credential phishing and certain forms of credential theft.

Fourth, the order revises the ambitions around securing Internet routing through the Border Gateway Protocol (BGP). It reduces the emphasis on deploying new tools and standards to harden routing, including efforts to promote methods like Route Origin Authorizations (ROAs) and more robust authentication mechanisms for BGP. Critics contend that relaxing BGP security guidance increases the risk of misrouting and traffic manipulation, which could affect critical infrastructure, financial networks, and other sensitive systems.

Fifth, the order scales back the broader push to encourage digital forms of identity as a standard component of government services and contractor interactions. The White House statement accompanying the executive order argued that enabling universal digital IDs could risk misuse, particularly in the context of unauthorized access to public benefits, and thus slowed or halted the adoption trajectory.

In sum, the order shifts the policy balance from aggressive modernization and strict compliance toward a more flexible, business-friendly posture. While the rhetoric emphasizes efficiency and market vitality, the practical implications hinge on how agencies, contractors, and vendors interpret and implement the new guidelines, particularly given the absence of the previously mandated attestations and the reduced enforcement focus.

The five core areas in detail

• Quantum-safe encryption adoption: The government had signaled a strong preference for cryptographic schemes resistant to quantum attacks. The new directive scales back this requirement, deferring aggressive adoption until there is more consensus, more mature technology, and clearer implementation paths that do not unduly hinder procurement cycles.

• Secure Software Development Framework (SSDF): The Biden-era SSDF represented a structured approach to secure software creation and procurement. The Trump-order substitutes a new reference implementation created by the National Institute for Standards and Technology (NIST) with no attestation requirement, effectively removing a formal compliance checkpoint that previously aimed to guarantee security controls were actually in place in practice.

• Phishing-resistant authentication: WebAuthn and similar mechanisms were part of a broader strategy to remove reliance on static passwords and credentials susceptible to phishing and credential stuffing. The new order deprioritizes these phishing-resistant regimens for government and contractor networks, a move critics say increases risk in an era of sophisticated social engineering and credential theft campaigns.

• BGP security and routing controls: The Secure Routing initiative aimed to mitigate risks in Internet routing by promoting cryptographic protections and operational guidance for BGP. The revised policy reduces the emphasis on such protections, potentially leaving routing infrastructure more exposed to misrouting and attack vectors that can interrupt or intercept traffic.

• Digital identity initiatives: The Biden policy encouraged digital IDs to streamline access control and identity verification across federal services and vendor ecosystems. The current order questions the breadth of this approach, citing concerns about abuse and privacy, and rolls back certain deployment timelines.

These targeted shifts reflect a broader philosophy that prioritizes regulatory simplicity and market-driven solutions over mandatory, prescriptive security standards. Proponents frame the result as a more agile environment that reduces compliance overhead and accelerates innovation. Critics, however, view the changes as a retreat from a measured, risk-informed security posture that had been shaped by notable cyber incidents and security research.

Context and history: Biden’s cybersecurity directives and the SolarWinds lesson

To understand the significance of the new executive order, it helps to review the policy landscape that preceded it and the events that helped shape it. The Biden administration had pursued a multi-faceted cybersecurity strategy designed to reduce risk across government and critical sectors. Central to that strategy was a strong emphasis on standardized security requirements for software used by the government, rigorous third-party risk controls, and a proactive approach to post-quantum cryptography.

A pivotal moment driving these policy choices dates back to the SolarWinds supply chain attack of 2020. In that event, adversaries linked to a foreign government breached the networks of a widely used cloud service, SolarWinds, and manipulated a software update that propagated a backdoor to more than 18,000 customers. The reach of that breach extended to multiple federal departments—Commerce, Treasury, Homeland Security, and the National Institutes of Health—and touched a broad array of private sector companies, including major tech players such as Microsoft, Intel, Cisco, Deloitte, and FireEye. The SolarWinds incident underscored the fragility of software supply chains and the cascading risks that can arise when trusted software is compromised.

In response, the Biden administration introduced a set of security requirements intended to prevent or mitigate similar breaches. Among these were the SSDF requirements for software used by government agencies and contractors, as well as a framework for the self-attestation of compliance that aimed to ensure vendors were following the established controls. The SSDF was designed to be a practical blueprint for secure development, with the self-attestation process intended to create a trusted baseline that suppliers would need to meet before entering government procurement pipelines.

Another major element was the push toward quantum-resilient cryptography. Under Biden’s directives, agencies were encouraged to begin adopting encryption schemes that would be resistant to attacks from quantum computers as these technologies matured. The rationale was to move away from fragile cryptographic schemes that could be rendered ineffective by advances in quantum computing.

The WebAuthn protocol and related phishing-resistant authentication technologies also featured prominently as tools to reduce the risk of credential compromise. The idea was to move beyond passwords and toward more secure authentication factors that are harder to spoof, thereby strengthening access controls for sensitive networks and systems.

The policy also included guidance related to BGP security and routing integrity. Recognizing the centrality of Internet routing to critical operations, the initiative sought to harden routing protocols and to establish operational practices designed to prevent misrouting and related disruptions. Similarly, there was emphasis on digital identity initiatives to standardize identity verification across federal services and contractor ecosystems, aiming to streamline access while safeguarding privacy and security.

The shift reflected a broader theme: policy that is as much about setting expectations and aligning incentives as it is about mandating specific technical controls. In this frame, executive orders function as both policy declarations and practical roadmaps for how agencies, contractors, and vendors should approach risk management in a rapidly evolving threat landscape.

Why the SSDF and attestations mattered

The Secure Software Development Framework was born from a recognition that secure software is not only a product feature but a process that begins long before code is written. The framework emphasizes secure design, secure coding practices, robust testing, and comprehensive supply-chain controls. In the post-SolarWinds era, the need for a consistent security baseline for software entering government networks was clear. The requirement for an attestation—an official declaration from senior company leadership that the software complied with the framework—was designed to strengthen accountability and create a verifiable chain of security assurance.

Critics of the attestation model argued that it created a potential bottleneck and could be gamed by vendors who could technically claim compliance without implementing the controls in meaningful ways. The Trump-era iteration removes the formal attestation requirement and replaces it with a reference implementation to be developed by NIST. This shift could be viewed as a way to reduce friction in procurement while hoping to preserve security through guidance rather than binding proof of compliance.

The quantum question: why cryptography matters

Quantum computing poses a fundamental challenge to conventional cryptographic algorithms. As researchers advance quantum capabilities, the cryptographic safeguards that protect confidentiality, integrity, and authentication must evolve. The Biden administration positioned the move toward quantum-safe cryptography as essential to long-term resilience. The Trump-order attempt to slow or refocus this transition reflects a different risk calculus: balancing immediate procurement realities and innovation incentives against the long horizon of cryptographic risk.

The practical hurdle is substantial. Transitioning to quantum-resistant algorithms requires rethinking software architectures, updating cryptographic libraries, and coordinating across countless systems, databases, and communications channels. It is not a one-time update but a multi-year program that touches virtually every layer of technology infrastructure. The tension between a measured, phased transition and a more aggressive, mandated shift is at the heart of the policy debate.

Implications for government contractors and the private sector

The executive order’s tightening or removal of several core requirements has direct implications for contractors, software vendors, and the broader technology ecosystem. The walk-back on attestation means that vendors may face less formal pressure to demonstrate verifiable security compliance before government contracts. While this could speed up procurement and reduce administrative overhead, it also raises concerns about the durability of security guarantees and the risk that actual security practices do not match claimed capabilities.

From the contractor perspective, the absence of a mandatory attestation might lower entry barriers for some vendors seeking federal business. However, the requirement to align with SSDF-driven best practices remains, albeit through a different mechanism. The risk attribution, accountability, and traceability that attestations provided could be diluted if the government does not require a demonstrable, auditable proof of security controls before award.

The policy shift also affects the pace and direction of encryption modernization. Slower adoption of quantum-resistant cryptography could leave government networks exposed to emerging threats for longer than anticipated, particularly if adversaries advance cryptanalytic capabilities or if certain quantum-resistant solutions face deployment challenges in widely used software and hardware stacks. Agencies and contractors may experience a longer transition period, during which hybrid cryptographic configurations and compatibility considerations predominate.

In the domain of authentication, deprioritizing phishing-resistant methods could influence the risk profile of sensitive systems. While user experience and administrative overhead are important, the defensive advantages of WebAuthn and similar mechanisms—such as phishing resistance and reduced reliance on password-based authentication—are well documented in the cybersecurity community. A slower or more limited deployment of such controls could translate into higher susceptibility to credential-based intrusions, especially in environments with dispersed workforces and contractor networks.

The BGP and routing security adjustments have meaningful operational consequences as well. Reducing emphasis on Route Origin Authorizations and related routing protections may increase exposure to misrouting, hijacking, and manipulation of traffic destined for critical services. Given the stakes in sectors like finance, energy, and public safety, routing integrity remains a crucial layer of defense against a range of attacks that exploit internet routing dynamics.

The digital identity dimension also influences both security and privacy considerations. Expanding digital identity capabilities across government services and contractor ecosystems can streamline access control and user experience, but it also raises questions about data governance, misuse, and privacy protections. The policy conversation becomes a balancing act between operational efficiency, security guarantees, and the protection of civil liberties and civil rights in the context of identity verification and access.

Industry reaction and practical implications

Industry voices have characterized the policy trajectory as decidedly pro-business and anti-regulation in its thrust. Critics argue that the diminished emphasis on aggressive security controls could position the United States as a more attractive target for sophisticated threat actors, given the potential for weaker standards in critical procurement segments. Proponents contend that the new approach reduces unnecessary friction and allows for more rapid deployment of secure, high-quality software and services by private-sector vendors.

Practically, the shift may influence how procurement cycles are conducted, how risk is assessed in contractor agreements, and how security controls are documented and audited. In environments where regulatory expectations are ambiguous or fragmented, a more guidance-based approach could yield uneven outcomes, prompting ongoing debates about what constitutes adequate security in practice. The tension between setting binding security requirements and providing flexible, outcome-oriented guidance is likely to shape policy discussions, vendor strategies, and government-academia collaborations in the months ahead.

Quantum-resistance, PQC, and the road ahead

Quantum-resistant cryptography (PQC) is at the center of the security modernization conversation. The move to adopt PQC algorithms is driven by the expectation that quantum-era threats could break traditional public-key cryptosystems, compromising confidentiality and trust across communications, software updates, digital signatures, and more. The National Institute of Standards and Technology (NIST) has led a multi-year process to standardize a portfolio of post-quantum cryptographic algorithms that are secure against quantum threats and that can be implemented efficiently across existing platforms.

However, the execution of this plan is complex. Transitioning to PQC across government networks and the private sector requires substantial coordination across software libraries, hardware accelerators, cryptographic modules, and operating systems. It also necessitates solving compatibility challenges, performance trade-offs, and interoperability concerns that arise when older cryptographic suites coexist with new PQC schemes. The policy shift away from a mandated, government-wide transition may slow momentum on this critical objective, potentially extending the period during which systems operate with mixed cryptographic protections. In practice, agencies and contractors would need to adopt phased strategies, focusing on high-value assets and mission-critical workloads while ensuring backward compatibility and smooth upgrade paths.

The WebAuthn and phishing-resistant authentication landscape is intertwined with PQC considerations. In secure authentication, the combination of strong cryptographic suites and robust key exchange protocols is essential. As the ecosystem evolves to support stronger, passwordless approaches, the policy environment will influence how quickly organizations adopt these technologies, how they handle legacy systems, and how they manage user onboarding, credential lifecycle, and revocation processes.

Moreover, the broader modernization effort involves not only cryptography but also supply-chain resilience, secure software development practices, and secure identity management. A comprehensive PQC strategy must be integrated with secure software supply chains, testbed environments for deploying quantum-safe protocols, and governance structures that enable consistent risk management across agencies and vendors. The current policy shift creates a constraint on aggressive, mandated progress, but it does not resolve the technical and organizational challenges inherent to a nationwide cryptographic transition. It remains essential for policymakers, industry, and the cybersecurity research community to collaborate on practical, scalable approaches that preserve security while maintaining innovation and efficiency.

Practical considerations for implementation

• Procurement and standards alignment: Agencies must interpret the new reference SSDF implementation and determine how it intersects with existing procurement requirements. Vendors will seek clarity on what constitutes acceptable security assurances, especially in the absence of formal attestations.

• Phased cryptography upgrades: Organizations may adopt staggered approaches to cryptographic modernization, prioritizing assets with the highest risk exposure while preparing for a broader rollout once PQC standards have matured and validated interoperability.

• Authentication strategy harmonization: The balance between user experience and security will guide decisions about deploying passwordless authentication, step-up authentication, and phishing-resistant mechanisms. Organizations must assess user adoption challenges, device support, and cross-organization interoperability.

• BGP and routing controls: Operators of critical networks should plan for potential future guidance or updates that reintroduce routing security best practices, ensuring readiness to implement ROAs, RPKI-based protections, and related measures if the policy posture shifts again.

• Digital identity governance: With the reconsideration of digital identity initiatives, agencies and contractors must revisit data governance frameworks, privacy protections, and risk assessment methodologies to prevent potential misuse while harnessing the benefits of streamlined access controls.

What happens next: policy trajectory and practical effect

The policy landscape around cybersecurity is inherently dynamic, driven by evolving threat landscapes, political considerations, and the ongoing push-pull between security and economic efficiency. With this executive order, several trajectories are likely:

• Legislative and administrative follow-on: Lawmakers and government agencies may revisit some of the rolled-back provisions in subsequent iterations, seeking a balance between secure modernization and regulatory simplicity. The policy conversation could lead to discrete amendments or new guidance that targets specific risk domains, such as supply-chain security or digital identity governance.

• Industry adaptation and market responses: Vendors and service providers may adjust product roadmaps to align with the new emphasis. The absence of a formal attestation could shift certification or third-party assessment practices toward alternative assurance mechanisms, potentially increasing the importance of independent security testing, penetration testing, and ongoing monitoring as trust signals for government customers.

• Security outcomes and incident response: The long-term security impact will hinge on how well agencies and vendors sustain secure development, secure software deployment, and robust identity and routing protections in practice. If the rollback reduces enforcement rigor without compensating controls, there could be a measurable difference in how effectively large-scale cyber incidents are detected, contained, and remediated.

• Public-private collaboration: The policy evolution underscores the need for ongoing collaboration between government, industry, and the research community to address fast-moving threats. Shared threat intelligence, joint exercises, and standardized secure development practices remain critical to resilience, regardless of the regulatory posture.

• International alignment: The decision may influence how the United States engages with allies and partners on cryptography standards, digital identity interoperability, and shared routing security practices. A more flexible regulatory framework could either facilitate adaptive cooperation or complicate harmonization efforts if counterpart nations pursue more aggressive security timelines.

A nuanced view: balancing risk, innovation, and resilience

The executive order reflects a deliberate recalibration of risk tolerance. From one vantage, simplifying regulatory requirements can unleash innovation, accelerate procurement, and reduce the bureaucratic burden on organizations delivering essential technology and services to the government. From another vantage, relaxing or delaying critical security controls raises legitimate concerns about systemic risk, especially in an environment where cyber threats—including supply-chain attacks, ransomware campaigns, and sophisticated nation-state operations—continue to escalate.

Security practitioners emphasize that resilience is achieved not merely through a single policy choice but through a layered, integrated approach. The interplay between secure development practices, robust cryptography, phishing-resistant authentication, routing integrity, and identity governance constitutes a comprehensive defense-in-depth strategy. If any layer weakens, the overall security posture can degrade. The policy shift thus invites a rigorous, proactive security culture among government and industry stakeholders who must adapt to a new regulatory cadence while preserving strong protective measures.

Expert perspectives: a snapshot of the broader debate

• Industry governance voices argue that reducing the emphasis on formal attestations and certain prescriptive controls can lower barriers to entry and foster a more dynamic marketplace. They highlight the importance of aligning security outcomes with real-world risk and operational needs, rather than relying solely on paperwork.

• Security researchers and practitioners warn that the removal of codified attestations and some mandatory standards could create gaps in accountability and verification. They argue that measurable, auditable security assurances are essential to ensuring that security controls are implemented and effective across vast procurement ecosystems.

• Policy analysts underscore the tension between regulatory simplicity and risk management. They emphasize the need for ongoing, independent evaluation of security practices and for adaptive governance mechanisms that can respond to emerging threats without stifling innovation.

• Academics and standards developers stress the importance of continuing progress in cryptography, secure-by-design software, and routing security. They point out that the transition to quantum-safe cryptography is not a trivial replacement but a comprehensive undertaking that requires sustained investment, research collaboration, and practical deployment strategies.

Conclusion

The new executive order marks a defining moment in the ongoing governance of national cybersecurity. By trimming several high-profile requirements—ranging from quantum-resistant encryption to secure software development, phishing-resistant authentication, BGP routing protections, and digital identity initiatives—the policy signals a shift toward a more flexible, pro-business regulatory posture. The stated aim is to reduce regulatory friction and accelerate technology deployment, yet critics warn that these changes may come at the cost of long-term resilience and robust risk management.

As agencies and industry participants navigate this transition, the critical challenge will be to preserve the integrity of the digital infrastructure without sacrificing the pace of innovation. The SolarWinds incident looms large in the collective memory of cybersecurity professionals, reinforcing the argument that well-designed, verifiable security controls are essential. The balance between expediency and rigor will shape not only procurement practices and vendor strategies but also the broader trajectory of the United States’ cybersecurity posture for years to come.

In the months ahead, expect vigorous policy discussions, technical debates, and practical experiments as stakeholders seek workable paths forward. The ultimate test will be whether the revised approach can deliver durable security gains, maintain trust in government and private-sector systems, and support a resilient digital ecosystem that can withstand evolving threats while enabling responsible innovation.