This is the fifth blog in a series of Covington blogs on cybersecurity policies, executive orders (“EOs”), and other actions of the Trump Administration. The fourth blog is available here and our initial blog is available here. This blog describes key cybersecurity developments that took place in June 2025.
White House Issues New Cybersecurity Executive Order
On June 6, President Trump issued an Executive Order (“Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144”) (the Order) that modifies certain initiatives in prior Executive Orders issued by Presidents Obama and Biden and highlights key cybersecurity priorities for the current Administration. We wrote about the Order in additional detail here.
At a high level, the Order: (i) directs that existing federal government regulations and policy be revised to focus on securing third-party software supply chains, quantum cryptography, artificial intelligence, and Internet of Things (IoT) devices; and (ii) more expressly focuses cybersecurity-related sanctions authorities on “foreign” persons. Although the Order makes certain changes to prior cybersecurity related Executive Orders issued under previous administrations, it generally leaves the framework of those Executive Orders in place. For example, the Order removes certain requirements relating to the form of attestations (i.e., removing the requirement for machine readable format), as well as the directive for centralized validation of software attestations by the Cybersecurity and Infrastructure Agency (CISA). Likewise, the associated directive to the Federal Acquisition Regulatory Council to amend the Federal Acquisition Regulation to incorporate those requirements has also been eliminated. However, the Order appears to leave the core program in place. Further, it does not appear to modify other cybersecurity Executive Orders beyond those specified. To that end, although the Order highlights some areas where the Trump administration has taken a different approach than prior administrations, it also signals a more general alignment between administrations on core cybersecurity principles.
U.S. Government Issues Cybersecurity Warning to Critical Infrastructure Operators and Others
On June 30, CISA, the Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center (DC3), and the National Security Agency (NSA) warned U.S. critical infrastructure organizations and other companies that the threat of cyber-attacks from Iran-affiliated cyber actors is heightened in the wake of the Iran conflict. We wrote about the warning in additional detail here. The agencies cautioned that the risk is particularly high for Defense Industrial Base (DIB) companies with Israeli ties. In addition to distributed denial of service (DDoS) and ransomware attacks, the agencies explained that malicious actors may target operational technology (OT) connected to the public internet to perpetrate attacks. The warning listed a variety of mitigation measures for critical infrastructure companies.