President Biden’s executive order on cybersecurity marks a significant step toward strengthening the federal government’s defenses against increasingly sophisticated cyber threats. Issued in May 2021, the order establishes new security requirements for federal agencies and their technology suppliers, emphasizing multifactor authentication, Zero Trust architecture, and improved incident reporting. The initiative follows several high-profile cyberattacks that exposed vulnerabilities in government systems and critical infrastructure.
Although the executive order directly targets federal government operations, its implications extend to the financial services and payments industries. Financial institutions, payment processors, and technology providers face many of the same cybersecurity challenges, particularly as digital transactions and cloud-based infrastructure become more prevalent. The administration’s approach could influence future regulatory expectations and encourage broader adoption of stronger authentication and security practices.
Federal Cybersecurity Requirements and Zero Trust Architecture
The Executive Order signed by President Biden yesterday will mandate government agencies implement multifactor authentication that is based on risk and a Zero Trust security model. The government is also creating a Cybersecurity Safety Review Board that will respond to incidents and recommend corrective actions.
Implications for Technology Suppliers and Legacy Systems
Most interesting is that the government intends to eliminate suppliers that are unable or unwilling to adopt these security measures, including systems that operate on premise or in the cloud. In fact it also specifically calls out how legacy systems will be treated.
Potential Impact on Financial Services and Payments
While the Executive Order only applies to Federal Government systems the mandate to implement incident reporting will eventually make its way to financial regulators, and any critical infrastructure participants that are not implementing Multifactor Authentication and the Zero Trust Model will surely face unwanted liabilities and this will certainly include financial infrastructure participants:
“Although every President in recent years has issued an order to improve the nation’s cybersecurity, experts believe this one is more detailed and has a better chance of success than previous efforts. It also comes amidst unprecedented attacks on US government and critical infrastructure, in the form of the SolarWinds, Exchange Server and Colonial Pipeline attacks, to name just a few.
Among the key measures is a requirement for all federal government software suppliers to meet strict rules on cybersecurity or risk being blacklisted. Eventually, the plan is to create an “energy star” label so both government and public buyers can quickly and easily see whether software was developed securely.
Other measures include an “aircrash investigation-style” Cybersecurity Safety Review Board, which will make recommendations for improvements after any major incident, and a standardized playbook for government incident response.
The EO will also mandate a drive to secure cloud services and zero trust, including multi-factor authentication and data encryption at rest and in transit, by default.
There are also provisions for government-wide endpoint detection and response (EDR), improved information sharing within government and between public and private sectors, and event logging requirements for federal government departments to enhance investigation and remediation.”
The executive order represents a shift toward a more proactive and standardized approach to cybersecurity across federal agencies. By emphasizing Zero Trust principles, multifactor authentication, and continuous monitoring, the administration is establishing a framework designed to reduce vulnerabilities and improve the government’s ability to respond to cyber incidents.
For financial institutions and payment service providers, the initiative highlights the growing importance of strengthening authentication and access controls. As financial services become increasingly interconnected through digital platforms, APIs, and third-party technology providers, traditional perimeter-based security approaches may no longer provide sufficient protection against evolving threats.
The order’s focus on software supply chain security also carries important implications for organizations that depend on external technology vendors. Financial institutions may need to evaluate whether their technology partners follow appropriate security practices, maintain effective incident response procedures, and provide sufficient transparency into potential vulnerabilities. These considerations are particularly relevant for legacy systems that may be difficult to integrate with modern security architectures.
Ultimately, the federal government’s cybersecurity initiative could help establish expectations that extend beyond government contractors. Although the executive order does not directly impose its requirements on private financial institutions, its emphasis on accountability, stronger authentication, and coordinated incident response offers a useful model for organizations seeking to protect sensitive financial data and maintain trust in digital payment systems.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group