Part 1 – The Trump Administration’s Cybersecurity Priorities for CUI: What’s Changing and What’s Staying the Same

As President Donald Trump returns to the White House in 2025, cybersecurity remains a top priority—especially protecting Controlled Unclassified Information (CUI). Unlike some policy areas that see major shifts during a presidential transition, cybersecurity has proven to be a bipartisan concern, with both parties recognizing the urgency of securing sensitive but unclassified government data.

A Strong but Steady Approach to Cybersecurity

In the early weeks of the new administration, Trump’s team largely maintained existing federal cybersecurity policies rather than dismantled them. Key executive orders issued under President Biden—like the landmark EO 14144, which strengthened cybersecurity measures across federal agencies and contractors—are still in effect. This continuity reflects a shared understanding across administrations that cyber threats are growing, particularly from foreign adversaries like China, and that stronger security measures are essential to national security.

Administration officials have stressed a “hand in glove” approach, indicating that while there may be some policy refinements, the overall mission of securing America’s digital infrastructure remains unchanged.

What’s Staying and What’s Evolving?

One major area of focus is strengthening the security of federal contractors and supply chains, particularly those handling CUI. Under Biden’s executive orders, agencies like the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) were directed to develop stricter cybersecurity standards. Federal contractors are now expected to meet tougher security requirements, including:

✅ Stronger encryption for CUI (both in transit and at rest)
✅ Enhanced access controls to ensure only authorized personnel can handle CUI
✅ Faster response times to cyber incidents, with some rules requiring reporting within hours

Early signs suggest that the Trump administration is on board with these measures, seeing them as critical components of a stronger national security stance. National Security Advisor, Mike Waltz, reaffirmed during the transition that countering cyber threats and protecting sensitive government data remain high-priority issues.

Regulatory Freeze: A Routine Reset or a Shift in Cyber Strategy?

As is common with new administrations, President Trump paused many pending regulations on January 20, 2025, for review—including a major new rule related to CUI security in federal contracting (which we’ll dive into in Part 2). While this regulatory freeze mirrors past transitions, it signals that the administration is looking closely at cybersecurity mandates to ensure they align with Trump’s broader policies on reducing regulatory burdens.

That said, officials have hinted that truly critical cybersecurity initiatives will move forward after review, suggesting that while some details may change, the overarching goal of strengthening cyber defenses will not be compromised.

Shifts in Cybersecurity Oversight: The DHS Reshuffle

One of the more unexpected early moves came from the Department of Homeland Security (DHS), where the acting DHS Secretary disbanded all current advisory committees on day one—including the Cyber Safety Review Board (CSRB).

The CSRB, created in 2021, had played a key role in reviewing major cyber incidents and bringing together government officials and private-sector experts. While it’s unclear whether the board will be restructured or replaced, this move suggests a potential shift in how the administration handles cybersecurity oversight—perhaps opting for a more centralized, government-led approach rather than relying on advisory committees.

What’s Next?

So far, the Trump administration has signaled stability and vigilance in cybersecurity policy. By upholding key executive orders and reinforcing higher security standards for federal contractors, the administration is setting the stage for a more resilient cyber strategy. At the same time, policy reviews and regulatory pauses indicate a careful evaluation of how cybersecurity mandates align with broader administration goals.

The big question now is: How will these priorities translate into concrete policies and enforcement measures?

In the next part of our series, we’ll break down the emerging legislative and regulatory developments shaping CUI security under the new administration—and what organizations need to do to stay ahead of these changes. Stay tuned.

References

1. Gibson Dunn – “Two Weeks In: Key Trump Administration Developments in Tech Policy” (February 2025)​
2. Foley & Lardner – “Cybersecurity Executive Order — Key Implications for the Manufacturing Industry” (Jan 24, 2025)​
3. Crowell & Moring – “Cyber For All: Proposed Rule Introduces Government-Wide CUI Cybersecurity Requirements” (Jan 17, 2025)​
4. Gibson Dunn – Discussion of FAR CUI Proposed Rule​
5. Breaking Defense – “CMMC 2.0 and the possibility of a cyber service: 2025 preview” (Jan 3, 2025)​
6. Crowell & Moring – “NIST SP 800-171 Rev. 3 Released” (May 14, 2024)​
7. NeoSystems – “3 Critical Cybersecurity Gaps Affecting GovCons” (2023)​
8. Solutions Review – “74 Cybersecurity Predictions… for 2025” (Dec 2024)​
9. Summit 7 – “CUI: The Complete Guide to Controlled Unclassified Information” (2023)​
10. Cuick Trac – “GovCloud vs. Secure File Transfer vs. CUI Enclave” (2022)​