In the absence of enacted legislation, the Obama Administration began drafting a cybersecurity executive order in 2012. On February 12, 2013, President Obama issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity , along with Presidential Policy Directive 21 (PPD 21), Critical Infrastructure Security and Resilience . E.O. 13636 attempts to address both of those issues, as well as others. It uses existing statutory and constitutional authority to 
expand information sharing and collaboration between the government and the private sector, including sharing classified information by broadening a program developed for the defense industrial base to other CI sectors; develop a voluntary framework of cybersecurity standards and best practices for protecting CI, through a public/private effort; establish a consultative process for improving CI cybersecurity; identify CI with especially high priority for protection, using the consultative process; establish a program with incentives for voluntary adoption of the framework by CI owners and operators; review cybersecurity regulatory requirements to determine if they are sufficient and appropriate; and incorporate privacy and civil liberties protections in activities under the order. E.O. 13636 builds on the involvement of the National Institute of Standards and Technology (NIST) in the development of cybersecurity technical standards and its statutory responsibilities to work with both government and private entities on various aspects of standards and technology. The executive order stipulates that it provides no authority for regulating critical infrastructure in addition to that under existing law, and it does not alter existing authority. The Secretary of Homeland Security is required to establish a broad consultative process to coordinate improvements in the cybersecurity of critical infrastructure. That issue is discussed below. The issuance of an executive order frequently raises questions about whether the order exceeds the scope of the President's authority, in relation to the constitutional separation of powers and validly enacted legislation. E.O. 13636 mainly addresses two of those topics: information sharing and protection of privately held CI. With respect to information sharing, the executive order does not provide exemptions from liability stemming from information sharing, which would require changes to current law. Several of the legislative proposals included such changes. With respect to protection of critical infrastructure, the provisions on designation of CI and identification of relevant regulations are related to those in some legislative proposals in the 112 th Congress. The role of NIST in developing the Cybersecurity Framework was not in the legislative proposals from that Congress, although several would have expanded the agency's role in cybersecurity. Reactions to the Executive Order

Given the absence of enacted comprehensive cybersecurity legislation, some security observers have contended that the executive order is a necessary step in securing vital assets against cyberthreats. Common themes by such critics have included the following claims:
The order offers little more than do existing processes. The order could make enactment of legislation less likely. Another concern of some is that the executive order could lead to government intrusiveness into private-sector activities, for example through increased regulation under existing statutory authority, while others contend that voluntary measures have a poor history of success. It appears to be too early in the implementation of the executive order to determine how effectively the concerns described above will be addressed and whether the responses will satisfy critics and skeptics.
The federal role in cybersecurity has been a topic of discussion and debate for over a decade. Despite significant legislative efforts in the 112th Congress on bills designed to improve the cybersecurity of U.S. critical infrastructure (CI), no legislation on that issue was enacted in that Congress. In an effort to address the issue in the absence of enacted legislation, the White House issued an executive order in February 2013. Citing repeated cyber-intrusions into critical infrastructure and growing cyberthreats, Executive Order 13636, Improving Critical Infrastructure Cybersecurity, was an attempt to enhance security and resiliency of CI through voluntary, collaborative efforts involving federal agencies and owners and operators of privately owned CI, as well as use of existing federal regulatory authorities.
Entities posing a significant threat to the cybersecurity of CI assets include cyberterrorists, cyberspies, cyberthieves, cyberwarriors, and cyberhacktivists. E.O. 13636 has attempted to address such threats by, among other things,
expanding to other CI sectors an existing Department of Homeland Security (DHS) program for information sharing and collaboration between the government and the private sector; establishing a broadly consultative process for identifying CI with especially high priority for protection; requiring the National Institute of Standards and Technology (NIST) to lead in developing a cybersecurity framework of standards and best practices for protecting CI; and directing regulatory agencies to determine the adequacy of existing requirements and their authority to establish additional ones to address the risks.
Among the major issues covered by the unenacted legislative proposals in the 112th Congress, E.O. 13636 mainly addresses two: information sharing and protection of privately held critical infrastructure. It does not provide exemptions from liability stemming from information sharing, which would require changes to current law. Several of the legislative proposals included such changes. With respect to protection of critical infrastructure, the provisions on designation of CI and identification of relevant regulations are related to those in some legislative proposals.
In the 113th Congress, some bills would provide explicit statutory authority for information-sharing along the lines of some bills in the 112th Congress. Others would authorize activities on developing a cybersecurity framework similar to those in the executive order.
The issuance of E.O. 13636, as with many other executive orders, raises questions about whether the order exceeds the scope of the President's authority, in relation to the constitutional separation of powers and validly enacted legislation. While answers to those questions are complex, the executive order specifies that implementation will be consistent with applicable law and that nothing in the order provides regulatory authority to an agency beyond that under existing law.
Overall, response to the executive order has been optimistic. Given the absence of comprehensive cybersecurity legislation, some security observers contend that the order is a necessary step in securing vital assets against cyberthreats. Others have argued, in contrast, that it offers little more than do existing processes, that it could make enactment of a bill less likely, or that it could lead to government intrusiveness into private-sector activities, for example through increased regulation under existing statutory authority. Despite considerable progress in meeting the specific objectives in the executive order, especially the NIST Framework, it still appears to be too early in the implementation of the order to determine whether such concerns will be addressed to the satisfaction of critics and skeptics.