President Trump’s Cyber Strategy for America

• Authority: Executive Office of the President
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2026-03-06

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Competitive dynamics

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• False or misleading information
• Pollution of information ecosystem
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2, 4.3), AI system security (2.2), competitive dynamics (6.4), and misinformation (3.1). Coverage is concentrated in security, cyber threats, and adversarial AI use domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

The strategy governs cybersecurity and AI security across multiple critical sectors including Information (telecommunications, data centers), Finance and Insurance (banking systems), Health Care (hospitals), Trade, Transportation and Utilities (energy grid, water utilities), Public Administration (federal networks), and National Security (military and intelligence systems). The document takes a whole-of-government and whole-of-nation approach to cyber defense.

Legislative Status

Other

Legislative Status Summary

This is an executive strategy document that outlines policy vision and priorities for cybersecurity and AI security, but does not create binding legal obligations, enforcement mechanisms, or penalties. It uses declarative future-tense language ('will') rather than mandatory legal language ('shall', 'must'), and functions as a strategic framework to guide administration actions rather than enforceable law.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is authored by the Executive Office of the President and repeatedly references decisions and actions by President Trump and his Administration. It is presented as the official cyber strategy of the Trump Administration.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer, AI_Infrastructure_Provider, Affected_Stakeholder
• Summary: The strategy applies broadly to federal government networks and systems, private sector partners in critical infrastructure, and aims to shape behavior of adversaries. It explicitly mentions coordination across government, industry, and academia.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document describes U.S. government enforcement actions including offensive cyber operations, sanctions, and disruption of adversary networks, though specific enforcement agencies are not named in this strategic document.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The document references monitoring and testing of federal networks and ongoing assessment of threats, though specific monitoring bodies are not explicitly identified in this high-level strategy document.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document addresses multiple lifecycle stages with primary focus on deployment and operation/monitoring of AI-enabled cybersecurity tools. It emphasizes securing AI systems from design through deployment and ongoing monitoring. The strategy covers building and using AI models for cyber defense, deploying AI-powered solutions, and operating/monitoring federal networks with AI tools.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions AI systems, AI models, generative AI, and agentic AI. It references the AI technology stack including data centers and infrastructure. There is no explicit mention of frontier AI, GPAI, foundation models, task-specific AI, predictive AI, compute thresholds, or open-weight models.