To expand upon that, the hard part is that every agency has a unique IT infrastructure (sometimes multiple infrastructures in a single organization) and budgets

To expand upon that, the hard part is that every agency has a unique IT infrastructure (sometimes multiple infrastructures in a single organization) and budgets that vary wildly. It's not a one size fits all approach across the whole government. The important part of the EO is the section 3.d.i, which says that every 60 days, until MFA is fully adopted, the agencies will report to DHS their plan and progress for implementing MFA. So basically, they can take longer then 180 days, but they need to be transparent about their plan and the roadblocks they are hitting in doing so.