Skip to content
FedXchange
Menu

The record of federal cyber governance, checked every day

FedXchange keeps every binding rule a federal security program follows, from the Privacy Act of 1974 to this morning's watch, and says what changed and why it matters in plain English. With a free account, it writes the policies that name the tools your agency actually runs.

1December 1 to 10, 2026FedRAMP sends the emergency test that asks for each service'sprogress report. Its current target is December 3.2December 7, 2026The VDR and VER rules take effect. A service that has not fullymigrated must give a corrective action for each rule, with targetdates.3December 17, 2026, 2pm EasternThe likely deadline for answers, sent through a web form.4A missed replyFedRAMP labels the service In Remediation for at least 30 days andnotes the failure on its Marketplace page. Every agency customer isnotified. The provider then has 30 days to send the information and acorrective action plan, or FedRAMP revokes its certification.5Plans that end after February 3, 2027The service shows as "FedRAMP Certified (In Remediation)" until ittells FedRAMP its migration is done.6March 7, 2027The grace period ends. A later finish needs a FedRAMP-approved planand a red team assessment coordinated by FedRAMP.7March 8, 2027A service not fully migrated and without an approved plan loses itscertification and is banned for one year.

What Notice 0017 sets, from the December test to March 8, 2027

Read the steps as text
  1. December 1 to 10, 2026. FedRAMP sends the emergency test that asks for each service's progress report. Its current target is December 3.
  2. December 7, 2026. The VDR and VER rules take effect. A service that has not fully migrated must give a corrective action for each rule, with target dates.
  3. December 17, 2026, 2pm Eastern. The likely deadline for answers, sent through a web form.
  4. A missed reply. FedRAMP labels the service In Remediation for at least 30 days and notes the failure on its Marketplace page. Every agency customer is notified. The provider then has 30 days to send the information and a corrective action plan, or FedRAMP revokes its certification.
  5. Plans that end after February 3, 2027. The service shows as "FedRAMP Certified (In Remediation)" until it tells FedRAMP its migration is done.
  6. March 7, 2027. The grace period ends. A later finish needs a FedRAMP-approved plan and a red team assessment coordinated by FedRAMP.
  7. March 8, 2027. A service not fully migrated and without an approved plan loses its certification and is banned for one year.

FedRAMP Notice 0017 puts VDR and VER enforcement in writing: an In Remediation label, agency notices, and a cutoff for new Rev5 applications

· FedRAMP

Notice 0017 sets a likely December 17 deadline for VDR and VER progress reports. A missed reply puts the service In Remediation, and its agency customers are notified. A service not fully migrated and with no approved plan on March 8, 2027, loses its FedRAMP Certification.

Read the analysis

Documents
898
In effect
492
Proposed
41
No longer in effect
365

The record as of November 12, 2026. Open to anyone, with no account.

How federal security governance fits together

Laws and White House direction set the requirements. Standards say how to meet them, named roles own the risk, and daily controls do the work. Evidence from that work goes back up to the people who answer for it.
How federal security governance fits together: law and policy set the requirements, standards and named roles shape how they are met, daily controls do the work, and evidence flows back to the people who answer for it.SecurityFISMA 2014FITARAClinger-Cohen ActPrivacyPrivacy Act of 1974E-Gov Act §208 PIAsCloudFedRAMP Authorization Act(FY 2023 NDAA)White HouseEO 14028, as amendedNSM-10 (quantum)OMBCircular A-130M-22-09 Zero trustM-21-31 LoggingFISMA reporting memoCISABOD 22-01 KEVBOD 23-01 AssetsBOD 25-01 CloudEmergency DirectivesStatutesExecutive directionLaw & policyRisk managementSP 800-37 RMFSP 800-53 Rev 5FIPS 199 and 200FrameworksNIST CSF 2.0CISA Zero TrustMaturity Model 2.0Identity & cryptoSP 800-63-4FIPS 140-3 modulesFIPS 203–205 (PQC)Cloud & dataFedRAMP Rev 5FedRAMP 20xSP 800-171 (CUI)Standards & frameworksAgency leadersAgency headCIOCISORisk ownersAuthorizing OfficialRisk executiveSenior privacy officialSystem levelSystem ownerISSM and ISSOCommon control providerOversightOMB and CISAInspector GeneralGAO and CongressRoles & accountabilityATO & authorizationRMF steps in SP 800-37Authorizing Official signs offAsset inventoryCDM dashboardsBOD 23-01 discovery cyclesIdentity & accessPIV and phishing-resistant MFALeast privilegeLogging & detectionM-21-31 event logging tiersCentral log retentionVulnerability managementKEV remediation deadlinesAuthenticated scanningSecure configurationHardened baselinesSCuBA for cloud (BOD 25-01)Continuous monitoringOngoing authorizationPOA&M tracking to closureSecurity trainingAnnual awareness for all staffRole-based trainingEncryptionFIPS 140-3 validated modulesPost-quantum migration planSupply chain riskVendor and SBOM reviewsFASCSA ordersIncident responseReport to CISA within one hourPlaybooks and exercisesFISMA reportingQuarterly CIO metricsAnnual IG evaluationControls in operationThe map ofFederal CISOGovernance
Filled dots: requirements going outHollow dots: evidence coming back
Read the map as a list

Law and policy set the requirements

  • Laws passed by Congress: the Federal Information Security Modernization Act of 2014 (FISMA), the Federal IT Acquisition Reform Act (FITARA), the Clinger-Cohen Act, the Privacy Act of 1974, section 208 of the E-Government Act (privacy impact assessments), and the FedRAMP Authorization Act in the 2023 National Defense Authorization Act
  • White House direction: Executive Order 14028 as amended, and National Security Memorandum 10 on quantum computing
  • Office of Management and Budget (OMB): Circular A-130, memorandum M-22-09 on zero trust, memorandum M-21-31 on event logging, and the yearly FISMA reporting memorandum
  • Cybersecurity and Infrastructure Security Agency (CISA): Binding Operational Directive 22-01 on known exploited vulnerabilities, 23-01 on asset visibility, 25-01 on cloud configuration, and Emergency Directives

Standards and frameworks say how to meet them

  • Risk management: the Risk Management Framework from the National Institute of Standards and Technology (NIST) in Special Publication (SP) 800-37, the security controls in SP 800-53 Revision 5, and Federal Information Processing Standards (FIPS) 199 and 200
  • Frameworks: the NIST Cybersecurity Framework 2.0 and the CISA Zero Trust Maturity Model 2.0
  • Identity and cryptography: the digital identity guidelines in SP 800-63-4, validated encryption modules under FIPS 140-3, and the post-quantum standards FIPS 203, 204, and 205
  • Cloud and data: the Federal Risk and Authorization Management Program (FedRAMP) Revision 5 baselines, FedRAMP 20x, and SP 800-171 for controlled unclassified information

Named roles own the risk

  • Agency leaders: the agency head, the Chief Information Officer (CIO), and the Chief Information Security Officer (CISO)
  • Risk owners: the Authorizing Official, the risk executive, and the senior agency official for privacy
  • System level: the system owner, the Information System Security Manager and Officer, and common control providers
  • Oversight: OMB and CISA, the Inspector General, the Government Accountability Office, and Congress

Controls do the daily work, and evidence flows back up

  • Authorization to operate: the Risk Management Framework steps in SP 800-37, ending when the Authorizing Official signs off
  • Asset inventory: Continuous Diagnostics and Mitigation (CDM) dashboards and the discovery cycles in Binding Operational Directive 23-01
  • Identity and access: Personal Identity Verification (PIV) cards, multi-factor authentication (MFA) that resists phishing, and least privilege
  • Logging and detection: the event logging tiers in memorandum M-21-31 and central log retention
  • Vulnerability management: deadlines to fix known exploited vulnerabilities (KEV) and authenticated scanning
  • Secure configuration: hardened baselines, and CISA's Secure Cloud Business Applications (SCuBA) settings under Binding Operational Directive 25-01
  • Continuous monitoring: ongoing authorization, and tracking each plan of action and milestones (POA&M) item until it is closed
  • Security training: yearly awareness training for all staff and role-based training
  • Encryption: encryption modules validated under FIPS 140-3 and a plan to move to post-quantum cryptography
  • Supply chain risk: reviews of vendors and their software bills of materials (SBOMs), and orders under the Federal Acquisition Supply Chain Security Act (FASCSA)
  • Incident response: reporting incidents to CISA within one hour, with playbooks and exercises
  • FISMA reporting: the Chief Information Officer's quarterly metrics and the Inspector General's yearly evaluation

From the blog: what the record shows

All analysis

The record, open to anyone

FedXchange reads 18 groups of federal sources, most of them every day, and a person reviews what the watch finds before it reaches the record. Nothing here needs an account.
Governance trackerOpen to anyone

Every law, executive order, OMB memorandum, CISA directive, NIST publication, FedRAMP rule, and contract clause that binds a federal security program, from the Privacy Act of 1974 to today, each with its status, its required agency actions, and the source.

Open the governance tracker
Marketplace trackerOpen to anyone

Every FedRAMP Marketplace listing, which agencies use it, and what changed stage this month.

Open the Marketplace tracker
Feeds and a spreadsheetOpen to anyone

Any tracker view as an Atom or JSON feed, or a CSV download, so the record can sit in your own reader or risk register.

Follow the whole record by Atom feed
Newsletter and alertsOpen to anyone

A short email each Friday with what the watch found that week, and an alert on the day it finds something new, if you want one.

Sign up below

What the watch checks, and how often

Then put the record to work: policies that name what your agency actually runs

Most policy templates say “the organization employs an automated tool.” Staff can't follow that, and assessors ask which tool you mean. FedXchange reads your agency's FedRAMP Marketplace authorizations, suggests a service for each of 18 security functions, and writes 92 plain-language policies, procedures, and plans that name the services and titles you confirm.

Works todayFree account

  1. Step 1: Name your agency

    FedXchange finds the cloud products your agency has authorized on the FedRAMP Marketplace and suggests one for each security function, such as identity management or vulnerability scanning.

    How we pick each suggested service

  2. Step 2: Confirm your choices

    Confirm a service for each of 18 functions, including services the government runs, and set your own titles for 50 offices and roles.

    See the functions

  3. Step 3: Get your documents

    FedXchange writes 92 policies, procedures, and plans that name what you confirmed. Download each one as a Word file.

    How the documents are made

  4. Step 4: Stay current

    The governance watch checks federal sources every day and tells you which of your documents a change touches.

    What the watch checks

Sign up free and write your documentsHow the documents are made

Suggested services

Example

  • Identity provider

    Your authorization

    Matched to your Marketplace authorization

  • SIEM and log management

    Your platform

    Covered by your cloud platform's authorization

  • Vulnerability disclosure

    Shared service

    CISA Vulnerability Disclosure Policy Platform

  • Learning management

    Generic name until you choose

    “the learning management system”

Nothing is used until you confirm it.How we pick each suggested service

Incident Response Plan, section 4

Example

The Security Operations Center watches alerts from your log management service around the clock.

When an alert may be an incident, the analyst opens a ticket in your ticketing service and tells the Information System Security Officer within one hour.

The highlighted words come from your answers: the services you confirmed and the titles your agency uses.

92 documents, written in plain language

34 policies · 33 procedures · 13 plans · 12 templates, rules of behavior, and references

  • Information Security Program Plan
  • Incident Response Plan
  • Information Security Continuous Monitoring (ISCM) Strategy
  • Post-Quantum Cryptography Migration Plan
  • Rules of Behavior — Privileged Users
  • and 87 more
  • Your names, not placeholders. Where a template says “the organization employs an automated tool,” yours names the service you confirmed and the office that runs it.
  • Every real option, side by side. For each function, FedXchange lists the FedRAMP Marketplace products that fit it (165 listings in all, as of November 12, 2026), your agency's own first, and the 9 services the government runs itself in 8 of the 18 functions, which never appear among your authorizations. See the functions and the shared services
  • Checked before you see them. Each document cites the federal sources it rests on and passes a fixed series of checks, from source currency to a review board of 16 reviewer roles. They are drafts: nothing is final until a person at your agency approves it.
  • Word files you can edit, written again when you change an answer. Each comes with your agency's cover and a filled table of contents. Pick a new service or retitle an office, and the next draft says so everywhere it matters.
  • No AI writes them. A fixed generator writes every document, so the same answers always give the same text. Your own AI assistant can connect over the Model Context Protocol to review suggestions and record choices; every change waits for your yes. How assistants connect
  • Coming nextDrafted updates: when a source changes, FedXchange proposes new wording for a person to approve.

Get what changed in the record by email

Each Friday, a short email lists what the watch found that week: new documents, changes in status, and comment deadlines, and, if you follow the Marketplace tracker, products that changed stage on the FedRAMP Marketplace. Add instant alerts if you want them. No account needed, and a one-click unsubscribe.

Sign up

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me
About

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.

Who runs FedXchange

Free to use. FedXchange is built by Varry LLC, which also makes RMF Coach, hands-on courses and an authorization simulation for learning NIST RMF and FedRAMP.

Start with the record. Write your policy set when you're ready.

The trackers, feeds, and newsletter need no account. Anyone can sign up free with a work email or Google account.

Open the governance trackerSign up free