Skip to content
FedXchange
Menu

The record of federal cyber governance, checked every day

FedXchange keeps every binding rule a federal security program follows, from the Privacy Act of 1974 to this morning's watch, and says what changed and why it matters in plain English. With a free account, it writes the policies that name the tools your agency actually runs.

1October 22, 2026Agency PQC migration plans were due to OMB and the Office of theNational Cyber Director, 120 days after M-26-15.2October 27, 2026NIST published the final IR 8547. M-26-15 requires migration plans toalign with it.3November 17 and 19, 2026Comments close on two FedRAMP requests for comment: RFC-0035(cryptographic module rules) and RFC-0036 (Class D pilot rules).4December 19, 2026180 days after EO 14412: NIST must speed up cryptographic modulevalidation, and the Federal Acquisition Regulation (FAR) Council mustpropose a contractor rule.5January 2, 2030Agencies must support Transport Layer Security (TLS) 1.3 or a laterversion.6December 31, 2030High value assets and high impact systems must use PQC for keyestablishment. After 2030, quantum-vulnerable public-key algorithmsare deprecated.7December 31, 2031High value assets and high impact systems must use PQC for digitalsignatures.8After 2035Quantum-vulnerable public-key algorithms are disallowed under NISTstandards.

Post-quantum deadlines for federal agencies, 2026 to 2035

Read the steps as text
  1. October 22, 2026. Agency PQC migration plans were due to OMB and the Office of the National Cyber Director, 120 days after M-26-15.
  2. October 27, 2026. NIST published the final IR 8547. M-26-15 requires migration plans to align with it.
  3. November 17 and 19, 2026. Comments close on two FedRAMP requests for comment: RFC-0035 (cryptographic module rules) and RFC-0036 (Class D pilot rules).
  4. December 19, 2026. 180 days after EO 14412: NIST must speed up cryptographic module validation, and the Federal Acquisition Regulation (FAR) Council must propose a contractor rule.
  5. January 2, 2030. Agencies must support Transport Layer Security (TLS) 1.3 or a later version.
  6. December 31, 2030. High value assets and high impact systems must use PQC for key establishment. After 2030, quantum-vulnerable public-key algorithms are deprecated.
  7. December 31, 2031. High value assets and high impact systems must use PQC for digital signatures.
  8. After 2035. Quantum-vulnerable public-key algorithms are disallowed under NIST standards.

NIST's final post-quantum transition plan deprecates RSA and elliptic curve cryptography after 2030

· Federal governance

NIST published the final IR 8547 on October 27, 2026. Every quantum-vulnerable public-key algorithm is now deprecated after 2030 and disallowed after 2035, and agencies' high value assets and high impact systems must move sooner: 2030 for key establishment and 2031 for signatures.

Read the analysis

Documents
877
In effect
492
Proposed
41
No longer in effect
344

The record as of November 6, 2026. Open to anyone, with no account.

From the blog: what the record shows

All analysis

The record, open to anyone

FedXchange reads 17 groups of federal sources, most of them every day, and a person reviews what the watch finds before it reaches the record. Nothing here needs an account.
Governance trackerOpen to anyone

Every law, executive order, OMB memorandum, CISA directive, NIST publication, FedRAMP rule, and contract clause that binds a federal security program, from the Privacy Act of 1974 to today, each with its status, its required agency actions, and the source.

Open the governance tracker
Marketplace trackerOpen to anyone

Every FedRAMP Marketplace listing, which agencies use it, and what changed stage this month.

Open the Marketplace tracker
Feeds and a spreadsheetOpen to anyone

Any tracker view as an Atom or JSON feed, or a CSV download, so the record can sit in your own reader or risk register.

Follow the whole record by Atom feed
Newsletter and alertsOpen to anyone

A short email each Friday with what the watch found that week, and an alert on the day it finds something new, if you want one.

Sign up below

What the watch checks, and how often

Then put the record to work: policies that name what your agency actually runs

Most policy templates say “the organization employs an automated tool.” Staff can't follow that, and assessors ask which tool you mean. FedXchange reads your agency's FedRAMP Marketplace authorizations, suggests a service for each of 18 security functions, and writes 92 plain-language policies, procedures, and plans that name the services and titles you confirm.

Works todayFree account

  1. Step 1: Name your agency

    FedXchange finds the cloud products your agency has authorized on the FedRAMP Marketplace and suggests one for each security function, such as identity management or vulnerability scanning.

    How we pick each suggested service

  2. Step 2: Confirm your choices

    Confirm a service for each of 18 functions, including services the government runs, and set your own titles for 50 offices and roles.

    See the functions

  3. Step 3: Get your documents

    FedXchange writes 92 policies, procedures, and plans that name what you confirmed. Download each one as a Word file.

    How the documents are made

  4. Step 4: Stay current

    The governance watch checks federal sources every day and tells you which of your documents a change touches.

    What the watch checks

Sign up free and write your documentsHow the documents are made

Suggested services

Example

  • Identity provider

    Your authorization

    Matched to your Marketplace authorization

  • SIEM and log management

    Your platform

    Covered by your cloud platform's authorization

  • Vulnerability disclosure

    Shared service

    CISA Vulnerability Disclosure Policy Platform

  • Learning management

    Generic name until you choose

    “the learning management system”

Nothing is used until you confirm it.How we pick each suggested service

Incident Response Plan, section 4

Example

The Security Operations Center watches alerts from your log management service around the clock.

When an alert may be an incident, the analyst opens a ticket in your ticketing service and tells the Information System Security Officer within one hour.

The highlighted words come from your answers: the services you confirmed and the titles your agency uses.

92 documents, written in plain language

34 policies · 33 procedures · 13 plans · 12 templates, rules of behavior, and references

  • Information Security Program Plan
  • Incident Response Plan
  • Information Security Continuous Monitoring (ISCM) Strategy
  • Post-Quantum Cryptography Migration Plan
  • Rules of Behavior — Privileged Users
  • and 87 more
  • Your names, not placeholders. Where a template says “the organization employs an automated tool,” yours names the service you confirmed and the office that runs it.
  • Every real option, side by side. For each function, FedXchange lists the FedRAMP Marketplace products that fit it (165 listings in all, as of November 6, 2026), your agency's own first, and the 9 services the government runs itself in 8 of the 18 functions, which never appear among your authorizations. See the functions and the shared services
  • Checked before you see them. Each document cites the federal sources it rests on and passes a fixed series of checks, from source currency to a review board of 16 reviewer roles. They are drafts: nothing is final until a person at your agency approves it.
  • Word files you can edit, written again when you change an answer. Each comes with your agency's cover and a filled table of contents. Pick a new service or retitle an office, and the next draft says so everywhere it matters.
  • No AI writes them. A fixed generator writes every document, so the same answers always give the same text. Your own AI assistant can connect over the Model Context Protocol to review suggestions and record choices; every change waits for your yes. How assistants connect
  • Coming nextDrafted updates: when a source changes, FedXchange proposes new wording for a person to approve.

Get what changed in the record by email

Each Friday, a short email lists what the watch found that week: new documents, changes in status, and comment deadlines, and, if you follow the Marketplace tracker, products that changed stage on the FedRAMP Marketplace. Add instant alerts if you want them. No account needed, and a one-click unsubscribe.

Sign up

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me
About

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.

Who runs FedXchange

Free to use. FedXchange is built by Varry LLC, which also makes RMF Coach, hands-on courses and an authorization simulation for learning NIST RMF and FedRAMP.

Start with the record. Write your policy set when you're ready.

The trackers, feeds, and newsletter need no account. Anyone can sign up free with a work email or Google account.

Open the governance trackerSign up free