Federal cyber governance is changing faster than agencies can absorb it

In 2016 an agency CISO tracked a FISMA memo each fall, a directive or two from DHS, a NIST revision every few years, and the occasional executive order. In 2026 the same CISO tracks all of that, plus a FedRAMP rule change most weeks, a new patching clock from the Known Exploited Vulnerabilities catalog most working days, four presidential cyber actions in sixteen weeks, and the busiest year on record for notices from the National Archives' Information Security Oversight Office, three of them on CUI.

We counted the governance that binds federal civilian agencies, by source and by year, from 2015 through October 17, 2026. Three things are true at once. The traditional sources are producing at roughly their historical pace. The items they produce now rewrite whole programs rather than adjust them. And one new source, FedRAMP's rulemaking, has by itself doubled the annual total.

Key insights

• Binding items more than doubled. Excluding NIST publications and KEV entries, agencies received 58 binding or quasi-binding items from 2015 through 2020 and 131 from 2021 through October 17, 2026. The annual count ran between 6 and 14 for a decade, then 32 in 2025 and 53 so far in 2026.
• FedRAMP is now the most prolific issuer. Zero public rulemaking items before 2025; 52 requests for comment and notices since, more than OMB, CISA directives, executive orders, and statutes combined over the same period. Take FedRAMP out and 2026 is within sight of 2016.
• The big 2026 memos and directives are rewrites. Logging (M-26-14), software assurance (M-26-05), post-quantum cryptography (M-26-15 and EO 14412), vulnerability management (BOD 26-04), and edge devices (BOD 26-02) each replace an existing program with a new design and new deadlines.
• More than a quarter of the governance in force today is less than two years old. Of the 169 sources in FedXchange's governance corpus, 44 were issued in 2025 or 2026.
• The next ten months are the heaviest stretch. PQC migration plans, a new 3-to-60-day patching regime, FedRAMP's rules becoming mandatory, logging maturity milestones, and edge-device decommissioning all land between October 2026 and August 2027.

The combined picture

We counted by the calendar year of issue. "Binding or quasi-binding" means a civilian agency must act on it or document why not: CISA Binding Operational and Emergency Directives; OMB memos on cybersecurity, privacy, identity, software supply chain, FISMA, FedRAMP, AI governance, or IT oversight; executive orders and national security memoranda on cybersecurity; statutes; FedRAMP requests for comment and public notices; and a small "other" category (CUI rules, FAR cyber rules, CISA guidance agencies must adopt). NIST publications and KEV entries are discussed separately because their volume would swamp the chart.

The step change in 2025 is almost entirely the FedRAMP band. Without FedRAMP, 2025 is 14 items and 2026 is 19: high, but within sight of 2016 and 2021. With FedRAMP, the total has never been close.

That is not a reason to discount it. Until 2025 FedRAMP changed its requirements through a handful of events: the 2011 OMB memo, the 2012 launch, the Rev4 baselines in 2014, the Rev5 baselines in 2023, and OMB's M-24-15 in 2024. In March 2025 it moved to rolling public requests for comment, in February 2026 it added numbered notices, and in June 2026 it published a rulebook of about 245 rules across 17 rulesets that is edited through a changelog between notices. FedRAMP says the 2026 rules expire no later than December 31, 2028 and that providers will move to "the 2027 or 2028 Consolidated Rules," which is an annual rulebook in all but name. For an agency, FedRAMP changed from an occasional event to a continuous feed: 34 items in the first 41 weeks of 2026, close to one a week. Our earlier article on the risk shift to agencies covers what those rules do.

Flat counts, heavier items

The traditional sources tell a different story from FedRAMP: the pace is steady, the weight is not.

OMB has issued between three and seven qualifying memos every year since 2015. The 2026 set is six, and four of them replace a program. M-26-05 (January) rescinded the secure-software attestation memos and made the CISA attestation form optional. M-26-14 (May) rescinded M-21-31 and set a five-level logging maturity model with deadlines through mid-2027. M-26-15 (June) laid out a post-quantum migration through 2035 and required a plan from every civilian agency in October 2026. M-26-10 (March) put CFO Act agency CIOs on monthly contract reporting. The annual FISMA guidance memo, issued nearly every year since 2001, had not appeared on OMB's 2026 list by October 17.

CISA directives have run at three a year since 2024, against a peak of five in 2020 and 2021. But BOD 22-01 (2021) gave agencies a fixed window per KEV entry; BOD 26-04 (June 10, 2026) revokes it and BOD 19-02 and replaces them with four-factor windows of 3 to 60 days, in full effect December 7, 2026. BOD 26-02 (February 2026) is a two-year edge-device program with milestones through February 2028. Those are standing programs, not patch orders.

Presidential actions have averaged about one a year since 2001. In 2026 there were four in sixteen weeks: EO 14390 (cybercrime), EO 14409 (AI and cyber defense, which ordered CISA to issue directives within 30 days), NSPM-12 (national security systems, rescinding a 1990 directive and a 2022 memorandum), and EO 14412, which sets multi-year system-level dates for civilian agencies: post-quantum key establishment on high-value assets and high-impact systems by December 31, 2030, and PQC signatures by December 31, 2031.

Congress is the quiet source. FISMA 2014, FITARA 2014, and the FedRAMP Authorization Act of 2022 are the statutory base, and FISMA reform bills failed in 2021, 2022, and 2024. The 2025 and 2026 entries are the FY2026 NDAA and three short-term extensions of the Cybersecurity Information Sharing Act of 2015, which now expires December 11, 2026.

NIST published roughly 4 to 16 final SP 800 documents a year over the period (a lower bound; the public index omits superseded documents). What binds an agency is narrower: SP 800-53 Release 5.2.0 (August 2025), SP 800-63-4 (July 2025), SP 800-61 Rev 3 (April 2025), and SP 800-18 Rev 2 (June 30, 2026), which rewrote system security plans around RMF tasks and machine-readable formats. NIST lists no date for SP 800-53 Rev 6 or SP 800-37 Rev 3.

The National Archives issued zero to three ISOO notices a year from 2016 through 2025 and nine in 2026, including the first notice on using AI tools with CUI (March 30) and two September 2 notices, one directing agencies to give contractors clearer CUI requirements and one tightening waiver oversight. The FAR CUI rule was re-proposed June 23, 2026, pinned to SP 800-171 Rev 3, and is not final.

Much of this is replacement rather than addition. M-26-05 replaced two memos; M-26-14 replaced one; BOD 26-04 revoked two directives; CISA retired ten emergency directives in one announcement in January 2026. Counting items overstates net obligations. It is about right as a count of programs an agency has to re-plan.

A quarter of what you comply with is less than two years old

Issuance tells you how fast rules are written. The age of the rules in force tells you how much of an agency's documentation is stale. FedXchange maintains a corpus of the governance sources that currently bind a civilian agency security program, 169 documents from the Privacy Act of 1974 to the September 2026 ISOO notices, with superseded documents removed as they are replaced.

Forty-four of the 169, more than a quarter, were issued in 2025 or 2026. The 2016 spike is the last comparable event: the Circular A-130 rewrite, the CUI rule, a run of OMB memos, and three directives in one year, which agencies spent the next several years absorbing. The current spike is larger and still running.

The practical meaning: a policy, procedure, or system security plan that cites M-21-31 for logging, BOD 22-01 for patching, or M-22-18 for software attestation is citing something that no longer exists, and one that cites a cloud provider's Customer Responsibility Matrix is citing a document FedRAMP has retired. Agency document sets written in the last five years commonly cite all four.

What is coming

Four of these matter most.

Post-quantum cryptography moved from inventory to deadline. NSM-10 (2022) and M-23-02 asked for annual cryptographic inventories against a 2035 national goal. EO 14412 and M-26-15 set 2030 and 2031 dates for high-value assets, require migration leads and plans now, and direct FAR rules that push the same dates onto contractors. For most agencies this is the largest multi-year engineering program on the list.

Patching gets a new clock on December 7. BOD 26-04 is the first binding operational directive since BOD 22-01 to change the general remediation clock: 3 days for exposed, automatable, full-control vulnerabilities and risk-based windows for the rest. The KEV catalog, which feeds it, has added 245 entries in 2025 and 264 so far in 2026. Agencies whose metrics and tooling were built around BOD 22-01's two-week window have seven weeks.

FedRAMP's agency rules become mandatory January 1, with the agency ruleset still marked "Placeholder." From that date agencies must review each cloud provider's quarterly Ongoing Certification Report, must have tooling that ingests machine-readable evidence, must not ask providers for more than FedRAMP requires without an agency-head finding, and, under notice NTC-0012, report provider incidents to CISA themselves. FedRAMP has also told agencies not to contact certified providers individually about CISA directives; FedRAMP relays them.

The slipping items should not drive 2026 planning. CIRCIA's final rule missed its statutory deadline and two announced targets. The FAR CUI rule has been proposed twice and finalized never. SP 800-53 Rev 6, SP 800-37 Rev 3, and FISMA reform have no dates. Plan 800-171 Rev 3 alignment for CUI systems anyway, because the ISOO notices already point there, but do not sequence this year's work around rules that may arrive in 2028.

What this does to agencies

The sources multiplied faster than the people reading them. In 2016 an agency security office could cover OMB, DHS, NIST, and its Inspector General. In 2026 it must also read FedRAMP's RFC tracker, changelog, and notices, the Archives' notices, the Federal Register for FAR proposals, and the KEV feed daily. FedRAMP's own staff shrank by more than half in two years, by its own October 2026 account, while its output went from zero to 52 items, and its security director said the same month that people are "googling, or they're relying on past advice." Agency security offices are not larger than they were.

Oversight lags the rules. The Inspector General community's March 2026 cloud best practices still audit to periodic control assessments and POA&Ms and describe FedRAMP 20x as a pilot. The FISMA metrics in use for FY2026 were written before M-26-14 and BOD 26-04 existed. An agency can be fully compliant with 2026 governance and fail a 2024 audit question, or the reverse.

And the calendar compounds. Each item above is manageable alone. Between October 2026 and August 2027 a typical agency must submit a PQC plan, stand up a new logging architecture, rebuild vulnerability management around new windows, inventory and begin decommissioning edge devices, absorb FedRAMP's agency rules for every cloud service it uses, and respond to whatever FISMA guidance eventually arrives. In a large agency those are different teams. In a small one they are the same three people.

What agencies should do now

• Keep a governance register with supersession. Track every source your documents cite, what replaced it, and when. Most agencies have a list of policies and no list of the governance behind them.
• Treat the 2026 memos and directives as program rewrites. Give M-26-05, M-26-14, M-26-15, BOD 26-02, and BOD 26-04 each an owner, a plan, and the dates above.
• Put the next ten months on one calendar and resolve the collisions between the PQC plan, the logging plan, BOD 26-04 readiness, the BOD 26-02 inventory, and FedRAMP's January 1 rules now.
• Watch changelogs, not just notices. FedRAMP changes rules between notices. The Federal Register, not an OMB memo, is where the next FAR cyber rules will appear.
• Use the trackers. FedXchange's governance tracker follows the sources above, marks what supersedes what, and shows the dated obligations in one place.

Sources

• CISA Cybersecurity Directives
• CISA BOD 26-04, Prioritizing Security Updates Based on Risk
• CISA BOD 26-02, Mitigating Risk From End-of-Support Edge Devices
• CISA Known Exploited Vulnerabilities catalog (JSON)
• OMB memoranda, 2025 to 2026
• OMB memoranda archive, 2021 to January 2025
• OMB memoranda archive, 2017 to January 2021
• OMB M-26-05, Adopting a Risk-based Approach to Software and Hardware Security
• OMB M-26-10, Reinforcing Transparency, Accountability, and Oversight of Federal Technology
• OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility
• HSToday on OMB M-26-15, post-quantum migration roadmap
• Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (Federal Register)
• Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security
• NSPM-12 text
• NIST SP 800 series publications index
• NIST Risk Management Framework project news
• CRS IF12959, Cybersecurity Information Sharing Act of 2015 extension (September 3, 2026)
• FedRAMP requests for comment and public notices
• FedRAMP Consolidated Rules for 2026: important dates and what's changing for Rev5
• FedRAMP: responding to CISA directives (agency guidance)
• ISOO Notices (National Archives)
• Cozen O'Connor on the revised FAR CUI proposed rule (June 2026)
• Hunton on the CIRCIA final rule schedule (July 2026)
• CIGIE, OIG Best Practices for Cloud Computing (March 2026)
• FedRAMP FY26 report: From foundation to implementation (October 8, 2026)
• FedRAMP Consolidated Rules for 2026: important deadlines for providers
• FedRAMP NTC-0012: Incident communication
• Nextgov/FCW: GSA seeks to boost understanding of FedRAMP 20x overhaul (October 8, 2026)
• FedXchange: FedRAMP moved the risk to agencies