Skip to content
FedXchange
Menu

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

618 documents

Showing 1 to 50.

Governance documents, sorted by date issued, newest first. Page 1 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 1 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
EO 14432Streamlining Access to Government Services Through America.govWhite HouseExecutive orderSeptember 29, 2026In effect
EO 14434Inaugurating the Era of Super IntelligenceWhite HouseExecutive orderSeptember 29, 2026In effect
ISOO Notice 2026-09Guidance for Use of Classification Authority Block on Standard Form 700NARAISOO noticeSeptember 28, 2026In effect
ISOO Notice 2026-07Executive Agent Guidance for Implementation of the Controlled Unclassified Information ProgramNARAISOO noticeSeptember 2, 2026In effect
ISOO Notice 2026-08Controlled Unclassified Information (CUI) Program Revised Requirements for WaiversNARAISOO noticeSeptember 2, 2026In effect
ISOO Notice 2026-06Standards for GSA Approved Security EquipmentNARAISOO noticeAugust 31, 2026In effect
M-26-18Scaling Use of Login.gov to Deliver a Universal Sign-on for Public ServicesOMBOMB memorandumAugust 31, 2026In effect
EO 14421Declaring a National Emergency To Secure the United States Bulk-Power SystemWhite HouseExecutive orderAugust 26, 2026In effect
ISOO Notice 2026-05Appeal Procedures for the Interagency Security Classification Appeals PanelNARAISOO noticeAugust 17, 2026In effect
NoneExpanding Capabilities to Combat Transnational Cyber-Enabled CrimeWhite HousePresidential directiveAugust 12, 2026In effect
M-26-17Rescission of M-23-13OMBOMB memorandumAugust 10, 2026In effect
NoneFY 2026 & FY 2027 CIO FISMA MetricsCISACISA guidanceAugust 3, 2026In effect
ISOO Notice 2026-04Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 YearsNARAISOO noticeAugust 3, 2026In effect
NoneLogging Reference ArchitectureCISACISA guidanceAugust 2026In effect
ISOO Notice 2026-03Department of State Declassification Referral WaiverNARAISOO noticeJuly 9, 2026In effect
SP 800-18 Rev. 2Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for SystemsNISTNIST Special PublicationJune 30, 2026In effect
NoneFedRAMP Consolidated Rules for 2026GSA and FedRAMPFedRAMP policyJune 25, 2026In effect
M-26-15Execution of the Migration to Post-Quantum CryptographyOMBOMB memorandumJune 24, 2026In effect
FAR Case 2026-001Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53FAR CouncilProposed ruleJune 23, 2026Proposed
EO 14412Securing the Nation Against Advanced Cryptographic AttacksWhite HouseExecutive orderJune 22, 2026In effect
EO 14413Ushering in the Next Frontier of Quantum InnovationWhite HouseExecutive orderJune 22, 2026In effect
NSPM-12National Policy for the Cybersecurity of National Security SystemsWhite HousePresidential directiveJune 12, 2026In effect
NoneBOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on RiskCISACISA guidanceJune 10, 2026In effect
BOD 26-04Prioritizing Security Updates Based on RiskCISABinding Operational DirectiveJune 10, 2026In effect
ISOO Notice 2026-02Prohibition on the Use of Combination Translator Applications to Generate Lock Combinations that Protect Classified InformationNARAISOO noticeJune 10, 2026In effect
NSPM-11Artificial Intelligence in the National Security EnterpriseWhite HousePresidential directiveJune 5, 2026In effect
EO 14409Promoting Advanced Artificial Intelligence Innovation and SecurityWhite HouseExecutive orderJune 2, 2026In effect
M-26-14Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber ThreatsOMBOMB memorandumMay 22, 2026In effect
SP 800-172 Rev. 3Enhanced Security Requirements for Protecting Controlled Unclassified InformationNISTNIST Special PublicationMay 13, 2026In effect
SP 800-172A Rev. 3Assessing Enhanced Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMay 13, 2026In effect
NoneV1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco DevicesCISACISA guidanceApril 23, 2026In effect
M-26-10Reinforcing Transparency, Accountability, and Oversight of Federal TechnologyOMBOMB memorandumMarch 31, 2026In effect
ISOO Notice 2026-01Responsible Use of Classified National Security Information and Controlled Unclassified Information with Artificial IntelligenceNARAISOO noticeMarch 30, 2026In effect
NoneV1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN SystemsCISACISA guidanceMarch 11, 2026In effect
Circular A-123Management's Responsibility for Internal ControlOMBOMB circularMarch 10, 2026In effect
EO 14390Combating Cybercrime, Fraud, and Predatory Schemes Against American CitizensWhite HouseExecutive orderMarch 6, 2026In effect
NoneSupplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN SystemsCISACISA guidanceFebruary 25, 2026In effect
ED 26-03Mitigate Vulnerabilities in Cisco SD-WAN SystemsCISAEmergency DirectiveFebruary 25, 2026In effect
FAR Case 2023-008Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and ServicesFAR CouncilProposed ruleFebruary 17, 2026Proposed
BOD 26-02Mitigating Risk From End-of-Support Edge DevicesCISABinding Operational DirectiveFebruary 5, 2026In effect
M-26-05Adopting a Risk-based Approach to Software and Hardware SecurityOMBOMB memorandumJanuary 23, 2026In effect
IR 8286 Rev. 1Integrating Cybersecurity and Enterprise Risk Management (ERM)NISTNIST Interagency ReportDecember 18, 2025In effect
SP 800-218 Rev. 1Secure Software Development Framework (SSDF) Version 1.2: Recommendations for Mitigating the Risk of Software VulnerabilitiesNISTNIST Special PublicationDecember 17, 2025Proposed
EO 14365Ensuring a National Policy Framework for Artificial IntelligenceWhite HouseExecutive orderDecember 11, 2025In effect
M-26-04Increasing Public Trust in Artificial Intelligence Through Unbiased AI PrinciplesOMBOMB memorandumDecember 11, 2025In effect
EO 14363Launching the Genesis MissionWhite HouseExecutive orderNovember 24, 2025In effect
M-26-02Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States ProducersOMBOMB memorandumNovember 21, 2025In effect
DFARS 252.204-7025Notice of Cybersecurity Maturity Model Certification Level RequirementsDoDContract clauseNovember 10, 2025In effect
NoneFedRAMP 20x Phase 2 PilotGSA and FedRAMPFedRAMP policyNovember 2025Expired
ED 26-01Mitigate Vulnerabilities in F5 DevicesCISAEmergency DirectiveOctober 15, 2025In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.