Deliverables and due dates
What federal cybersecurity, privacy, and technology governance asks agencies to deliver, and by when: every required action in a law, memo, directive, or standard still in effect, and every open comment period. Soonest first.
Choose your agencies to see only what applies to them. Add the dates to your calendar, or download the list as a spreadsheet.
Add the dated ones to a calendarDownload as a spreadsheet (CSV)The governance tracker
Due in the next 30 days (7)
Comments close October 19, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-19158, Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 14, 28, 36, and 52 · Optional: anyone may comment
Comments close October 22, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-19331, General Services Administration Acquisition Regulation; GSAR Implementation of Executive Order 14275, Federal Supply Schedule Ordering Procedures · Optional: anyone may comment
By October 22, 2026 (within 120 days of the memo)AppliesWorked out
Submit a post-quantum cryptography migration plan to OMB and the Office of the National Cyber Director.
M-26-15, Execution of the Migration to Post-Quantum Cryptography · Applies to executive branch agencies
Controls: SC-12, SC-13
By October 30, 2026 (within 60 days of the memo)Applies ifWorked out
Inventory the agency's public websites that need sign-in.
M-26-18, Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services · Applies to executive branch agencies, but only agencies with public websites that need sign-in
Controls: CM-8, IA-8
Comments close November 4, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-20317, General Services Administration Acquisition Regulation; GSAR Implementation of Executive Order 14275, Acquisition of Utility Services · Optional: anyone may comment
Comments close November 4, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-20392, Overpressure Blast Effects Analysis Burden Reducing Clarification · Optional: anyone may comment
Comments close November 6, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-20532, Privacy Act of 1974; Implementation · Optional: anyone may comment
Due later (2)
Comments close December 1, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-17926, Heightened Import Disclosures for Supply Chain Visibility · Optional: anyone may comment
By 2027Applies
Remove and replace unsupported edge devices.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: SA-22
Ongoing or set by an event (9)
Over one to two yearsApplies if
Make Login.gov the default sign-in for those websites, and phase out duplicate identity solutions.
M-26-18, Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services · Applies to executive branch agencies, but only agencies with public websites that need sign-in
Controls: IA-2, IA-8
3 to 60 days after a vulnerability is found, by riskApplies
Fix each vulnerability within the 3- to 60-day window the directive sets for it, based on risk factors such as a Known Exploited Vulnerabilities listing and internet exposure.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB) · Chief Information Officer
Controls: RA-5, SI-2
Within 90 days of CISA's logging reference architectureApplies
Write an agency logging plan aimed at real-time detection and later investigation.
M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats · Applies to executive branch agencies
Controls: AU-2, AU-6, AU-12
Within 14 days of finding one or being told by CISAApplies
Take device management interfaces off the public internet, or protect them with zero trust access controls.
BOD 23-02, Mitigating the Risk from Internet-Exposed Management Interfaces · Applies to federal civilian executive branch (FCEB)
Controls: AC-17, CM-7, SC-7
Every 7 days, since April 3, 2023Applies
Run automated discovery of the devices on agency networks every 7 days.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: CM-8
Every 14 days, since April 3, 2023Applies
Scan discovered devices for vulnerabilities every 14 days.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: RA-5
Monthly, starting May 2026Applies
Report to OMB each month on the IT contracts the CIO approves.
M-26-10, Reinforcing Transparency, Accountability, and Oversight of Federal Technology · Applies to CFO Act agencies only · Chief Information Officer
Controls: SA-4
Within 30 days of an assessment; status reports monthlyApplies if
Identify the agency's High Value Assets for CISA, support CISA's risk and architecture assessments of them, and fix major or critical weaknesses within 30 days or send a remediation plan.
BOD 18-02, Securing High Value Assets · Applies if the agency has High Value Assets
Controls: CA-2, CA-5, RA-3
Test the plan each yearApplies
Keep a breach response plan, run a breach response team, test the plan each year, and assess the risk to individuals when deciding on notification.
M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information · Applies to executive branch agencies · Senior Agency Official for Privacy
Controls: IR-3, IR-8(1)
No date given (16)
No date givenApplies
Migrate to post-quantum cryptography in phases, starting with high-impact systems and High Value Assets.
M-26-15, Execution of the Migration to Post-Quantum Cryptography · Applies to executive branch agencies
Controls: SC-12, SC-13
No date givenApplies
Tag internet-exposed assets so each vulnerability's risk can be judged.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: CM-8
No date givenApplies
Keep CISA's scanning access to agency systems in place.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: CA-7, RA-5
No date givenApplies
Check high-risk systems for signs of earlier compromise.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: IR-4, SI-4
No date givenApplies
Keep logs searchable for six months and retrievable for one year.
M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats · Applies to executive branch agencies
Controls: AU-9, AU-11
No date givenApplies if
Inventory Cisco Catalyst SD-WAN systems, collect forensic data, apply Cisco's updates, and follow CISA's hunt and hardening steps.
ED 26-03, Mitigate Vulnerabilities in Cisco SD-WAN Systems · Applies if the agency runs the product the document names, but only agencies that run Cisco Catalyst SD-WAN systems
Controls: CM-8, IR-4, SI-2
No date givenApplies
Update edge devices such as firewalls and routers.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: SI-2
No date givenApplies
Report devices on CISA's end-of-support list to CISA.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: CM-8, SA-22
No date givenApplies
Keep an ongoing inventory of edge devices nearing end of support.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: CM-8, SA-22
No date givenApplies
Set the agency's own risk-based software and hardware security policies. Attestation forms and SBOMs are optional tools.
M-26-05, Adopting a Risk-based Approach to Software and Hardware Security · Applies to executive branch agencies
Controls: SA-4, SR-3
No date givenApplies if
Inventory F5 devices, check whether their management interfaces face the internet, apply F5's October 2025 updates, disconnect end-of-support devices, and report to CISA.
ED 26-01, Mitigate Vulnerabilities in F5 Devices · Applies if the agency runs the product the document names, but only agencies that run F5 BIG-IP devices
Controls: CM-8, SA-22, SC-7, SI-2
No date givenApplies
Designate a Chief AI Officer and publish an agency AI strategy.
M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust · Applies to executive branch agencies
New documents needed: Agency AI Strategy
No date givenApplies
Report the discovery and scan results to CISA.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: CA-7
No date givenApplies
Publish a vulnerability disclosure policy that invites the public to report security flaws, set up procedures to handle reports, widen its scope until it covers every internet-facing system, and report metrics to CISA.
BOD 20-01, Develop and Publish a Vulnerability Disclosure Policy · Applies to federal civilian executive branch (FCEB)
Controls: RA-5(11)
No date givenApplies if
Set up governance for High Value Assets, prioritize them with a data-driven method, have them assessed by CISA or independent assessors, and fix the weaknesses found.
M-19-03, Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program · Applies if the agency has High Value Assets
Controls: CA-2, CA-5, RA-3
No date givenApplies
Set up email authentication that rejects spoofed messages, encrypt mail in transit, and serve every public website only over encrypted connections, dropping weak encryption protocols.
BOD 18-01, Enhance Email and Web Security · Applies to federal civilian executive branch (FCEB)
Controls: SC-8, SC-13, SI-8
Date passed (8)
The date has passed. FedXchange does not know whether an agency finished the work.
Comments close October 9, 2026Optional
Send comments, if the agency has any.
RFC-0033, 20x Phase 4 Development Tracks for 20x Class D · Optional: anyone may comment
Comments close October 9, 2026Optional
Send comments, if the agency has any.
RFC-0034, Technical Advisory Group Changes · Optional: anyone may comment
By May 20, 2026 (within 180 days of the memo)Applies ifWorked out
Build information security risk steps into buying and using drones, including MFA-based access controls, trusted software updates, and data encryption.
M-26-02, Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers · Applies to executive branch agencies, but only agencies that buy or use drones
Controls: IA-2, SC-8, SC-28, SI-7
By April 3, 2026 (within 365 days of the memo)AppliesWorked out
Apply the memo's minimum risk management practices to high-impact AI.
M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust · Applies to executive branch agencies
Controls: RA-3
By June 20, 2025Applies if
Apply CISA's mandatory secure configuration settings.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CM-2, CM-6
By April 25, 2025Applies if
Run CISA's configuration assessment tools on each tenant.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CA-7, CM-6
By February 21, 2025Applies if
List the agency's Microsoft 365 cloud tenants for CISA.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CM-8
By September 30, 2024Applies
Meet the memo's zero trust goals, including phishing-resistant MFA, complete device inventories, encrypted DNS and web traffic, application security testing, and data categorization.
M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles · Applies to executive branch agencies
Controls: CM-8, IA-2, RA-2, SA-11, SC-8
Required actions come from the governance tracker, where FedXchange's editors record what each document asks of agencies. "Applies if" means the action reaches the agency only when a condition holds, such as running the product a directive names. A date marked "Worked out" is counted from the document's issue date, such as 120 days after a memo.
Check the official source before you rely on a date. Each item links to its page in the tracker, which links to the source.