Deliverables and due dates
What federal cybersecurity, privacy, and technology governance asks agencies to deliver, and by when: every required action in a law, memo, directive, or standard still in effect, and every open comment period. Soonest first.
Choose your agencies to see only what applies to them. Add the dates to your calendar, or download the list as a spreadsheet.
Add the dated ones to a calendarDownload as a spreadsheet (CSV)The governance tracker
Due later (2)
Comments close December 1, 2026Optional
Send comments, if the agency has any.
FR Doc. 2026-17926, Heightened Import Disclosures for Supply Chain Visibility · Optional: anyone may comment
By 2027Applies
Remove and replace unsupported edge devices.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: SA-22
Required actions come from the governance tracker, where FedXchange's editors record what each document asks of agencies. "Applies if" means the action reaches the agency only when a condition holds, such as running the product a directive names. A date marked "Worked out" is counted from the document's issue date, such as 120 days after a memo.
Check the official source before you rely on a date. Each item links to its page in the tracker, which links to the source.