Deliverables and due dates
What federal cybersecurity, privacy, and technology governance asks agencies to deliver, and by when: every required action in a law, memo, directive, or standard still in effect, and every open comment period. Soonest first.
Choose your agencies to see only what applies to them. Add the dates to your calendar, or download the list as a spreadsheet.
Add the dated ones to a calendarDownload as a spreadsheet (CSV)The governance tracker
Ongoing or set by an event (9)
Over one to two yearsApplies if
Make Login.gov the default sign-in for those websites, and phase out duplicate identity solutions.
M-26-18, Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services · Applies to executive branch agencies, but only agencies with public websites that need sign-in
Controls: IA-2, IA-8
3 to 60 days after a vulnerability is found, by riskApplies
Fix each vulnerability within the 3- to 60-day window the directive sets for it, based on risk factors such as a Known Exploited Vulnerabilities listing and internet exposure.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB) · Chief Information Officer
Controls: RA-5, SI-2
Within 90 days of CISA's logging reference architectureApplies
Write an agency logging plan aimed at real-time detection and later investigation.
M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats · Applies to executive branch agencies
Controls: AU-2, AU-6, AU-12
Within 14 days of finding one or being told by CISAApplies
Take device management interfaces off the public internet, or protect them with zero trust access controls.
BOD 23-02, Mitigating the Risk from Internet-Exposed Management Interfaces · Applies to federal civilian executive branch (FCEB)
Controls: AC-17, CM-7, SC-7
Every 7 days, since April 3, 2023Applies
Run automated discovery of the devices on agency networks every 7 days.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: CM-8
Every 14 days, since April 3, 2023Applies
Scan discovered devices for vulnerabilities every 14 days.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: RA-5
Monthly, starting May 2026Applies
Report to OMB each month on the IT contracts the CIO approves.
M-26-10, Reinforcing Transparency, Accountability, and Oversight of Federal Technology · Applies to CFO Act agencies only · Chief Information Officer
Controls: SA-4
Within 30 days of an assessment; status reports monthlyApplies if
Identify the agency's High Value Assets for CISA, support CISA's risk and architecture assessments of them, and fix major or critical weaknesses within 30 days or send a remediation plan.
BOD 18-02, Securing High Value Assets · Applies if the agency has High Value Assets
Controls: CA-2, CA-5, RA-3
Test the plan each yearApplies
Keep a breach response plan, run a breach response team, test the plan each year, and assess the risk to individuals when deciding on notification.
M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information · Applies to executive branch agencies · Senior Agency Official for Privacy
Controls: IR-3, IR-8(1)
Required actions come from the governance tracker, where FedXchange's editors record what each document asks of agencies. "Applies if" means the action reaches the agency only when a condition holds, such as running the product a directive names. A date marked "Worked out" is counted from the document's issue date, such as 120 days after a memo.
Check the official source before you rely on a date. Each item links to its page in the tracker, which links to the source.