Deliverables and due dates
What federal cybersecurity, privacy, and technology governance asks agencies to deliver, and by when: every required action in a law, memo, directive, or standard still in effect, and every open comment period. Soonest first.
Choose your agencies to see only what applies to them. Add the dates to your calendar, or download the list as a spreadsheet.
Add the dated ones to a calendarDownload as a spreadsheet (CSV)The governance tracker
Date passed (8)
The date has passed. FedXchange does not know whether an agency finished the work.
Comments close October 9, 2026Optional
Send comments, if the agency has any.
RFC-0033, 20x Phase 4 Development Tracks for 20x Class D · Optional: anyone may comment
Comments close October 9, 2026Optional
Send comments, if the agency has any.
RFC-0034, Technical Advisory Group Changes · Optional: anyone may comment
By May 20, 2026 (within 180 days of the memo)Applies ifWorked out
Build information security risk steps into buying and using drones, including MFA-based access controls, trusted software updates, and data encryption.
M-26-02, Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers · Applies to executive branch agencies, but only agencies that buy or use drones
Controls: IA-2, SC-8, SC-28, SI-7
By April 3, 2026 (within 365 days of the memo)AppliesWorked out
Apply the memo's minimum risk management practices to high-impact AI.
M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust · Applies to executive branch agencies
Controls: RA-3
By June 20, 2025Applies if
Apply CISA's mandatory secure configuration settings.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CM-2, CM-6
By April 25, 2025Applies if
Run CISA's configuration assessment tools on each tenant.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CA-7, CM-6
By February 21, 2025Applies if
List the agency's Microsoft 365 cloud tenants for CISA.
BOD 25-01, Implementing Secure Practices for Cloud Services · Applies to federal civilian executive branch (FCEB), but only agencies with Microsoft 365 cloud tenants
Controls: CM-8
By September 30, 2024Applies
Meet the memo's zero trust goals, including phishing-resistant MFA, complete device inventories, encrypted DNS and web traffic, application security testing, and data categorization.
M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles · Applies to executive branch agencies
Controls: CM-8, IA-2, RA-2, SA-11, SC-8
Required actions come from the governance tracker, where FedXchange's editors record what each document asks of agencies. "Applies if" means the action reaches the agency only when a condition holds, such as running the product a directive names. A date marked "Worked out" is counted from the document's issue date, such as 120 days after a memo.
Check the official source before you rely on a date. Each item links to its page in the tracker, which links to the source.