Deliverables and due dates
What federal cybersecurity, privacy, and technology governance asks agencies to deliver, and by when: every required action in a law, memo, directive, or standard still in effect, and every open comment period. Soonest first.
Choose your agencies to see only what applies to them. Add the dates to your calendar, or download the list as a spreadsheet.
Add the dated ones to a calendarDownload as a spreadsheet (CSV)The governance tracker
No date given (16)
No date givenApplies
Migrate to post-quantum cryptography in phases, starting with high-impact systems and High Value Assets.
M-26-15, Execution of the Migration to Post-Quantum Cryptography · Applies to executive branch agencies
Controls: SC-12, SC-13
No date givenApplies
Tag internet-exposed assets so each vulnerability's risk can be judged.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: CM-8
No date givenApplies
Keep CISA's scanning access to agency systems in place.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: CA-7, RA-5
No date givenApplies
Check high-risk systems for signs of earlier compromise.
BOD 26-04, Prioritizing Security Updates Based on Risk · Applies to federal civilian executive branch (FCEB)
Controls: IR-4, SI-4
No date givenApplies
Keep logs searchable for six months and retrievable for one year.
M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats · Applies to executive branch agencies
Controls: AU-9, AU-11
No date givenApplies if
Inventory Cisco Catalyst SD-WAN systems, collect forensic data, apply Cisco's updates, and follow CISA's hunt and hardening steps.
ED 26-03, Mitigate Vulnerabilities in Cisco SD-WAN Systems · Applies if the agency runs the product the document names, but only agencies that run Cisco Catalyst SD-WAN systems
Controls: CM-8, IR-4, SI-2
No date givenApplies
Update edge devices such as firewalls and routers.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: SI-2
No date givenApplies
Report devices on CISA's end-of-support list to CISA.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: CM-8, SA-22
No date givenApplies
Keep an ongoing inventory of edge devices nearing end of support.
BOD 26-02, Mitigating Risk From End-of-Support Edge Devices · Applies to federal civilian executive branch (FCEB)
Controls: CM-8, SA-22
No date givenApplies
Set the agency's own risk-based software and hardware security policies. Attestation forms and SBOMs are optional tools.
M-26-05, Adopting a Risk-based Approach to Software and Hardware Security · Applies to executive branch agencies
Controls: SA-4, SR-3
No date givenApplies if
Inventory F5 devices, check whether their management interfaces face the internet, apply F5's October 2025 updates, disconnect end-of-support devices, and report to CISA.
ED 26-01, Mitigate Vulnerabilities in F5 Devices · Applies if the agency runs the product the document names, but only agencies that run F5 BIG-IP devices
Controls: CM-8, SA-22, SC-7, SI-2
No date givenApplies
Designate a Chief AI Officer and publish an agency AI strategy.
M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust · Applies to executive branch agencies
New documents needed: Agency AI Strategy
No date givenApplies
Report the discovery and scan results to CISA.
BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks · Applies to federal civilian executive branch (FCEB)
Controls: CA-7
No date givenApplies
Publish a vulnerability disclosure policy that invites the public to report security flaws, set up procedures to handle reports, widen its scope until it covers every internet-facing system, and report metrics to CISA.
BOD 20-01, Develop and Publish a Vulnerability Disclosure Policy · Applies to federal civilian executive branch (FCEB)
Controls: RA-5(11)
No date givenApplies if
Set up governance for High Value Assets, prioritize them with a data-driven method, have them assessed by CISA or independent assessors, and fix the weaknesses found.
M-19-03, Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program · Applies if the agency has High Value Assets
Controls: CA-2, CA-5, RA-3
No date givenApplies
Set up email authentication that rejects spoofed messages, encrypt mail in transit, and serve every public website only over encrypted connections, dropping weak encryption protocols.
BOD 18-01, Enhance Email and Web Security · Applies to federal civilian executive branch (FCEB)
Controls: SC-8, SC-13, SI-8
Required actions come from the governance tracker, where FedXchange's editors record what each document asks of agencies. "Applies if" means the action reaches the agency only when a condition holds, such as running the product a directive names. A date marked "Worked out" is counted from the document's issue date, such as 120 days after a memo.
Check the official source before you rely on a date. Each item links to its page in the tracker, which links to the source.