Governance tracker
Federal cybersecurity, privacy, and technology governance
Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.
FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.
Get new governance by emailWhat the statuses meanNames on this page
Found in the last 7 days
Nothing new in the last 7 days.
Skip to the results
Filters
Results
631 documents
Showing 1 to 50.
Governance documents, sorted by date issued, oldest first. Page 1 of 13.
The table scrolls sideways. Each title opens the document's page.
| Number, sort A to Z | Title, sort A to Z | Issuer, sort A to Z | Type | Issued, sort newest first | Status, sort A to Z |
|---|---|---|---|---|---|
| Pub. L. 93-579 | Privacy Act of 1974 | Congress | Law | December 31, 1974 | In effect |
| EO 12065 | National Security Information | White House | Executive order | June 28, 1978 | Superseded |
| Pub. L. 96-511 | Paperwork Reduction Act of 1980 | Congress | Law | December 11, 1980 | Superseded |
| EO 12356 | National Security Information | White House | Executive order | April 2, 1982 | Superseded |
| FAR 52.224-1 | Privacy Act Notification | FAR Council | Contract clause | April 1984 | In effect |
| FAR 52.224-2 | Privacy Act | FAR Council | Contract clause | April 1984 | In effect |
| NSDD-145 | National Policy on Telecommunications and Automated Information Systems Security | White House | Presidential directive | September 17, 1984 | Superseded |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | December 24, 1985 | Superseded |
| Pub. L. 99-474 | Computer Fraud and Abuse Act of 1986 | Congress | Law | October 16, 1986 | In effect |
| Pub. L. 100-235 | Computer Security Act of 1987 | Congress | Law | January 8, 1988 | Superseded |
| Pub. L. 100-503 | Computer Matching and Privacy Protection Act of 1988 | Congress | Law | October 18, 1988 | In effect |
| NSD-42 | National Policy for the Security of National Security Telecommunications and Information Systems | White House | Presidential directive | July 5, 1990 | Superseded |
| EO 12829 | National Industrial Security Program | White House | Executive order | January 6, 1993 | In effect |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | June 25, 1993 | Superseded |
| FIPS 140-1 | Security Requirements for Cryptographic Modules | NIST | FIPS standard | January 11, 1994 | Withdrawn |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | July 15, 1994 | Superseded |
| EO 12958 | Classified National Security Information | White House | Executive order | April 17, 1995 | Superseded |
| Pub. L. 104-13 | Paperwork Reduction Act of 1995 | Congress | Law | May 22, 1995 | In effect |
| EO 12968 | Access to Classified Information | White House | Executive order | August 2, 1995 | In effect |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | February 8, 1996 | Superseded |
| Pub. L. 104-106, Div. E | Information Technology Management Reform Act of 1996 (Clinger-Cohen Act) | Congress | Law | February 10, 1996 | In effect |
| M-96-20 | Implementation of the Information Technology Management Reform Act of 1996 | OMB | OMB memorandum | April 4, 1996 | Rescinded |
| EO 13010 | Critical Infrastructure Protection | White House | Executive order | July 15, 1996 | Expired |
| EO 13011 | Federal Information Technology | White House | Executive order | July 16, 1996 | Rescinded |
| FAR 52.239-1 | Privacy or Security Safeguards | FAR Council | Contract clause | August 1996 | In effect |
| M-97-02 | Funding Information Systems Investments | OMB | OMB memorandum | October 25, 1996 | Rescinded |
| M-97-16 | Information Technology Architectures | OMB | OMB memorandum | June 18, 1997 | Rescinded |
| EO 13073 | Year 2000 Conversion | White House | Executive order | February 4, 1998 | In effect |
| None | Privacy and Personal Information in Federal Records | White House | Presidential directive | May 14, 1998 | In effect |
| PDD-63 | Critical Infrastructure Protection | White House | Presidential directive | May 22, 1998 | Superseded |
| EO 13103 | Computer Software Piracy | White House | Executive order | September 30, 1998 | In effect |
| Pub. L. 105-277, Div. C, Title XVII | Government Paperwork Elimination Act | Congress | Law | October 21, 1998 | In effect |
| M-99-05 | Instructions on Complying with President's Memorandum of May 14, 1998, "Privacy and Personal Information in Federal Records" | OMB | OMB memorandum | January 7, 1999 | Superseded |
| M-99-18 | Privacy Policies on Federal Web Sites | OMB | OMB memorandum | June 2, 1999 | Superseded |
| M-99-20 | Security of Federal Automated Information Resources | OMB | OMB memorandum | June 23, 1999 | Rescinded |
| EO 13130 | National Infrastructure Assurance Council | White House | Executive order | July 14, 1999 | Superseded |
| None | Memorandum on Electronic Government | White House | Presidential directive | December 17, 1999 | In effect |
| M-00-07 | Incorporating and Funding Security in Information Systems Investments | OMB | OMB memorandum | February 28, 2000 | Rescinded |
| M-00-10 | OMB Procedures and Guidance on Implementing the Government Paperwork Elimination Act | OMB | OMB memorandum | April 25, 2000 | In effect |
| M-00-13 | Privacy Policies and Data Collection on Federal Web Sites | OMB | OMB memorandum | June 22, 2000 | Rescinded |
| M-00-15 | OMB Guidance on Implementing the Electronic Signatures in Global and National Commerce Act | OMB | OMB memorandum | September 25, 2000 | In effect |
| Pub. L. 106-398, Title X, Subtitle G | Government Information Security Reform | Congress | Law | October 30, 2000 | Superseded |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | November 28, 2000 | Superseded |
| M-01-05 | Guidance on Inter-Agency Sharing of Personal Data - Protecting Personal Privacy | OMB | OMB memorandum | December 20, 2000 | In effect |
| M-01-08 | Guidance on Implementing the Government Information Security Reform Act | OMB | OMB memorandum | January 16, 2001 | Rescinded |
| FIPS 140-2 | Security Requirements for Cryptographic Modules | NIST | FIPS standard | May 25, 2001 | Superseded |
| M-01-24 | Reporting Instructions for the Government Information Security Reform Act | OMB | OMB memorandum | June 22, 2001 | Rescinded |
| EO 13231 | Critical Infrastructure Protection in the Information Age | White House | Executive order | October 16, 2001 | In effect |
| M-02-01 | Guidance for Preparing and Submitting Security Plans of Action and Milestones | OMB | OMB memorandum | October 17, 2001 | In effect |
| FIPS 197 | Advanced Encryption Standard (AES) | NIST | FIPS standard | November 26, 2001 | In effect |
What the statuses mean
- In effect
- Still in force, possibly with amendments.
- Proposed
- A proposed rule or draft. It may change before it takes effect.
- Superseded
- Replaced by a newer document or edition.
- Rescinded
- Cancelled by its issuer.
- Withdrawn
- Withdrawn by its issuer (NIST's term).
- Retired
- Closed by its issuer (CISA's term for a directive that has done its job).
- Expired
- Lapsed on its own terms.
Names on this page
- AI
- Artificial intelligence
- BOD
- Binding Operational Directive, issued by CISA
- CISA
- Cybersecurity and Infrastructure Security Agency
- CUI
- Controlled Unclassified Information
- DFARS
- Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
- DoD
- Department of Defense
- ED
- Emergency Directive, issued by CISA
- EO
- Executive order
- FAR
- Federal Acquisition Regulation, the rules for federal contracts
- FASC
- Federal Acquisition Security Council
- FedRAMP
- Federal Risk and Authorization Management Program, run by GSA
- FIPS
- Federal Information Processing Standard, published by NIST
- FISMA
- Federal Information Security Modernization Act
- GSA
- General Services Administration
- ISOO
- Information Security Oversight Office, part of NARA
- IT
- Information technology
- MFA
- Multifactor authentication
- NARA
- National Archives and Records Administration
- NIST
- National Institute of Standards and Technology
- OMB
- Office of Management and Budget
- OPM
- Office of Personnel Management
- PIV
- Personal Identity Verification, the federal employee ID card
- SBOM
- Software bill of materials: a list of the parts in a piece of software
Get new governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.