Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 501 to 550.

Governance documents, sorted by date issued, oldest first. Page 11 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 11 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
ISOO Notice 2024-02Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 YearsNARAISOO noticeFebruary 29, 2024Rescinded
NoneSecuring the Information and Communications Technology and Services Supply Chain: Connected VehiclesCommerceProposed ruleMarch 1, 2024Superseded
NoneSecure Software Development Attestation FormCISACISA guidanceMarch 11, 2024In effect
M-24-10Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial IntelligenceOMBOMB memorandumMarch 28, 2024Rescinded
FAR Part 40Information Security and Supply Chain SecurityFAR CouncilRegulationApril 1, 2024In effect
ED 24-02Mitigating the Significant Risk from Nation-State Compromise of Microsoft Corporate Email SystemCISAEmergency DirectiveApril 2, 2024Retired
NoneCyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting RequirementsCISAProposed ruleApril 4, 2024Proposed
Pub. L. 118-50, Div. IProtecting Americans' Data from Foreign Adversaries Act of 2024CongressLawApril 24, 2024In effect
NSM-22Critical Infrastructure Security and ResilienceWhite HousePresidential directiveApril 30, 2024In effect
FAR Case 2023-008Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and ServicesFAR CouncilProposed ruleMay 3, 2024Superseded
SP 800-171 Rev. 3Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsNISTNIST Special PublicationMay 14, 2024In effect
SP 800-171A Rev. 3Assessing Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMay 14, 2024In effect
ICTS-2021-002Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc.CommerceSupply-chain orderJune 24, 2024In effect
ISOO Notice 2024-03Changes to ISOO Liaison ProgramNARAISOO noticeJune 26, 2024In effect
M-24-14Administration Cybersecurity Priorities for the FY 2026 BudgetOMBOMB memorandumJuly 10, 2024In effect
NoneRedesignation of Regulations for Securing the Information and Communications Technology and Services Supply ChainCommerceRegulationJuly 18, 2024In effect
M-24-15Modernizing the Federal Risk and Authorization Management ProgramOMBOMB memorandumJuly 25, 2024In effect
AI 600-1Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileNISTNIST frameworkJuly 26, 2024In effect
SP 800-218ASecure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community ProfileNISTNIST Special PublicationJuly 26, 2024In effect
FIPS 203Module-Lattice-Based Key-Encapsulation Mechanism StandardNISTFIPS standardAugust 13, 2024In effect
FIPS 204Module-Lattice-Based Digital Signature StandardNISTFIPS standardAugust 13, 2024In effect
FIPS 205Stateless Hash-Based Digital Signature StandardNISTFIPS standardAugust 13, 2024In effect
DFARS Case 2019-D041Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)DoDProposed ruleAugust 15, 2024Superseded
SP 800-50 Rev. 1Building a Cybersecurity and Privacy Learning ProgramNISTNIST Special PublicationSeptember 12, 2024In effect
M-24-18Advancing the Responsible Acquisition of Artificial Intelligence in GovernmentOMBOMB memorandumSeptember 24, 2024Rescinded
NoneSecuring the Information and Communications Technology and Services Supply Chain: Connected VehiclesCommerceProposed ruleSeptember 26, 2024Superseded
32 CFR Part 170Cybersecurity Maturity Model Certification (CMMC) ProgramDoDRegulationOctober 15, 2024In effect
NSM-25Advancing the United States' Leadership in Artificial Intelligence; Harnessing Artificial Intelligence To Fulfill National Security Objectives; and Fostering the Safety, Security, and Trustworthiness of Artificial IntelligenceWhite HousePresidential directiveOctober 24, 2024Superseded
NoneFederal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign EntitiesFAR CouncilRegulationNovember 12, 2024In effect
FAR 52.240-1Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign EntitiesFAR CouncilContract clauseNovember 12, 2024In effect
IR 8547Transition to Post-Quantum Cryptography StandardsNISTNIST Interagency ReportNovember 12, 2024Proposed
SP 800-55 Vol. 1Measurement Guide for Information Security: Volume 1 — Identifying and Selecting MeasuresNISTNIST Special PublicationDecember 4, 2024In effect
SP 800-55 Vol. 2Measurement Guide for Information Security: Volume 2 — Developing an Information Security Measurement ProgramNISTNIST Special PublicationDecember 4, 2024In effect
15 CFR Part 791Securing the Information and Communications Technology and Services Supply ChainCommerceRegulationDecember 6, 2024In effect
NoneBOD 25-01: Implementation Guidance for Implementing Secure Practices for Cloud ServicesCISACISA guidanceDecember 17, 2024In effect
BOD 25-01Implementing Secure Practices for Cloud ServicesCISABinding Operational DirectiveDecember 17, 2024In effect
NoneSecuring the Information and Communications Technology and Services Supply Chain: Unmanned Aircraft SystemsCommerceProposed ruleJanuary 3, 2025Proposed
M-25-03Implementation Guidance for the Federal Data Center Enhancement ActOMBOMB memorandumJanuary 14, 2025In effect
FAR Case 2017-016Federal Acquisition Regulation: Controlled Unclassified InformationFAR CouncilProposed ruleJanuary 15, 2025Superseded
M-25-04Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumJanuary 15, 2025In effect
M-25-05Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management GuidanceOMBOMB memorandumJanuary 15, 2025In effect
NoneSecuring the Information and Communications Technology and Services Supply Chain: Connected VehiclesCommerceRegulationJanuary 16, 2025In effect
EO 14144Strengthening and Promoting Innovation in the Nation's CybersecurityWhite HouseExecutive orderJanuary 16, 2025In effect
EO 14148Initial Rescissions of Harmful Executive Orders and ActionsWhite HouseExecutive orderJanuary 20, 2025In effect
EO 14158Establishing and Implementing the President's "Department of Government Efficiency"White HouseExecutive orderJanuary 20, 2025In effect
EO 14179Removing Barriers to American Leadership in Artificial IntelligenceWhite HouseExecutive orderJanuary 23, 2025In effect
EO 14239Achieving Efficiency Through State and Local PreparednessWhite HouseExecutive orderMarch 18, 2025In effect
EO 14240Eliminating Waste and Saving Taxpayer Dollars by Consolidating ProcurementWhite HouseExecutive orderMarch 20, 2025In effect
EO 14243Stopping Waste, Fraud, and Abuse by Eliminating Information SilosWhite HouseExecutive orderMarch 20, 2025In effect
NoneFedRAMP 20xGSA and FedRAMPFedRAMP policyMarch 24, 2025In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.