Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

631 documents

Showing 51 to 100.

Governance documents, sorted by date issued, oldest first. Page 2 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 2 of 13.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
SP 800-34	Contingency Planning Guide for Information Technology Systems	NIST	NIST Special Publication	June 13, 2002	Withdrawn
SP 800-30	Risk Management Guide for Information Technology Systems	NIST	NIST Special Publication	July 2002	Withdrawn
M-02-09	Reporting Instructions for the Government Information Security Reform Act and Updated Guidance on Security Plans of Action and Milestones	OMB	OMB memorandum	July 2, 2002	Rescinded
Pub. L. 107-296	Homeland Security Act of 2002	Congress	Law	November 25, 2002	In effect
Pub. L. 107-305	Cyber Security Research and Development Act	Congress	Law	November 27, 2002	In effect
Pub. L. 107-347	E-Government Act of 2002	Congress	Law	December 17, 2002	In effect
Pub. L. 107-347, Title III	Federal Information Security Management Act of 2002	Congress	Law	December 17, 2002	Superseded
Pub. L. 107-347, Title V	Confidential Information Protection and Statistical Efficiency Act of 2002	Congress	Law	December 17, 2002	Superseded
EO 13292	Further Amendment to Executive Order 12958, as Amended, Classified National Security Information	White House	Executive order	March 25, 2003	Superseded
M-03-14	Reducing Cost and Improving Quality in Federal Purchases of Commercial Software	OMB	OMB memorandum	June 2, 2003	Rescinded
M-03-18	Implementation Guidance for the E-Government Act of 2002	OMB	OMB memorandum	August 1, 2003	In effect
M-03-19	Reporting Instructions for the Federal Information Security Management Act and Updated Guidance on Quarterly IT Security Reporting	OMB	OMB memorandum	August 6, 2003	Rescinded
None	Employees Responsible for the Management or Use of Federal Computer Systems	OPM	Proposed rule	September 4, 2003	Superseded
M-03-22	OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002	OMB	OMB memorandum	September 26, 2003	In effect
SP 800-50	Building an Information Technology Security Awareness and Training Program	NIST	NIST Special Publication	October 2003	Withdrawn
M-04-04	E-Authentication Guidance for Federal Agencies	OMB	OMB memorandum	December 16, 2003	Rescinded
HSPD-7	Critical Infrastructure Identification, Prioritization, and Protection	White House	Presidential directive	December 17, 2003	Superseded
SP 800-61	Computer Security Incident Handling Guide	NIST	NIST Special Publication	January 16, 2004	Withdrawn
FIPS 199	Standards for Security Categorization of Federal Information and Information Systems	NIST	FIPS standard	February 2004	In effect
SP 800-37	Guide for the Security Certification and Accreditation of Federal Information Systems	NIST	NIST Special Publication	May 20, 2004	Withdrawn
SP 800-60 Vol. 1	Guide for Mapping Types of Information and Information Systems to Security Categories	NIST	NIST Special Publication	June 10, 2004	Withdrawn
5 CFR 930.301	Information Security Responsibilities for Employees who Manage or Use Federal Information Systems	OPM	Regulation	June 14, 2004	In effect
SP 800-63	Electronic Authentication Guideline	NIST	NIST Special Publication	June 30, 2004	Withdrawn
M-04-16	Software Acquisition	OMB	OMB memorandum	July 1, 2004	In effect
M-04-25	FY 2004 Reporting Instructions for the Federal Information Security Management Act	OMB	OMB memorandum	August 23, 2004	Rescinded
HSPD-12	Policy for a Common Identification Standard for Federal Employees and Contractors	White House	Presidential directive	August 27, 2004	In effect
M-04-26	Personal Use Policies and "File Sharing" Technology	OMB	OMB memorandum	September 8, 2004	Rescinded
M-05-04	Policies for Federal Agency Public Websites	OMB	OMB memorandum	December 17, 2004	Rescinded
M-05-05	Electronic Signatures: How to Mitigate the Risk of Commercial Managed Services	OMB	OMB memorandum	December 20, 2004	Rescinded
M-05-08	Designation of Senior Agency Officials for Privacy	OMB	OMB memorandum	February 11, 2005	Rescinded
FIPS 201	Personal Identity Verification (PIV) of Federal Employees and Contractors	NIST	FIPS standard	February 25, 2005	Withdrawn
SP 800-53	Recommended Security Controls for Federal Information Systems	NIST	NIST Special Publication	February 28, 2005	Withdrawn
M-05-15	FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	June 13, 2005	Rescinded
M-05-22	Transition Planning for Internet Protocol Version 6 (IPv6)	OMB	OMB memorandum	August 2, 2005	Rescinded
M-05-24	Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors	OMB	OMB memorandum	August 5, 2005	In effect
FAR 52.204-9	Personal Identity Verification of Contractor Personnel	FAR Council	Contract clause	January 3, 2006	In effect
SP 800-18 Rev. 1	Guide for Developing Security Plans for Federal Information Systems	NIST	NIST Special Publication	February 24, 2006	Withdrawn
FIPS 200	Minimum Security Requirements for Federal Information and Information Systems	NIST	FIPS standard	March 2006	In effect
FIPS 201-1	Personal Identity Verification (PIV) of Federal Employees and Contractors	NIST	FIPS standard	March 31, 2006	Withdrawn
EO 13402	Strengthening Federal Efforts To Protect Against Identity Theft	White House	Executive order	May 10, 2006	In effect
M-06-15	Safeguarding Personally Identifiable Information	OMB	OMB memorandum	May 22, 2006	Rescinded
M-06-16	Protection of Sensitive Agency Information	OMB	OMB memorandum	June 23, 2006	Rescinded
M-06-18	Acquisition of Products and Services for Implementation of HSPD-12	OMB	OMB memorandum	June 30, 2006	Rescinded
M-06-19	Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments	OMB	OMB memorandum	July 12, 2006	Rescinded
M-06-20	FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 17, 2006	Rescinded
None	Recommendations for Identity Theft Related Data Breach Notification	OMB	OMB memorandum	September 20, 2006	Rescinded
SP 800-53 Rev. 1	Recommended Security Controls for Federal Information Systems	NIST	NIST Special Publication	December 19, 2006	Withdrawn
M-07-06	Validating and Monitoring Agency Issuance of Personal Identity Verification Credentials	OMB	OMB memorandum	January 11, 2007	Rescinded
M-07-11	Implementation of Commonly Accepted Security Configurations for Windows Operating Systems	OMB	OMB memorandum	March 22, 2007	Rescinded
M-07-16	Safeguarding Against and Responding to the Breach of Personally Identifiable Information	OMB	OMB memorandum	May 22, 2007	Rescinded

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email