Skip to content
FedXchange
Menu

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

109 documents match these filters

Filters: Acquisition.

Showing 51 to 100.

Governance documents, sorted by date issued, oldest first. Page 2 of 3.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 2 of 3.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
41 CFR Part 201-1Federal Acquisition Security Council RuleFASCRegulationAugust 26, 2021In effect
SP 800-213IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity RequirementsNISTNIST Special PublicationNovember 29, 2021In effect
SP 800-172AAssessing Enhanced Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMarch 15, 2022Withdrawn
SP 800-161 Rev. 1Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNISTNIST Special PublicationMay 5, 2022In effect
M-22-18Enhancing the Security of the Software Supply Chain through Secure Software Development PracticesOMBOMB memorandumSeptember 14, 2022Rescinded
Pub. L. 117-207Artificial Intelligence Training for the Acquisition Workforce ActCongressLawOctober 17, 2022In effect
Pub. L. 117-263, Div. G, Title LXXII, Subtitle BAdvancing American AI ActCongressLawDecember 23, 2022In effect
Pub. L. 117-263, § 5949Prohibition on Certain Semiconductor Products and ServicesCongressLawDecember 23, 2022In effect
EO 14093Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National SecurityWhite HouseExecutive orderMarch 27, 2023In effect
NoneDepartment of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) ActivitiesDoDProposed ruleMay 3, 2023Superseded
FAR 52.204-27Prohibition on a ByteDance Covered ApplicationFAR CouncilContract clauseJune 2, 2023In effect
FAR Case 2021-017Federal Acquisition Regulation: Cyber Threat and Incident Reporting and Information SharingFAR CouncilProposed ruleOctober 3, 2023Proposed
FAR Case 2021-019Federal Acquisition Regulation: Standardizing Cybersecurity Requirements for Unclassified Federal Information SystemsFAR CouncilProposed ruleOctober 3, 2023Proposed
FAR Case 2020-011Federal Acquisition Regulation: Implementation of Federal Acquisition Supply Chain Security Act (FASCSA) OrdersFAR CouncilRegulationOctober 5, 2023In effect
FAR 52.204-28Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency ContractsFAR CouncilContract clauseDecember 4, 2023In effect
FAR 52.204-29Federal Acquisition Supply Chain Security Act Orders—Representation and DisclosuresFAR CouncilContract clauseDecember 4, 2023In effect
FAR 52.204-30Federal Acquisition Supply Chain Security Act Orders—ProhibitionFAR CouncilContract clauseDecember 4, 2023In effect
M-24-08Strengthening Digital Accessibility and the Management of Section 508 of the Rehabilitation ActOMBOMB memorandumDecember 21, 2023In effect
Pub. L. 118-31, Title XVIII, Subtitle BAmerican Security Drone Act of 2023CongressLawDecember 22, 2023In effect
NoneCybersecurity Maturity Model Certification (CMMC) ProgramDoDProposed ruleDecember 26, 2023Superseded
NoneSecure Software Development Attestation FormCISACISA guidanceMarch 11, 2024In effect
FAR Part 40Information Security and Supply Chain SecurityFAR CouncilRegulationApril 1, 2024In effect
FAR Case 2023-008Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and ServicesFAR CouncilProposed ruleMay 3, 2024Superseded
SP 800-171 Rev. 3Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsNISTNIST Special PublicationMay 14, 2024In effect
SP 800-171A Rev. 3Assessing Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMay 14, 2024In effect
DFARS Case 2019-D041Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)DoDProposed ruleAugust 15, 2024Superseded
M-24-18Advancing the Responsible Acquisition of Artificial Intelligence in GovernmentOMBOMB memorandumSeptember 24, 2024Rescinded
32 CFR Part 170Cybersecurity Maturity Model Certification (CMMC) ProgramDoDRegulationOctober 15, 2024In effect
NoneFederal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign EntitiesFAR CouncilRegulationNovember 12, 2024In effect
FAR 52.240-1Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign EntitiesFAR CouncilContract clauseNovember 12, 2024In effect
FAR Case 2017-016Federal Acquisition Regulation: Controlled Unclassified InformationFAR CouncilProposed ruleJanuary 15, 2025Superseded
EO 14240Eliminating Waste and Saving Taxpayer Dollars by Consolidating ProcurementWhite HouseExecutive orderMarch 20, 2025In effect
M-25-22Driving Efficient Acquisition of Artificial Intelligence in GovernmentOMBOMB memorandumApril 3, 2025In effect
EO 14275Restoring Common Sense to Federal ProcurementWhite HouseExecutive orderApril 15, 2025In effect
M-25-31Consolidating Federal Procurement ActivitiesOMBOMB memorandumJuly 18, 2025In effect
EO 14319Preventing Woke AI in the Federal GovernmentWhite HouseExecutive orderJuly 23, 2025In effect
NonePrioritizing 20x Authorizations for AI Cloud SolutionsGSA and FedRAMPFedRAMP policyAugust 25, 2025In effect
DFARS Case 2019-D041Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)DoDRegulationSeptember 10, 2025In effect
DFARS 252.204-7025Notice of Cybersecurity Maturity Model Certification Level RequirementsDoDContract clauseNovember 10, 2025In effect
M-26-02Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States ProducersOMBOMB memorandumNovember 21, 2025In effect
M-26-04Increasing Public Trust in Artificial Intelligence Through Unbiased AI PrinciplesOMBOMB memorandumDecember 11, 2025In effect
FAR Case 2023-008Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and ServicesFAR CouncilProposed ruleFebruary 17, 2026Proposed
M-26-10Reinforcing Transparency, Accountability, and Oversight of Federal TechnologyOMBOMB memorandumMarch 31, 2026In effect
SP 800-172 Rev. 3Enhanced Security Requirements for Protecting Controlled Unclassified InformationNISTNIST Special PublicationMay 13, 2026In effect
SP 800-172A Rev. 3Assessing Enhanced Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMay 13, 2026In effect
NSPM-11Artificial Intelligence in the National Security EnterpriseWhite HousePresidential directiveJune 5, 2026In effect
NoneFederal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 6, 7, 10, 18, 26, 37, and 41FAR CouncilProposed ruleJune 23, 2026Proposed
NoneFederal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 5, 24, and 29FAR CouncilProposed ruleJune 23, 2026Proposed
NoneFederal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 3 and 49FAR CouncilProposed ruleJune 23, 2026Proposed
FAR Case 2026-001Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53FAR CouncilProposed ruleJune 23, 2026Proposed

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.