Skip to content
FedXchange
Menu

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

68 documents match these filters

Filters: Privacy.

Showing 51 to 68.

Governance documents, sorted by date issued, oldest first. Page 2 of 2.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 2 of 2.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
Pub. L. 115-435Foundations for Evidence-Based Policymaking Act of 2018CongressLawJanuary 14, 2019In effect
CSWP 10NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0NISTNIST frameworkJanuary 16, 2020In effect
EO 13942Addressing the Threat Posed by TikTok, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply ChainWhite HouseExecutive orderAugust 6, 2020Rescinded
EO 13943Addressing the Threat Posed by WeChat, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply ChainWhite HouseExecutive orderAugust 6, 2020Rescinded
SP 800-53 Rev. 5Security and Privacy Controls for Information Systems and OrganizationsNISTNIST Special PublicationSeptember 23, 2020In effect
SP 800-53BControl Baselines for Information Systems and OrganizationsNISTNIST Special PublicationOctober 29, 2020In effect
M-21-04Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy ActOMBOMB memorandumNovember 12, 2020In effect
EO 13971Addressing the Threat Posed by Applications and Other Software Developed or Controlled by Chinese CompaniesWhite HouseExecutive orderJanuary 5, 2021Rescinded
EO 14034Protecting Americans' Sensitive Data From Foreign AdversariesWhite HouseExecutive orderJune 9, 2021In effect
SP 800-53A Rev. 5Assessing Security and Privacy Controls in Information Systems and OrganizationsNISTNIST Special PublicationJanuary 25, 2022In effect
EO 14083Ensuring Robust Consideration of Evolving National Security Risks by the Committee on Foreign Investment in the United StatesWhite HouseExecutive orderSeptember 15, 2022In effect
EO 14117Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of ConcernWhite HouseExecutive orderFebruary 28, 2024In effect
Pub. L. 118-50, Div. IProtecting Americans' Data from Foreign Adversaries Act of 2024CongressLawApril 24, 2024In effect
SP 800-50 Rev. 1Building a Cybersecurity and Privacy Learning ProgramNISTNIST Special PublicationSeptember 12, 2024In effect
EO 14243Stopping Waste, Fraud, and Abuse by Eliminating Information SilosWhite HouseExecutive orderMarch 20, 2025In effect
M-25-32Preventing Improper Payments and Protecting Privacy Through Do Not PayOMBOMB memorandumAugust 20, 2025In effect
SP 800-18 Rev. 2Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for SystemsNISTNIST Special PublicationJune 30, 2026In effect
EO 14432Streamlining Access to Government Services Through America.govWhite HouseExecutive orderSeptember 29, 2026In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.