Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

631 documents

Showing 151 to 200.

Governance documents, sorted by date issued, oldest first. Page 4 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 4 of 13.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
EO 13549	Classified National Security Information Program for State, Local, Tribal, and Private Sector Entities	White House	Executive order	August 18, 2010	In effect
None	Transition to IPv6	OMB	OMB memorandum	September 28, 2010	Rescinded
ISOO Notice 2010-02	Agencies Eligible/Ineligible to Receive Referrals	NARA	ISOO notice	September 30, 2010	Rescinded
M-11-02	Sharing Data While Protecting Privacy	OMB	OMB memorandum	November 3, 2010	In effect
EO 13556	Controlled Unclassified Information	White House	Executive order	November 4, 2010	In effect
M-11-08	Initial Assessments of Safeguarding and Counterintelligence Postures for Classified National Security Information in Automated Systems	OMB	OMB memorandum	January 3, 2011	In effect
SP 800-131A	Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths	NIST	NIST Special Publication	January 13, 2011	Withdrawn
M-11-11	Continued Implementation of Homeland Security Presidential Directive (HSPD) 12– Policy for a Common Identification Standard for Federal Employees and Contractors	OMB	OMB memorandum	February 3, 2011	Rescinded
SP 800-39	Managing Information Security Risk: Organization, Mission, and Information System View	NIST	NIST Special Publication	March 2011	In effect
ISOO Notice 2011-01	Review and Approval of Exemptions to Automatic Declassification Pursuant to Sections 3.3(b) and 3.3(h) of Executive Order 13526	NARA	ISOO notice	April 28, 2011	Rescinded
ISOO Notice 2011-02	Further Guidance and Clarification on Commingling Atomic Energy Information and Classified National Security Information	NARA	ISOO notice	May 18, 2011	In effect
CUI Office Notice 2011-01	Initial Implementation Guidance for Executive Order 13556	NARA	CUI notice	June 9, 2011	Superseded
DFARS Case 2011-D039	Defense Federal Acquisition Regulation Supplement; Safeguarding Unclassified DoD Information (DFARS Case 2011-D039)	DoD	Proposed rule	June 29, 2011	Superseded
M-11-27	Implementing the Telework Enhancement Act of 2010: Security Guidelines	OMB	OMB memorandum	July 15, 2011	In effect
M-11-29	Chief Information Officer Authorities	OMB	OMB memorandum	August 8, 2011	Rescinded
SP 800-128	Guide for Security-Focused Configuration Management of Information Systems	NIST	NIST Special Publication	August 12, 2011	In effect
M-11-33	FY 2011 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 14, 2011	Superseded
SP 800-145	The NIST Definition of Cloud Computing	NIST	NIST Special Publication	September 28, 2011	In effect
SP 800-137	Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations	NIST	NIST Special Publication	September 30, 2011	In effect
None	Requirements for Accepting Externally-Issued Identity Credentials	OMB	OMB memorandum	October 6, 2011	Rescinded
EO 13587	Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information	White House	Executive order	October 7, 2011	In effect
CUI Joint Memo 2011-11-22	CUI and the Freedom of Information Act	NARA	CUI notice	November 22, 2011	Superseded
None	Managing Government Records	White House	Presidential directive	November 28, 2011	In effect
None	Security Authorization of Information Systems in Cloud Computing Environments	OMB	OMB memorandum	December 8, 2011	Rescinded
ISOO Notice 2012-01	Requirements for Derivative Classifier Training	NARA	ISOO notice	December 8, 2011	In effect
SP 800-63-1	Electronic Authentication Guideline	NIST	NIST Special Publication	December 12, 2011	Withdrawn
ISOO Notice 2012-02	Classification Marking Instructions on the Use of "50X1-HUM" vs "25X1-human" as a Declassification Instruction	NARA	ISOO notice	December 23, 2011	In effect
FIPS 180-4	Secure Hash Standard (SHS)	NIST	FIPS standard	March 6, 2012	In effect
M-12-10	Implementing PortfolioStat	OMB	OMB memorandum	March 30, 2012	In effect
None	Building a 21st Century Digital Government	White House	Presidential directive	May 23, 2012	In effect
None	FedRAMP becomes operational	GSA and FedRAMP	FedRAMP policy	June 2012	In effect
CUI Memo 2012-07-27	Review of Proposed Categories for CUI Registry	NARA	CUI notice	July 27, 2012	Superseded
SP 800-61 Rev. 2	Computer Security Incident Handling Guide	NIST	NIST Special Publication	August 6, 2012	Withdrawn
None	Federal Acquisition Regulation; Basic Safeguarding of Contractor Information Systems	FAR Council	Proposed rule	August 24, 2012	Superseded
M-12-18	Managing Government Records Directive	OMB	OMB memorandum	August 24, 2012	Rescinded
SP 800-30 Rev. 1	Guide for Conducting Risk Assessments	NIST	NIST Special Publication	September 17, 2012	In effect
M-12-20	FY 2012 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 27, 2012	Superseded
ISOO Notice 2012-04	Additional Guidance on Standards for Security Equipment	NARA	ISOO notice	October 12, 2012	Rescinded
ISOO Notice 2013-01	Further Marking Guidance on Commingling North Atlantic Treaty Organization (NATO) and Classified National Security Information (NSI)	NARA	ISOO notice	November 1, 2012	In effect
ISOO Notice 2013-02	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	January 23, 2013	Rescinded
EO 13636	Improving Critical Infrastructure Cybersecurity	White House	Executive order	February 12, 2013	In effect
PPD-21	Critical Infrastructure Security and Resilience	White House	Presidential directive	February 12, 2013	Superseded
ISOO Notice 2013-03	Processing of Mandatory Declassification Review Requests Appealed to the Interagency Security Classification Appeals Panel	NARA	ISOO notice	April 10, 2013	In effect
CUI Memo 2013-04-11	Appointments of Senior Agency Official and Program Manager for CUI Program Implementation	NARA	CUI notice	April 11, 2013	In effect
SP 800-53 Rev. 4	Security and Privacy Controls for Federal Information Systems and Organizations	NIST	NIST Special Publication	April 30, 2013	Withdrawn
EO 13642	Making Open and Machine Readable the New Default for Government Information	White House	Executive order	May 9, 2013	In effect
M-13-13	Open Data Policy—Managing Information as an Asset	OMB	OMB memorandum	May 9, 2013	Rescinded
CUI Office Notice 2013-01	Provisional Approval of Proposed CUI Categories and Subcategories	NARA	CUI notice	May 22, 2013	Superseded
ISOO Notice 2013-04	The National Security Staff (NSS) Partial Waiver for the Declassification Review of Select National Security Council and White House Classified Records	NARA	ISOO notice	June 14, 2013	Rescinded
FIPS 186-4	Digital Signature Standard (DSS)	NIST	FIPS standard	July 19, 2013	Withdrawn

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email