Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

631 documents

Showing 201 to 250.

Governance documents, sorted by date issued, oldest first. Page 5 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 5 of 13.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
SP 800-40 Rev. 3	Guide to Enterprise Patch Management Technologies	NIST	NIST Special Publication	July 22, 2013	Withdrawn
M-13-20	Protecting Privacy while Reducing Improper Payments with the Do Not Pay Initiative	OMB	OMB memorandum	August 16, 2013	In effect
ISOO Notice 2013-05	Revision of the Standard Form (SF) 312, "Classified Information Nondisclosure Agreement"	NARA	ISOO notice	August 19, 2013	In effect
SP 800-63-2	Electronic Authentication Guideline	NIST	NIST Special Publication	August 29, 2013	Withdrawn
FIPS 201-2	Personal Identity Verification (PIV) of Federal Employees and Contractors	NIST	FIPS standard	September 5, 2013	Withdrawn
ISOO Notice 2013-06	Changes in Express Mail	NARA	ISOO notice	September 18, 2013	In effect
DFARS 252.204-7012	Safeguarding Covered Defense Information and Cyber Incident Reporting	DoD	Contract clause	November 18, 2013	In effect
DFARS 252.239-7018	Supply Chain Risk	DoD	Contract clause	November 18, 2013	In effect
M-14-03	Enhancing the Security of Federal Information and Information Systems	OMB	OMB memorandum	November 18, 2013	Rescinded
M-14-04	Fiscal Year 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	November 18, 2013	Superseded
CSWP 1	Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0	NIST	NIST framework	February 12, 2014	Superseded
ISOO Notice 2014-01	Appeal Rights for Mandatory Declassification Review Requests and the Rejection of Requests for Specific Reasons	NARA	ISOO notice	March 26, 2014	In effect
ISOO Notice 2014-02	Procurement of Security Equipment	NARA	ISOO notice	April 4, 2014	Rescinded
Pub. L. 113-101	Digital Accountability and Transparency Act of 2014	Congress	Law	May 9, 2014	In effect
CUI Joint Memo 2014-07-03	Revised Guidance regarding CUI and the Freedom of Information Act	NARA	CUI notice	July 3, 2014	Superseded
ISOO Notice 2014-03	U.S. Protection of Information Shared by the Government of the United Kingdom	NARA	ISOO notice	August 27, 2014	In effect
ISOO Notice 2014-04	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	September 5, 2014	Rescinded
M-14-16	Guidance on Managing Email	OMB	OMB memorandum	September 15, 2014	Rescinded
M-15-01	Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices	OMB	OMB memorandum	October 3, 2014	Rescinded
EO 13681	Improving the Security of Consumer Financial Transactions	White House	Executive order	October 17, 2014	In effect
Pub. L. 113-187	Presidential and Federal Records Act Amendments of 2014	Congress	Law	November 26, 2014	In effect
None	Policies for Dot Gov Domain Issuance for Federal Agency Public Websites	OMB	OMB memorandum	December 8, 2014	Rescinded
SP 800-53A Rev. 4	Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans	NIST	NIST Special Publication	December 11, 2014	Withdrawn
SP 800-88 Rev. 1	Guidelines for Media Sanitization	NIST	NIST Special Publication	December 17, 2014	Withdrawn
Pub. L. 113-274	Cybersecurity Enhancement Act of 2014	Congress	Law	December 18, 2014	In effect
Pub. L. 113-282	National Cybersecurity Protection Act of 2014	Congress	Law	December 18, 2014	In effect
Pub. L. 113-283	Federal Information Security Modernization Act of 2014	Congress	Law	December 18, 2014	In effect
Pub. L. 113-291, Title VIII, Subtitle D	Federal Information Technology Acquisition Reform	Congress	Law	December 19, 2014	In effect
EO 13691	Promoting Private Sector Cybersecurity Information Sharing	White House	Executive order	February 13, 2015	In effect
None	Establishment of the Cyber Threat Intelligence Integration Center	White House	Presidential directive	February 25, 2015	In effect
EO 13694	Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities	White House	Executive order	April 1, 2015	In effect
SP 800-161	Supply Chain Risk Management Practices for Federal Information Systems and Organizations	NIST	NIST Special Publication	April 8, 2015	Withdrawn
None	Controlled Unclassified Information	NARA	Proposed rule	May 8, 2015	Superseded
BOD 15-01	Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies' Internet-Accessible Systems	CISA	Binding Operational Directive	May 21, 2015	Superseded
ISOO Notice 2015-01	Withholding Authorities for Mandatory Declassification Review	NARA	ISOO notice	June 5, 2015	In effect
M-15-13	Policy to Require Secure Connections across Federal Websites and Web Services	OMB	OMB memorandum	June 8, 2015	In effect
M-15-14	Management and Oversight of Federal Information Technology	OMB	OMB memorandum	June 10, 2015	In effect
ISOO Notice 2015-02	Message from OPM to Security Clearance Holders	NARA	ISOO notice	June 16, 2015	Expired
SP 800-171	Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations	NIST	NIST Special Publication	June 18, 2015	Withdrawn
ISOO Notice 2015-04	Update on Recent Cyber Incidents at OPM	NARA	ISOO notice	July 10, 2015	Expired
FIPS 202	SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions	NIST	FIPS standard	August 4, 2015	In effect
EO 13704	Presidential Innovation Fellows Program	White House	Executive order	August 17, 2015	In effect
DFARS 252.239-7010	Cloud Computing Services	DoD	Contract clause	August 26, 2015	In effect
ISOO Notice 2015-05	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	September 25, 2015	Rescinded
M-16-02	Category Management Policy 15-1: Improving the Acquisition and Management of Common Information Technology: Laptops and Desktops	OMB	OMB memorandum	October 16, 2015	In effect
M-16-03	Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 30, 2015	Rescinded
M-16-04	Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government	OMB	OMB memorandum	October 30, 2015	Rescinded
SP 800-131A Rev. 1	Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths	NIST	NIST Special Publication	November 6, 2015	Withdrawn
Pub. L. 114-113, Div. N	Cybersecurity Act of 2015	Congress	Law	December 18, 2015	In effect
Pub. L. 114-113, Div. N, Title II, Subtitle B	Federal Cybersecurity Enhancement Act of 2015	Congress	Law	December 18, 2015	In effect

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email