Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 251 to 300.

Governance documents, sorted by date issued, oldest first. Page 6 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 6 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
Pub. L. 114-113, Div. N, Title IIIFederal Cybersecurity Workforce Assessment Act of 2015CongressLawDecember 18, 2015In effect
EO 13718Commission on Enhancing National CybersecurityWhite HouseExecutive orderFebruary 9, 2016Expired
EO 13719Establishment of the Federal Privacy CouncilWhite HouseExecutive orderFebruary 9, 2016In effect
M-16-12Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software LicensingOMBOMB memorandumJune 2, 2016In effect
BOD 16-01Securing High Value AssetsCISABinding Operational DirectiveJune 9, 2016Superseded
FAR 52.204-21Basic Safeguarding of Covered Contractor Information SystemsFAR CouncilContract clauseJune 15, 2016In effect
NoneFedRAMP High Baseline RequirementsGSA and FedRAMPFedRAMP policyJune 23, 2016Superseded
M-16-14Category Management Policy 16-2: Providing Comprehensive Identity Protection Services, Identity Monitoring, and Data Breach ResponseOMBOMB memorandumJuly 1, 2016In effect
M-16-15Federal Cybersecurity Workforce StrategyOMBOMB memorandumJuly 12, 2016In effect
Circular A-123Management's Responsibility for Enterprise Risk Management and Internal ControlOMBOMB circularJuly 15, 2016Superseded
PPD-41United States Cyber Incident CoordinationWhite HousePresidential directiveJuly 26, 2016In effect
Circular A-130Managing Information as a Strategic ResourceOMBOMB circularJuly 28, 2016In effect
Pub. L. 114-210Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act of 2016)CongressLawJuly 29, 2016In effect
M-16-19Data Center Optimization Initiative (DCOI)OMBOMB memorandumAugust 1, 2016Rescinded
M-16-20Category Management Policy 16-3: Improving the Acquisition and Management of Common Information Technology: Mobile Devices and ServicesOMBOMB memorandumAugust 4, 2016In effect
M-16-21Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source SoftwareOMBOMB memorandumAugust 8, 2016In effect
32 CFR Part 2002Controlled Unclassified Information (CUI)NARARegulationSeptember 14, 2016In effect
CUI Notice 2016-01Implementation Guidance for the Controlled Unclassified Information ProgramNARACUI noticeSeptember 14, 2016Rescinded
M-16-24Role and Designation of Senior Agency Officials for PrivacyOMBOMB memorandumSeptember 15, 2016In effect
CUI Handbook 2016-09-16Marking CUI (Marking Handbook)NARACUI noticeSeptember 16, 2016Superseded
BOD 16-02Threat to Network Infrastructure DevicesCISABinding Operational DirectiveSeptember 27, 2016Retired
32 CFR Part 236Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) ActivitiesDoDRegulationOctober 4, 2016In effect
BOD 16-032016 Agency Cybersecurity Reporting RequirementsCISABinding Operational DirectiveOctober 17, 2016In effect
M-17-05Fiscal Year 2016-2017 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumNovember 4, 2016Rescinded
M-17-06Policies for Federal Agency Public Websites and Digital ServicesOMBOMB memorandumNovember 8, 2016Rescinded
SP 800-160 Vol. 1Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure SystemsNISTNIST Special PublicationNovember 14, 2016Withdrawn
CUI Handbook 2016-12-06Marking CUI Rev 1.1 (Marking Handbook)NARACUI noticeDecember 6, 2016In effect
M-17-09Management of Federal High Value AssetsOMBOMB memorandumDecember 9, 2016Rescinded
SP 800-171 Rev. 1Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsNISTNIST Special PublicationDecember 20, 2016Withdrawn
Circular A-108Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy ActOMBOMB circularDecember 23, 2016In effect
EO 13757Taking Additional Steps to Address the National Emergency With Respect to Significant Malicious Cyber-Enabled ActivitiesWhite HouseExecutive orderDecember 28, 2016In effect
NoneFedRAMP Tailored for Low-Impact Software-as-a-Service (LI-SaaS)GSA and FedRAMPFedRAMP policy2017In effect
M-17-12Preparing for and Responding to a Breach of Personally Identifiable InformationOMBOMB memorandumJanuary 3, 2017In effect
FAR 52.224-3Privacy TrainingFAR CouncilContract clauseJanuary 19, 2017In effect
M-17-15Rescission of Memoranda Relating to Identity ManagementOMBOMB memorandumJanuary 19, 2017In effect
NoneFederal Incident Notification GuidelinesCISACISA guidanceApril 1, 2017In effect
ISOO Notice 2017-02Clarification of Classification by CompilationNARAISOO noticeApril 17, 2017In effect
EO 13794Establishment of the American Technology CouncilWhite HouseExecutive orderApril 28, 2017In effect
EO 13800Strengthening the Cybersecurity of Federal Networks and Critical InfrastructureWhite HouseExecutive orderMay 11, 2017In effect
M-17-25Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical InfrastructureOMBOMB memorandumMay 19, 2017Rescinded
CUI Notice 2017-01Implementation Recommendations for the CUI ProgramNARACUI noticeJune 12, 2017In effect
M-17-26Reducing Burden for Federal Agencies by Rescinding and Modifying OMB MemorandaOMBOMB memorandumJune 15, 2017In effect
SP 800-63-3Digital Identity GuidelinesNISTNIST Special PublicationJune 22, 2017Withdrawn
ISOO Notice 2017-03National Security Council (NSC) Partial Waiver for the Declassification Review of Certain White House and NSC RecordsNARAISOO noticeJuly 12, 2017Rescinded
SP 800-181National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce FrameworkNISTNIST Special PublicationAugust 7, 2017Withdrawn
CUI Notice 2017-02Controlled Unclassified Information (CUI) and Multi-Step Destruction ProcessNARACUI noticeAugust 17, 2017Superseded
BOD 17-01Removal of Kaspersky-branded ProductsCISABinding Operational DirectiveSeptember 13, 2017Retired
ISOO Notice 2017-04Security Classification GuidesNARAISOO noticeSeptember 14, 2017In effect
Pub. L. 115-59Social Security Number Fraud Prevention Act of 2017CongressLawSeptember 15, 2017In effect
BOD 18-01Enhance Email and Web SecurityCISABinding Operational DirectiveOctober 16, 2017In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.