Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

631 documents

Showing 351 to 400.

Governance documents, sorted by date issued, oldest first. Page 8 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 8 of 13.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
M-20-04	Fiscal Year 2019-2020 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 19, 2019	Rescinded
None	Securing the Information and Communications Technology and Services Supply Chain	Commerce	Proposed rule	November 27, 2019	Superseded
FAR 52.204-26	Covered Telecommunications Equipment or Services—Representation	FAR Council	Contract clause	December 13, 2019	In effect
DFARS 252.204-7018	Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services	DoD	Contract clause	December 31, 2019	In effect
ED 20-02	Mitigate Windows Vulnerabilities from January 2020 Patch Tuesday	CISA	Emergency Directive	January 14, 2020	Retired
CSWP 10	NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0	NIST	NIST framework	January 16, 2020	In effect
EO 13905	Strengthening National Resilience Through Responsible Use of Positioning, Navigation, and Timing Services	White House	Executive order	February 12, 2020	In effect
SP 800-171 Rev. 2	Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations	NIST	NIST Special Publication	February 21, 2020	Withdrawn
IR 8170	Approaches for Federal Agencies to Use the Cybersecurity Framework	NIST	NIST Interagency Report	March 19, 2020	In effect
M-20-19	Harnessing Technology to Support Mission Continuity	OMB	OMB memorandum	March 22, 2020	In effect
CUI Memo 2020-03-30	Applying Exigent Circumstances Waiver to CUI Safeguarding Requirements While Teleworking in Response to the COVID-19 Pandemic	NARA	CUI notice	March 30, 2020	Rescinded
EO 13913	Establishing the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector	White House	Executive order	April 4, 2020	In effect
EO 13920	Securing the United States Bulk-Power System	White House	Executive order	May 1, 2020	Expired
ISOO Notice 2020-01	COVID-19 guidelines and alternative operating methods for alarm monitoring industry	NARA	ISOO notice	May 12, 2020	Rescinded
CUI Notice 2020-01	CUI Program Implementation Deadlines	NARA	CUI notice	May 14, 2020	Rescinded
CUI Notice 2020-02	Alternate Marking Methods	NARA	CUI notice	June 3, 2020	Rescinded
CUI Notice 2020-03	CUI Non-Disclosure Agreement Template Memo	NARA	CUI notice	June 3, 2020	In effect
CUI Notice 2020-04	Assessing Security Requirements for CUI in Non-Federal Information Systems	NARA	CUI notice	June 16, 2020	In effect
ED 20-03	Mitigate Windows DNS Server Remote Code Execution Vulnerability from July 2020 Patch Tuesday	CISA	Emergency Directive	July 16, 2020	Retired
None	Trusted Internet Connections (TIC) 3.0 Core Guidance Documents	CISA	CISA guidance	July 31, 2020	In effect
EO 13942	Addressing the Threat Posed by TikTok, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply Chain	White House	Executive order	August 6, 2020	Rescinded
EO 13943	Addressing the Threat Posed by WeChat, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply Chain	White House	Executive order	August 6, 2020	Rescinded
SP 800-207	Zero Trust Architecture	NIST	NIST Special Publication	August 11, 2020	In effect
CUI Notice 2020-05	Using Exigent Circumstances Waivers	NARA	CUI notice	August 20, 2020	Rescinded
ISOO Notice 2020-02	Transmitting Classified Information	NARA	ISOO notice	August 24, 2020	In effect
None	Federal Acquisition Supply Chain Security Act	FASC	Regulation	September 1, 2020	Superseded
BOD 20-01	Develop and Publish a Vulnerability Disclosure Policy	CISA	Binding Operational Directive	September 2, 2020	In effect
M-20-32	Improving Vulnerability Identification, Management, and Remediation	OMB	OMB memorandum	September 2, 2020	In effect
SPD-5	Cybersecurity Principles for Space Systems	White House	Presidential directive	September 4, 2020	In effect
ED 20-04	Mitigate Netlogon Elevation of Privilege Vulnerability from August 2020 Patch Tuesday	CISA	Emergency Directive	September 18, 2020	Retired
SP 800-53 Rev. 5	Security and Privacy Controls for Information Systems and Organizations	NIST	NIST Special Publication	September 23, 2020	In effect
DFARS Case 2019-D041	Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)	DoD	Regulation	September 29, 2020	In effect
CUI Notice 2020-06	Limited Marking Waiver Best Practices to Alert Users of CUI	NARA	CUI notice	October 1, 2020	Rescinded
CUI Notice 2020-07	Using Alternate Designation Indicators (ADI) with CUI	NARA	CUI notice	October 2, 2020	Rescinded
IR 8286	Integrating Cybersecurity and Enterprise Risk Management (ERM)	NIST	NIST Interagency Report	October 13, 2020	Withdrawn
SP 800-53B	Control Baselines for Information Systems and Organizations	NIST	NIST Special Publication	October 29, 2020	In effect
M-21-02	Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 9, 2020	Rescinded
M-21-04	Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act	OMB	OMB memorandum	November 12, 2020	In effect
M-21-05	Extension of Data Center Optimization Initiative (DCOI)	OMB	OMB memorandum	November 13, 2020	Expired
SP 800-181 Rev. 1	Workforce Framework for Cybersecurity (NICE Framework)	NIST	NIST Special Publication	November 16, 2020	In effect
M-21-07	Completing the Transition to Internet Protocol Version 6 (IPv6)	OMB	OMB memorandum	November 19, 2020	In effect
DFARS 252.204-7019	Notice of NIST SP 800-171 DoD Assessment Requirements	DoD	Contract clause	November 30, 2020	In effect
DFARS 252.204-7020	NIST SP 800-171 DoD Assessment Requirements	DoD	Contract clause	November 30, 2020	In effect
DFARS 252.204-7021	Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements	DoD	Contract clause	November 30, 2020	In effect
EO 13960	Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government	White House	Executive order	December 3, 2020	In effect
Pub. L. 116-194	Information Technology Modernization Centers of Excellence Program Act	Congress	Law	December 3, 2020	In effect
Pub. L. 116-207	Internet of Things Cybersecurity Improvement Act of 2020	Congress	Law	December 4, 2020	In effect
ED 21-01	Mitigate SolarWinds Orion Code Compromise	CISA	Emergency Directive	December 13, 2020	Retired
Pub. L. 116-260, Div. U, Title I	AI in Government Act of 2020	Congress	Law	December 27, 2020	In effect
Pub. L. 116-260, Div. U, Title IX	DOTGOV Act of 2020	Congress	Law	December 27, 2020	In effect

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email