Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 401 to 450.

Governance documents, sorted by date issued, oldest first. Page 9 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 9 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
NoneHigh Value Asset Control Overlay, Version 2.0CISACISA guidanceJanuary 2021In effect
Pub. L. 116-283, Div. ENational Artificial Intelligence Initiative Act of 2020CongressLawJanuary 1, 2021In effect
Pub. L. 116-283, § 1752National Cyber DirectorCongressLawJanuary 1, 2021In effect
EO 13971Addressing the Threat Posed by Applications and Other Software Developed or Controlled by Chinese CompaniesWhite HouseExecutive orderJanuary 5, 2021Rescinded
EO 13981Protecting the United States From Certain Unmanned Aircraft SystemsWhite HouseExecutive orderJanuary 18, 2021In effect
NoneSecuring the Information and Communications Technology and Services Supply ChainCommerceRegulationJanuary 19, 2021Superseded
EO 13984Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled ActivitiesWhite HouseExecutive orderJanuary 19, 2021In effect
SP 800-172Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171NISTNIST Special PublicationFebruary 2, 2021Withdrawn
ED 21-02Mitigate Microsoft Exchange On-Premises Product VulnerabilitiesCISAEmergency DirectiveMarch 3, 2021Retired
ED 21-03Mitigate Pulse Connect Secure Product VulnerabilitiesCISAEmergency DirectiveApril 20, 2021Retired
EO 14028Improving the Nation's CybersecurityWhite HouseExecutive orderMay 12, 2021In effect
EO 14034Protecting Americans' Sensitive Data From Foreign AdversariesWhite HouseExecutive orderJune 9, 2021In effect
ISOO Notice 2021-01Rescinding Approval of Pre-1989 General Services Administration (GSA)-Approved ContainersNARAISOO noticeJune 29, 2021Rescinded
ED 21-04Mitigate Windows Print Spooler Service VulnerabilityCISAEmergency DirectiveJuly 13, 2021Retired
ISOO Notice 2021-02Partial Waiver for the Declassification Review of Certain White House, National Security Council (NSC) and Homeland Security Council (HSC) RecordsNARAISOO noticeJuly 16, 2021In effect
NoneNational Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control SystemsWhite HousePresidential directiveJuly 28, 2021In effect
NoneVulnerability Disclosure Policy (VDP) PlatformCISACISA guidanceJuly 30, 2021In effect
M-21-30Protecting Critical Software Through Enhanced Security MeasuresOMBOMB memorandumAugust 10, 2021In effect
41 CFR Part 201-1Federal Acquisition Security Council RuleFASCRegulationAugust 26, 2021In effect
M-21-31Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity IncidentsOMBOMB memorandumAugust 27, 2021Rescinded
NoneZero Trust Maturity Model, Version 1.0CISACISA guidanceSeptember 7, 2021Superseded
ISOO Notice 2021-03Applying to the Technology Modernization Fund (TMF) to support classification and declassification improvementsNARAISOO noticeOctober 5, 2021In effect
IR 8397Guidelines on Minimum Standards for Developer Verification of SoftwareNISTNIST Interagency ReportOctober 6, 2021In effect
M-22-01Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and ResponseOMBOMB memorandumOctober 8, 2021In effect
NoneKnown Exploited Vulnerabilities CatalogCISACISA guidanceNovember 3, 2021In effect
BOD 22-01Reducing the Significant Risk of Known Exploited VulnerabilitiesCISABinding Operational DirectiveNovember 3, 2021Superseded
NoneFederal Government Cybersecurity Incident and Vulnerability Response PlaybooksCISACISA guidanceNovember 16, 2021In effect
NoneSecuring the Information and Communications Technology and Services Supply Chain; Connected Software ApplicationsCommerceProposed ruleNovember 26, 2021Superseded
SP 800-213IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity RequirementsNISTNIST Special PublicationNovember 29, 2021In effect
M-22-05Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumDecember 6, 2021Rescinded
EO 14058Transforming Federal Customer Experience and Service Delivery To Rebuild Trust in GovernmentWhite HouseExecutive orderDecember 13, 2021In effect
ED 22-02Mitigate Apache Log4j VulnerabilityCISAEmergency DirectiveDecember 17, 2021Retired
NSM-8Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community SystemsWhite HousePresidential directiveJanuary 19, 2022Superseded
FIPS 201-3Personal Identity Verification (PIV) of Federal Employees and ContractorsNISTFIPS standardJanuary 24, 2022In effect
SP 800-53A Rev. 5Assessing Security and Privacy Controls in Information Systems and OrganizationsNISTNIST Special PublicationJanuary 25, 2022In effect
M-22-09Moving the U.S. Government Toward Zero Trust Cybersecurity PrinciplesOMBOMB memorandumJanuary 26, 2022In effect
SP 800-218Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software VulnerabilitiesNISTNIST Special PublicationFebruary 3, 2022In effect
Pub. L. 117-103, Div. YCyber Incident Reporting for Critical Infrastructure Act of 2022CongressLawMarch 15, 2022In effect
SP 800-172AAssessing Enhanced Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMarch 15, 2022Withdrawn
SP 800-40 Rev. 4Guide to Enterprise Patch Management Planning: Preventive Maintenance for TechnologyNISTNIST Special PublicationApril 6, 2022In effect
NSM-10Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic SystemsWhite HousePresidential directiveMay 4, 2022In effect
SP 800-161 Rev. 1Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNISTNIST Special PublicationMay 5, 2022In effect
ISOO Notice 2022-01Digital Signatures on Standard Form (SF) 312, Classified Information Nondisclosure AgreementNARAISOO noticeMay 9, 2022In effect
ED 22-03Mitigate VMware VulnerabilitiesCISAEmergency DirectiveMay 18, 2022Retired
ISOO Notice 2022-02Declassification Guide Review RequirementsNARAISOO noticeMay 19, 2022In effect
Pub. L. 117-149Federal Rotational Cyber Workforce Program Act of 2021CongressLawJune 21, 2022In effect
M-22-16Administration Cybersecurity Priorities for the FY 2024 BudgetOMBOMB memorandumJuly 22, 2022Superseded
ISOO Notice 2022-03General Services Administration (GSA) Approved Security EquipmentNARAISOO noticeAugust 2022Rescinded
CUI Notice 2022-01Executive Agent Guidance Regarding White House National Security Council (NSC) Memorandum, "Initiating a Process to Review Information Management and Classification Policies," June 2, 2022NARACUI noticeSeptember 7, 2022Rescinded
M-22-18Enhancing the Security of the Software Supply Chain through Secure Software Development PracticesOMBOMB memorandumSeptember 14, 2022Rescinded

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.