Skip to content
FedXchange
Menu

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

140 documents match these filters

Filters: CUI and classified information.

Showing 1 to 50.

Governance documents, sorted by date issued, oldest first. Page 1 of 3.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 1 of 3.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort newest firstStatus, sort A to Z
EO 12065National Security InformationWhite HouseExecutive orderJune 28, 1978Superseded
EO 12356National Security InformationWhite HouseExecutive orderApril 2, 1982Superseded
NSDD-145National Policy on Telecommunications and Automated Information Systems SecurityWhite HousePresidential directiveSeptember 17, 1984Superseded
NSD-42National Policy for the Security of National Security Telecommunications and Information SystemsWhite HousePresidential directiveJuly 5, 1990Superseded
EO 12829National Industrial Security ProgramWhite HouseExecutive orderJanuary 6, 1993In effect
EO 12958Classified National Security InformationWhite HouseExecutive orderApril 17, 1995Superseded
EO 12968Access to Classified InformationWhite HouseExecutive orderAugust 2, 1995In effect
EO 13292Further Amendment to Executive Order 12958, as Amended, Classified National Security InformationWhite HouseExecutive orderMarch 25, 2003Superseded
NoneDesignation and Sharing of Controlled Unclassified Information (CUI)White HousePresidential directiveMay 7, 2008Superseded
EO 13467Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security InformationWhite HouseExecutive orderJune 30, 2008In effect
ISOO Notice 2009-01Use of Standard Form 715, "Declassification Review Tab"NARAISOO noticeOctober 10, 2008In effect
ISOO Notice 2009-02Initial Instructions on the Use of the SF 715, "Declassification Review Tab"NARAISOO noticeOctober 10, 2008In effect
ISOO Notice 2009-03Notification, Coordination, and Documentation Related to Subsequent Reviews Conducted by Primary Reviewing Agencies [Related to Automatic Declassification]NARAISOO noticeOctober 10, 2008In effect
ISOO Notice 2009-04"Best Practices" for Declassification Review Record KeepingNARAISOO noticeOctober 10, 2008In effect
ISOO Notice 2009-05Agencies Ineligible to Receive Referrals Identified by Primary Reviewing Agencies Amongst Records Subject to Automatic Declassification on December 31st of 2006, 2007, and 2008NARAISOO noticeOctober 10, 2008Rescinded
ISOO Notice 2009-06Handling NATO Information Identified during Automatic Declassification ProcessingNARAISOO noticeDecember 12, 2008Rescinded
ISOO Notice 2009-07Mandatory Declassification Review – Inappropriate Citation of Section 6.2(d) of E.O. 13526NARAISOO noticeJanuary 8, 2009In effect
ISOO Notice 2009-08Utilization of Classified AddendaNARAISOO noticeJanuary 8, 2009Rescinded
ISOO Notice 2009-09Derivative Classification – Identification of Multiple SourcesNARAISOO noticeJanuary 9, 2009Rescinded
ISOO Notice 2009-10Security Violation Reporting to ISOONARAISOO noticeApril 28, 2009Rescinded
ISOO Notice 2009-11Prohibited Use of the Markings "MR" (Manual Review) and "Source Marked MR, date of source [date]"NARAISOO noticeMay 8, 2009Rescinded
ISOO Notice 2009-12Prohibited Use of the Marking "OADR"NARAISOO noticeMay 8, 2009Rescinded
ISOO Notice 2009-13Prohibited Use of X1-X8 MarkingsNARAISOO noticeMay 8, 2009Rescinded
NoneClassified Information and Controlled Unclassified InformationWhite HousePresidential directiveMay 27, 2009In effect
ISOO Notice 2009-14Corrections to Citations in 32 C.F.R. Part 2001 Referencing Open Storage AreasNARAISOO noticeJune 9, 2009Rescinded
ISOO Notice 2009-15Further Definition of "Comparable Media" as it Relates to Delays in the Onset of Automatic DeclassificationNARAISOO noticeJuly 16, 2009Rescinded
EO 13526Classified National Security InformationWhite HouseExecutive orderDecember 29, 2009In effect
EO 13549Classified National Security Information Program for State, Local, Tribal, and Private Sector EntitiesWhite HouseExecutive orderAugust 18, 2010In effect
ISOO Notice 2010-02Agencies Eligible/Ineligible to Receive ReferralsNARAISOO noticeSeptember 30, 2010Rescinded
EO 13556Controlled Unclassified InformationWhite HouseExecutive orderNovember 4, 2010In effect
M-11-08Initial Assessments of Safeguarding and Counterintelligence Postures for Classified National Security Information in Automated SystemsOMBOMB memorandumJanuary 3, 2011In effect
ISOO Notice 2011-01Review and Approval of Exemptions to Automatic Declassification Pursuant to Sections 3.3(b) and 3.3(h) of Executive Order 13526NARAISOO noticeApril 28, 2011Rescinded
ISOO Notice 2011-02Further Guidance and Clarification on Commingling Atomic Energy Information and Classified National Security InformationNARAISOO noticeMay 18, 2011In effect
CUI Office Notice 2011-01Initial Implementation Guidance for Executive Order 13556NARACUI noticeJune 9, 2011Superseded
DFARS Case 2011-D039Defense Federal Acquisition Regulation Supplement; Safeguarding Unclassified DoD Information (DFARS Case 2011-D039)DoDProposed ruleJune 29, 2011Superseded
EO 13587Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified InformationWhite HouseExecutive orderOctober 7, 2011In effect
CUI Joint Memo 2011-11-22CUI and the Freedom of Information ActNARACUI noticeNovember 22, 2011Superseded
ISOO Notice 2012-01Requirements for Derivative Classifier TrainingNARAISOO noticeDecember 8, 2011In effect
ISOO Notice 2012-02Classification Marking Instructions on the Use of "50X1-HUM" vs "25X1-human" as a Declassification InstructionNARAISOO noticeDecember 23, 2011In effect
CUI Memo 2012-07-27Review of Proposed Categories for CUI RegistryNARACUI noticeJuly 27, 2012Superseded
ISOO Notice 2012-04Additional Guidance on Standards for Security EquipmentNARAISOO noticeOctober 12, 2012Rescinded
ISOO Notice 2013-01Further Marking Guidance on Commingling North Atlantic Treaty Organization (NATO) and Classified National Security Information (NSI)NARAISOO noticeNovember 1, 2012In effect
ISOO Notice 2013-02Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 YearsNARAISOO noticeJanuary 23, 2013Rescinded
ISOO Notice 2013-03Processing of Mandatory Declassification Review Requests Appealed to the Interagency Security Classification Appeals PanelNARAISOO noticeApril 10, 2013In effect
CUI Memo 2013-04-11Appointments of Senior Agency Official and Program Manager for CUI Program ImplementationNARACUI noticeApril 11, 2013In effect
CUI Office Notice 2013-01Provisional Approval of Proposed CUI Categories and SubcategoriesNARACUI noticeMay 22, 2013Superseded
ISOO Notice 2013-04The National Security Staff (NSS) Partial Waiver for the Declassification Review of Select National Security Council and White House Classified RecordsNARAISOO noticeJune 14, 2013Rescinded
ISOO Notice 2013-05Revision of the Standard Form (SF) 312, "Classified Information Nondisclosure Agreement"NARAISOO noticeAugust 19, 2013In effect
ISOO Notice 2013-06Changes in Express MailNARAISOO noticeSeptember 18, 2013In effect
DFARS 252.204-7012Safeguarding Covered Defense Information and Cyber Incident ReportingDoDContract clauseNovember 18, 2013In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.