Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

61 documents match these filters

Filters: Security programs and FISMA reporting.

Showing 1 to 50.

Governance documents, sorted by date issued, oldest first. Page 1 of 2.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 1 of 2.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
Pub. L. 100-235	Computer Security Act of 1987	Congress	Law	January 8, 1988	Superseded
Circular A-130	Management of Federal Information Resources	OMB	OMB circular	February 8, 1996	Superseded
M-99-20	Security of Federal Automated Information Resources	OMB	OMB memorandum	June 23, 1999	Rescinded
M-00-07	Incorporating and Funding Security in Information Systems Investments	OMB	OMB memorandum	February 28, 2000	Rescinded
Pub. L. 106-398, Title X, Subtitle G	Government Information Security Reform	Congress	Law	October 30, 2000	Superseded
M-01-08	Guidance on Implementing the Government Information Security Reform Act	OMB	OMB memorandum	January 16, 2001	Rescinded
M-01-24	Reporting Instructions for the Government Information Security Reform Act	OMB	OMB memorandum	June 22, 2001	Rescinded
M-02-01	Guidance for Preparing and Submitting Security Plans of Action and Milestones	OMB	OMB memorandum	October 17, 2001	In effect
M-02-09	Reporting Instructions for the Government Information Security Reform Act and Updated Guidance on Security Plans of Action and Milestones	OMB	OMB memorandum	July 2, 2002	Rescinded
Pub. L. 107-347, Title III	Federal Information Security Management Act of 2002	Congress	Law	December 17, 2002	Superseded
M-03-19	Reporting Instructions for the Federal Information Security Management Act and Updated Guidance on Quarterly IT Security Reporting	OMB	OMB memorandum	August 6, 2003	Rescinded
None	Employees Responsible for the Management or Use of Federal Computer Systems	OPM	Proposed rule	September 4, 2003	Superseded
FIPS 199	Standards for Security Categorization of Federal Information and Information Systems	NIST	FIPS standard	February 2004	In effect
5 CFR 930.301	Information Security Responsibilities for Employees who Manage or Use Federal Information Systems	OPM	Regulation	June 14, 2004	In effect
M-04-25	FY 2004 Reporting Instructions for the Federal Information Security Management Act	OMB	OMB memorandum	August 23, 2004	Rescinded
M-04-26	Personal Use Policies and "File Sharing" Technology	OMB	OMB memorandum	September 8, 2004	Rescinded
M-05-15	FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	June 13, 2005	Rescinded
FIPS 200	Minimum Security Requirements for Federal Information and Information Systems	NIST	FIPS standard	March 2006	In effect
M-06-20	FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 17, 2006	Rescinded
M-07-19	FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 25, 2007	Rescinded
M-08-21	FY 2008 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 14, 2008	Rescinded
SP 800-55 Rev. 1	Performance Measurement Guide for Information Security	NIST	NIST Special Publication	July 16, 2008	Withdrawn
M-09-29	FY 2009 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	August 20, 2009	Rescinded
M-10-15	FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	April 21, 2010	Rescinded
M-10-28	Clarifying Cybersecurity Responsibilities and Activities of the Executive Office of the President and the Department of Homeland Security (DHS)	OMB	OMB memorandum	July 6, 2010	Rescinded
M-11-27	Implementing the Telework Enhancement Act of 2010: Security Guidelines	OMB	OMB memorandum	July 15, 2011	In effect
M-11-33	FY 2011 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 14, 2011	Superseded
SP 800-137	Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations	NIST	NIST Special Publication	September 30, 2011	In effect
M-12-20	FY 2012 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 27, 2012	Superseded
M-14-03	Enhancing the Security of Federal Information and Information Systems	OMB	OMB memorandum	November 18, 2013	Rescinded
M-14-04	Fiscal Year 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	November 18, 2013	Superseded
M-15-01	Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices	OMB	OMB memorandum	October 3, 2014	Rescinded
Pub. L. 113-283	Federal Information Security Modernization Act of 2014	Congress	Law	December 18, 2014	In effect
M-16-03	Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 30, 2015	Rescinded
M-16-04	Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government	OMB	OMB memorandum	October 30, 2015	Rescinded
Pub. L. 114-113, Div. N, Title II, Subtitle B	Federal Cybersecurity Enhancement Act of 2015	Congress	Law	December 18, 2015	In effect
BOD 16-03	2016 Agency Cybersecurity Reporting Requirements	CISA	Binding Operational Directive	October 17, 2016	In effect
M-17-05	Fiscal Year 2016-2017 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 4, 2016	Rescinded
None	Federal Incident Notification Guidelines	CISA	CISA guidance	April 1, 2017	In effect
M-17-25	Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure	OMB	OMB memorandum	May 19, 2017	Rescinded
M-17-26	Reducing Burden for Federal Agencies by Rescinding and Modifying OMB Memoranda	OMB	OMB memorandum	June 15, 2017	In effect
M-18-02	Fiscal Year 2017-2018 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 16, 2017	Rescinded
M-18-23	Shifting From Low-Value to High-Value Work	OMB	OMB memorandum	August 27, 2018	In effect
M-19-02	Fiscal Year 2018-2019 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 25, 2018	Rescinded
M-20-04	Fiscal Year 2019-2020 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 19, 2019	Rescinded
IR 8170	Approaches for Federal Agencies to Use the Cybersecurity Framework	NIST	NIST Interagency Report	March 19, 2020	In effect
M-21-02	Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 9, 2020	Rescinded
Pub. L. 116-283, § 1752	National Cyber Director	Congress	Law	January 1, 2021	In effect
M-22-05	Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	December 6, 2021	Rescinded
M-22-16	Administration Cybersecurity Priorities for the FY 2024 Budget	OMB	OMB memorandum	July 22, 2022	Superseded

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email