Governance tracker
Federal cybersecurity, privacy, and technology governance
Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.
FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.
Get new governance by emailWhat the statuses meanNames on this page
Found in the last 7 days
Nothing new in the last 7 days.
Skip to the results
Filters
Results
34 documents match these filters
Filters: Records and data.
Governance documents, sorted by date issued, oldest first. Page 1 of 1.
The table scrolls sideways. Each title opens the document's page.
| Number, sort A to Z | Title, sort A to Z | Issuer, sort A to Z | Type | Issued, sort newest first | Status, sort A to Z |
|---|---|---|---|---|---|
| Pub. L. 93-579 | Privacy Act of 1974 | Congress | Law | December 31, 1974 | In effect |
| Pub. L. 96-511 | Paperwork Reduction Act of 1980 | Congress | Law | December 11, 1980 | Superseded |
| Circular A-130 | Management of Federal Information Resources | OMB | OMB circular | June 25, 1993 | Superseded |
| Pub. L. 104-13 | Paperwork Reduction Act of 1995 | Congress | Law | May 22, 1995 | In effect |
| M-00-10 | OMB Procedures and Guidance on Implementing the Government Paperwork Elimination Act | OMB | OMB memorandum | April 25, 2000 | In effect |
| M-00-15 | OMB Guidance on Implementing the Electronic Signatures in Global and National Commerce Act | OMB | OMB memorandum | September 25, 2000 | In effect |
| Pub. L. 107-347, Title V | Confidential Information Protection and Statistical Efficiency Act of 2002 | Congress | Law | December 17, 2002 | Superseded |
| M-03-18 | Implementation Guidance for the E-Government Act of 2002 | OMB | OMB memorandum | August 1, 2003 | In effect |
| ISOO Notice 2009-03 | Notification, Coordination, and Documentation Related to Subsequent Reviews Conducted by Primary Reviewing Agencies [Related to Automatic Declassification] | NARA | ISOO notice | October 10, 2008 | In effect |
| ISOO Notice 2009-04 | "Best Practices" for Declassification Review Record Keeping | NARA | ISOO notice | October 10, 2008 | In effect |
| None | Transparency and Open Government | White House | Presidential directive | January 21, 2009 | In effect |
| M-10-06 | Open Government Directive | OMB | OMB memorandum | December 8, 2009 | In effect |
| M-11-02 | Sharing Data While Protecting Privacy | OMB | OMB memorandum | November 3, 2010 | In effect |
| CUI Joint Memo 2011-11-22 | CUI and the Freedom of Information Act | NARA | CUI notice | November 22, 2011 | Superseded |
| None | Managing Government Records | White House | Presidential directive | November 28, 2011 | In effect |
| None | Building a 21st Century Digital Government | White House | Presidential directive | May 23, 2012 | In effect |
| M-12-18 | Managing Government Records Directive | OMB | OMB memorandum | August 24, 2012 | Rescinded |
| EO 13642 | Making Open and Machine Readable the New Default for Government Information | White House | Executive order | May 9, 2013 | In effect |
| M-13-13 | Open Data Policy—Managing Information as an Asset | OMB | OMB memorandum | May 9, 2013 | Rescinded |
| Pub. L. 113-101 | Digital Accountability and Transparency Act of 2014 | Congress | Law | May 9, 2014 | In effect |
| CUI Joint Memo 2014-07-03 | Revised Guidance regarding CUI and the Freedom of Information Act | NARA | CUI notice | July 3, 2014 | Superseded |
| M-14-16 | Guidance on Managing Email | OMB | OMB memorandum | September 15, 2014 | Rescinded |
| Pub. L. 113-187 | Presidential and Federal Records Act Amendments of 2014 | Congress | Law | November 26, 2014 | In effect |
| SP 800-88 Rev. 1 | Guidelines for Media Sanitization | NIST | NIST Special Publication | December 17, 2014 | Withdrawn |
| CUI Joint Memo 2018-11-19 | Decontrolling CUI in response to a FOIA request | NARA | CUI notice | November 19, 2018 | In effect |
| Pub. L. 115-435 | Foundations for Evidence-Based Policymaking Act of 2018 | Congress | Law | January 14, 2019 | In effect |
| M-19-18 | Federal Data Strategy – A Framework for Consistency | OMB | OMB memorandum | June 4, 2019 | In effect |
| M-19-21 | Transition to Electronic Records | OMB | OMB memorandum | June 28, 2019 | In effect |
| M-23-07 | Update to Transition to Electronic Records | OMB | OMB memorandum | December 23, 2022 | In effect |
| M-25-05 | Phase 2 Implementation of the Foundations for Evidence-Based Policymaking Act of 2018: Open Government Data Access and Management Guidance | OMB | OMB memorandum | January 15, 2025 | In effect |
| EO 14158 | Establishing and Implementing the President's "Department of Government Efficiency" | White House | Executive order | January 20, 2025 | In effect |
| EO 14243 | Stopping Waste, Fraud, and Abuse by Eliminating Information Silos | White House | Executive order | March 20, 2025 | In effect |
| SP 800-88 Rev. 2 | Guidelines for Media Sanitization | NIST | NIST Special Publication | September 26, 2025 | In effect |
| EO 14363 | Launching the Genesis Mission | White House | Executive order | November 24, 2025 | In effect |
What the statuses mean
- In effect
- Still in force, possibly with amendments.
- Proposed
- A proposed rule or draft. It may change before it takes effect.
- Superseded
- Replaced by a newer document or edition.
- Rescinded
- Cancelled by its issuer.
- Withdrawn
- Withdrawn by its issuer (NIST's term).
- Retired
- Closed by its issuer (CISA's term for a directive that has done its job).
- Expired
- Lapsed on its own terms.
Names on this page
- AI
- Artificial intelligence
- BOD
- Binding Operational Directive, issued by CISA
- CISA
- Cybersecurity and Infrastructure Security Agency
- CUI
- Controlled Unclassified Information
- DFARS
- Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
- DoD
- Department of Defense
- ED
- Emergency Directive, issued by CISA
- EO
- Executive order
- FAR
- Federal Acquisition Regulation, the rules for federal contracts
- FASC
- Federal Acquisition Security Council
- FedRAMP
- Federal Risk and Authorization Management Program, run by GSA
- FIPS
- Federal Information Processing Standard, published by NIST
- FISMA
- Federal Information Security Modernization Act
- GSA
- General Services Administration
- ISOO
- Information Security Oversight Office, part of NARA
- IT
- Information technology
- MFA
- Multifactor authentication
- NARA
- National Archives and Records Administration
- NIST
- National Institute of Standards and Technology
- OMB
- Office of Management and Budget
- OPM
- Office of Personnel Management
- PIV
- Personal Identity Verification, the federal employee ID card
- SBOM
- Software bill of materials: a list of the parts in a piece of software
Get new governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.