Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

49 documents match these filters

Filters: Vulnerabilities and patching.

Governance documents, sorted by date issued, oldest first. Page 1 of 1.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, oldest first. Page 1 of 1.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort newest first	Status, sort A to Z
M-99-20	Security of Federal Automated Information Resources	OMB	OMB memorandum	June 23, 1999	Rescinded
Pub. L. 107-305	Cyber Security Research and Development Act	Congress	Law	November 27, 2002	In effect
M-07-11	Implementation of Commonly Accepted Security Configurations for Windows Operating Systems	OMB	OMB memorandum	March 22, 2007	Rescinded
M-08-22	Guidance on the Federal Desktop Core Configuration (FDCC)	OMB	OMB memorandum	August 11, 2008	Rescinded
SP 800-40 Rev. 3	Guide to Enterprise Patch Management Technologies	NIST	NIST Special Publication	July 22, 2013	Withdrawn
M-15-01	Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices	OMB	OMB memorandum	October 3, 2014	Rescinded
BOD 15-01	Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies' Internet-Accessible Systems	CISA	Binding Operational Directive	May 21, 2015	Superseded
BOD 16-01	Securing High Value Assets	CISA	Binding Operational Directive	June 9, 2016	Superseded
BOD 16-02	Threat to Network Infrastructure Devices	CISA	Binding Operational Directive	September 27, 2016	Retired
BOD 18-02	Securing High Value Assets	CISA	Binding Operational Directive	May 7, 2018	In effect
Pub. L. 115-390	Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act)	Congress	Law	December 21, 2018	In effect
BOD 19-02	Vulnerability Remediation Requirements for Internet-Accessible Systems	CISA	Binding Operational Directive	April 29, 2019	Superseded
ED 20-02	Mitigate Windows Vulnerabilities from January 2020 Patch Tuesday	CISA	Emergency Directive	January 14, 2020	Retired
ED 20-03	Mitigate Windows DNS Server Remote Code Execution Vulnerability from July 2020 Patch Tuesday	CISA	Emergency Directive	July 16, 2020	Retired
BOD 20-01	Develop and Publish a Vulnerability Disclosure Policy	CISA	Binding Operational Directive	September 2, 2020	In effect
M-20-32	Improving Vulnerability Identification, Management, and Remediation	OMB	OMB memorandum	September 2, 2020	In effect
ED 20-04	Mitigate Netlogon Elevation of Privilege Vulnerability from August 2020 Patch Tuesday	CISA	Emergency Directive	September 18, 2020	Retired
Pub. L. 116-207	Internet of Things Cybersecurity Improvement Act of 2020	Congress	Law	December 4, 2020	In effect
ED 21-02	Mitigate Microsoft Exchange On-Premises Product Vulnerabilities	CISA	Emergency Directive	March 3, 2021	Retired
ED 21-03	Mitigate Pulse Connect Secure Product Vulnerabilities	CISA	Emergency Directive	April 20, 2021	Retired
ED 21-04	Mitigate Windows Print Spooler Service Vulnerability	CISA	Emergency Directive	July 13, 2021	Retired
None	Vulnerability Disclosure Policy (VDP) Platform	CISA	CISA guidance	July 30, 2021	In effect
M-22-01	Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response	OMB	OMB memorandum	October 8, 2021	In effect
None	Known Exploited Vulnerabilities Catalog	CISA	CISA guidance	November 3, 2021	In effect
BOD 22-01	Reducing the Significant Risk of Known Exploited Vulnerabilities	CISA	Binding Operational Directive	November 3, 2021	Superseded
None	Federal Government Cybersecurity Incident and Vulnerability Response Playbooks	CISA	CISA guidance	November 16, 2021	In effect
ED 22-02	Mitigate Apache Log4j Vulnerability	CISA	Emergency Directive	December 17, 2021	Retired
SP 800-40 Rev. 4	Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology	NIST	NIST Special Publication	April 6, 2022	In effect
ED 22-03	Mitigate VMware Vulnerabilities	CISA	Emergency Directive	May 18, 2022	Retired
None	BOD 23-01: Implementation Guidance for Improving Asset Visibility and Vulnerability Detection on Federal Networks	CISA	CISA guidance	October 3, 2022	In effect
BOD 23-01	Improving Asset Visibility and Vulnerability Detection on Federal Networks	CISA	Binding Operational Directive	October 3, 2022	In effect
SP 800-216	Recommendations for Federal Vulnerability Disclosure Guidelines	NIST	NIST Special Publication	May 24, 2023	In effect
None	BOD 23-02: Implementation Guidance for Mitigating the Risk from Internet-Exposed Management Interfaces	CISA	CISA guidance	June 13, 2023	In effect
BOD 23-02	Mitigating the Risk from Internet-Exposed Management Interfaces	CISA	Binding Operational Directive	June 13, 2023	In effect
ED 24-01	Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities	CISA	Emergency Directive	January 19, 2024	In effect
None	Supplemental Direction V1: ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities	CISA	CISA guidance	January 31, 2024	Superseded
None	Supplemental Direction V2: ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities	CISA	CISA guidance	February 9, 2024	In effect
ED 25-02	Mitigate Microsoft Exchange Vulnerability	CISA	Emergency Directive	August 7, 2025	In effect
None	Supplemental Direction ED 25-03: Core Dump and Hunt Instructions	CISA	CISA guidance	September 25, 2025	In effect
ED 25-03	Identify and Mitigate Potential Compromise of Cisco Devices	CISA	Emergency Directive	September 25, 2025	In effect
ED 26-01	Mitigate Vulnerabilities in F5 Devices	CISA	Emergency Directive	October 15, 2025	In effect
BOD 26-02	Mitigating Risk From End-of-Support Edge Devices	CISA	Binding Operational Directive	February 5, 2026	In effect
None	Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems	CISA	CISA guidance	February 25, 2026	In effect
ED 26-03	Mitigate Vulnerabilities in Cisco SD-WAN Systems	CISA	Emergency Directive	February 25, 2026	In effect
None	V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems	CISA	CISA guidance	March 11, 2026	In effect
None	V1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices	CISA	CISA guidance	April 23, 2026	In effect
EO 14409	Promoting Advanced Artificial Intelligence Innovation and Security	White House	Executive order	June 2, 2026	In effect
None	BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk	CISA	CISA guidance	June 10, 2026	In effect
BOD 26-04	Prioritizing Security Updates Based on Risk	CISA	Binding Operational Directive	June 10, 2026	In effect

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email