Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

140 documents match these filters

Filters: CUI and classified information.

Showing 51 to 100.

Governance documents, sorted by date issued, newest first. Page 2 of 3.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 2 of 3.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort oldest first	Status, sort A to Z
CUI Memo 2020-03-30	Applying Exigent Circumstances Waiver to CUI Safeguarding Requirements While Teleworking in Response to the COVID-19 Pandemic	NARA	CUI notice	March 30, 2020	Rescinded
SP 800-171 Rev. 2	Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations	NIST	NIST Special Publication	February 21, 2020	Withdrawn
ISOO Notice 2019-01	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	September 27, 2019	Rescinded
CUI Notice 2019-04	Oversight of the Controlled Unclassified Information (CUI) Program within Private Sector Entities	NARA	CUI notice	September 6, 2019	In effect
CUI Notice 2019-03	Destroying CUI in Paper Form	NARA	CUI notice	July 15, 2019	In effect
CUI Notice 2019-02	CUI Program Manager Position Description	NARA	CUI notice	May 13, 2019	In effect
CUI Notice 2019-01	CUI Coversheet and Media Labels	NARA	CUI notice	February 22, 2019	In effect
CUI Joint Memo 2018-11-19	Decontrolling CUI in response to a FOIA request	NARA	CUI notice	November 19, 2018	In effect
CUI Notice 2018-04	Provisional Categories	NARA	CUI notice	November 16, 2018	In effect
CUI Notice 2018-06	Establishing, Eliminating or Modifying Categories of CUI	NARA	CUI notice	November 16, 2018	In effect
CUI Notice 2018-07	CUI Limited Dissemination Controls	NARA	CUI notice	November 16, 2018	In effect
CUI Notice 2018-05	Implementation Guidance when CUI is commingled with CNSI	NARA	CUI notice	October 24, 2018	In effect
CUI Memo 2018-10-16	CUI Senior Agency Official/Program Manager Change Form	NARA	CUI notice	October 16, 2018	In effect
SP 800-171A	Assessing Security Requirements for Controlled Unclassified Information	NIST	NIST Special Publication	June 13, 2018	Withdrawn
CUI Notice 2018-03	Implementation and Compliance Reporting and Delays	NARA	CUI notice	March 13, 2018	Rescinded
CUI Notice 2018-01	Guidance for Drafting Agreements with Non-Executive Branch Entities involving CUI	NARA	CUI notice	January 24, 2018	In effect
CUI Notice 2018-02	Recommendations for CUI Basic Training	NARA	CUI notice	January 24, 2018	In effect
ISOO Notice 2018-01	Declassification Date or Event Markings Clarification	NARA	ISOO notice	January 16, 2018	In effect
ISOO Notice 2017-04	Security Classification Guides	NARA	ISOO notice	September 14, 2017	In effect
CUI Notice 2017-02	Controlled Unclassified Information (CUI) and Multi-Step Destruction Process	NARA	CUI notice	August 17, 2017	Superseded
ISOO Notice 2017-03	National Security Council (NSC) Partial Waiver for the Declassification Review of Certain White House and NSC Records	NARA	ISOO notice	July 12, 2017	Rescinded
CUI Notice 2017-01	Implementation Recommendations for the CUI Program	NARA	CUI notice	June 12, 2017	In effect
ISOO Notice 2017-02	Clarification of Classification by Compilation	NARA	ISOO notice	April 17, 2017	In effect
SP 800-171 Rev. 1	Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations	NIST	NIST Special Publication	December 20, 2016	Withdrawn
CUI Handbook 2016-12-06	Marking CUI Rev 1.1 (Marking Handbook)	NARA	CUI notice	December 6, 2016	In effect
CUI Handbook 2016-09-16	Marking CUI (Marking Handbook)	NARA	CUI notice	September 16, 2016	Superseded
32 CFR Part 2002	Controlled Unclassified Information (CUI)	NARA	Regulation	September 14, 2016	In effect
CUI Notice 2016-01	Implementation Guidance for the Controlled Unclassified Information Program	NARA	CUI notice	September 14, 2016	Rescinded
ISOO Notice 2015-05	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	September 25, 2015	Rescinded
ISOO Notice 2015-04	Update on Recent Cyber Incidents at OPM	NARA	ISOO notice	July 10, 2015	Expired
SP 800-171	Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations	NIST	NIST Special Publication	June 18, 2015	Withdrawn
ISOO Notice 2015-02	Message from OPM to Security Clearance Holders	NARA	ISOO notice	June 16, 2015	Expired
ISOO Notice 2015-01	Withholding Authorities for Mandatory Declassification Review	NARA	ISOO notice	June 5, 2015	In effect
None	Controlled Unclassified Information	NARA	Proposed rule	May 8, 2015	Superseded
ISOO Notice 2014-04	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	September 5, 2014	Rescinded
ISOO Notice 2014-03	U.S. Protection of Information Shared by the Government of the United Kingdom	NARA	ISOO notice	August 27, 2014	In effect
CUI Joint Memo 2014-07-03	Revised Guidance regarding CUI and the Freedom of Information Act	NARA	CUI notice	July 3, 2014	Superseded
ISOO Notice 2014-02	Procurement of Security Equipment	NARA	ISOO notice	April 4, 2014	Rescinded
ISOO Notice 2014-01	Appeal Rights for Mandatory Declassification Review Requests and the Rejection of Requests for Specific Reasons	NARA	ISOO notice	March 26, 2014	In effect
DFARS 252.204-7012	Safeguarding Covered Defense Information and Cyber Incident Reporting	DoD	Contract clause	November 18, 2013	In effect
ISOO Notice 2013-06	Changes in Express Mail	NARA	ISOO notice	September 18, 2013	In effect
ISOO Notice 2013-05	Revision of the Standard Form (SF) 312, "Classified Information Nondisclosure Agreement"	NARA	ISOO notice	August 19, 2013	In effect
ISOO Notice 2013-04	The National Security Staff (NSS) Partial Waiver for the Declassification Review of Select National Security Council and White House Classified Records	NARA	ISOO notice	June 14, 2013	Rescinded
CUI Office Notice 2013-01	Provisional Approval of Proposed CUI Categories and Subcategories	NARA	CUI notice	May 22, 2013	Superseded
CUI Memo 2013-04-11	Appointments of Senior Agency Official and Program Manager for CUI Program Implementation	NARA	CUI notice	April 11, 2013	In effect
ISOO Notice 2013-03	Processing of Mandatory Declassification Review Requests Appealed to the Interagency Security Classification Appeals Panel	NARA	ISOO notice	April 10, 2013	In effect
ISOO Notice 2013-02	Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 Years	NARA	ISOO notice	January 23, 2013	Rescinded
ISOO Notice 2013-01	Further Marking Guidance on Commingling North Atlantic Treaty Organization (NATO) and Classified National Security Information (NSI)	NARA	ISOO notice	November 1, 2012	In effect
ISOO Notice 2012-04	Additional Guidance on Standards for Security Equipment	NARA	ISOO notice	October 12, 2012	Rescinded
CUI Memo 2012-07-27	Review of Proposed Categories for CUI Registry	NARA	CUI notice	July 27, 2012	Superseded

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email