Governance tracker
Federal cybersecurity, privacy, and technology governance
Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.
FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.
Get new governance by emailWhat the statuses meanNames on this page
Found in the last 7 days
Nothing new in the last 7 days.
Filters
Results
109 documents match these filters
Filters: Acquisition.
Showing 101 to 109.
Governance documents, sorted by date issued, newest first. Page 3 of 3.
The table scrolls sideways. Each title opens the document's page.
| Number, sort A to Z | Title, sort A to Z | Issuer, sort A to Z | Type | Issued, sort oldest first | Status, sort A to Z |
|---|---|---|---|---|---|
| M-04-16 | Software Acquisition | OMB | OMB memorandum | July 1, 2004 | In effect |
| M-03-14 | Reducing Cost and Improving Quality in Federal Purchases of Commercial Software | OMB | OMB memorandum | June 2, 2003 | Rescinded |
| EO 13103 | Computer Software Piracy | White House | Executive order | September 30, 1998 | In effect |
| M-97-02 | Funding Information Systems Investments | OMB | OMB memorandum | October 25, 1996 | Rescinded |
| FAR 52.239-1 | Privacy or Security Safeguards | FAR Council | Contract clause | August 1996 | In effect |
| Pub. L. 104-106, Div. E | Information Technology Management Reform Act of 1996 (Clinger-Cohen Act) | Congress | Law | February 10, 1996 | In effect |
| EO 12829 | National Industrial Security Program | White House | Executive order | January 6, 1993 | In effect |
| FAR 52.224-1 | Privacy Act Notification | FAR Council | Contract clause | April 1984 | In effect |
| FAR 52.224-2 | Privacy Act | FAR Council | Contract clause | April 1984 | In effect |
What the statuses mean
- In effect
- Still in force, possibly with amendments.
- Proposed
- A proposed rule or draft. It may change before it takes effect.
- Superseded
- Replaced by a newer document or edition.
- Rescinded
- Cancelled by its issuer.
- Withdrawn
- Withdrawn by its issuer (NIST's term).
- Retired
- Closed by its issuer (CISA's term for a directive that has done its job).
- Expired
- Lapsed on its own terms.
Names on this page
- AI
- Artificial intelligence
- BOD
- Binding Operational Directive, issued by CISA
- CISA
- Cybersecurity and Infrastructure Security Agency
- CUI
- Controlled Unclassified Information
- DFARS
- Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
- DoD
- Department of Defense
- ED
- Emergency Directive, issued by CISA
- EO
- Executive order
- FAR
- Federal Acquisition Regulation, the rules for federal contracts
- FASC
- Federal Acquisition Security Council
- FedRAMP
- Federal Risk and Authorization Management Program, run by GSA
- FIPS
- Federal Information Processing Standard, published by NIST
- FISMA
- Federal Information Security Modernization Act
- GSA
- General Services Administration
- ISOO
- Information Security Oversight Office, part of NARA
- IT
- Information technology
- MFA
- Multifactor authentication
- NARA
- National Archives and Records Administration
- NIST
- National Institute of Standards and Technology
- OMB
- Office of Management and Budget
- OPM
- Office of Personnel Management
- PIV
- Personal Identity Verification, the federal employee ID card
- SBOM
- Software bill of materials: a list of the parts in a piece of software
Get new governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.