Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 151 to 200.

Governance documents, sorted by date issued, newest first. Page 4 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 4 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
M-23-18Administration Cybersecurity Priorities for the FY 2025 BudgetOMBOMB memorandumJune 27, 2023Superseded
ISOO Notice 2023-02Handling NATO Information Identified during Automatic Declassification ProcessingNARAISOO noticeJune 23, 2023In effect
ISOO Notice 2023-01Classified Records Found Outside Government ControlNARAISOO noticeJune 21, 2023In effect
NoneSecuring the Information and Communications Technology and Services Supply Chain; Connected Software ApplicationsCommerceRegulationJune 16, 2023In effect
NoneBOD 23-02: Implementation Guidance for Mitigating the Risk from Internet-Exposed Management InterfacesCISACISA guidanceJune 13, 2023In effect
BOD 23-02Mitigating the Risk from Internet-Exposed Management InterfacesCISABinding Operational DirectiveJune 13, 2023In effect
M-23-16Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development PracticesOMBOMB memorandumJune 9, 2023Rescinded
FAR 52.204-27Prohibition on a ByteDance Covered ApplicationFAR CouncilContract clauseJune 2, 2023In effect
NoneFedRAMP Rev. 5 BaselinesGSA and FedRAMPFedRAMP policyMay 30, 2023In effect
SP 800-216Recommendations for Federal Vulnerability Disclosure GuidelinesNISTNIST Special PublicationMay 24, 2023In effect
NoneDepartment of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) ActivitiesDoDProposed ruleMay 3, 2023Superseded
NoneZero Trust Maturity Model, Version 2.0CISACISA guidanceApril 11, 2023In effect
EO 14093Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National SecurityWhite HouseExecutive orderMarch 27, 2023In effect
M-23-13"No TikTok on Government Devices" Implementation GuidanceOMBOMB memorandumFebruary 27, 2023Rescinded
M-23-10The Registration and Use of .gov Domains in the Federal GovernmentOMBOMB memorandumFebruary 8, 2023In effect
FIPS 186-5Digital Signature Standard (DSS)NISTFIPS standardFebruary 3, 2023In effect
AI 100-1Artificial Intelligence Risk Management Framework (AI RMF 1.0)NISTNIST frameworkJanuary 26, 2023In effect
Pub. L. 117-328, Div. RNo TikTok on Government Devices ActCongressLawDecember 29, 2022In effect
M-23-07Update to Transition to Electronic RecordsOMBOMB memorandumDecember 23, 2022In effect
Pub. L. 117-263, Div. G, Title LXXII, Subtitle BAdvancing American AI ActCongressLawDecember 23, 2022In effect
Pub. L. 117-263, § 5921FedRAMP Authorization ActCongressLawDecember 23, 2022In effect
Pub. L. 117-263, § 5949Prohibition on Certain Semiconductor Products and ServicesCongressLawDecember 23, 2022In effect
Pub. L. 117-260Quantum Computing Cybersecurity Preparedness ActCongressLawDecember 21, 2022In effect
M-23-03Fiscal Year 2023 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumDecember 2, 2022Rescinded
M-23-02Migrating to Post-Quantum CryptographyOMBOMB memorandumNovember 18, 2022In effect
SP 800-160 Vol. 1 Rev. 1Engineering Trustworthy Secure SystemsNISTNIST Special PublicationNovember 16, 2022In effect
Pub. L. 117-207Artificial Intelligence Training for the Acquisition Workforce ActCongressLawOctober 17, 2022In effect
NoneBOD 23-01: Implementation Guidance for Improving Asset Visibility and Vulnerability Detection on Federal NetworksCISACISA guidanceOctober 3, 2022In effect
BOD 23-01Improving Asset Visibility and Vulnerability Detection on Federal NetworksCISABinding Operational DirectiveOctober 3, 2022In effect
EO 14083Ensuring Robust Consideration of Evolving National Security Risks by the Committee on Foreign Investment in the United StatesWhite HouseExecutive orderSeptember 15, 2022In effect
M-22-18Enhancing the Security of the Software Supply Chain through Secure Software Development PracticesOMBOMB memorandumSeptember 14, 2022Rescinded
CUI Notice 2022-01Executive Agent Guidance Regarding White House National Security Council (NSC) Memorandum, "Initiating a Process to Review Information Management and Classification Policies," June 2, 2022NARACUI noticeSeptember 7, 2022Rescinded
ISOO Notice 2022-03General Services Administration (GSA) Approved Security EquipmentNARAISOO noticeAugust 2022Rescinded
M-22-16Administration Cybersecurity Priorities for the FY 2024 BudgetOMBOMB memorandumJuly 22, 2022Superseded
Pub. L. 117-149Federal Rotational Cyber Workforce Program Act of 2021CongressLawJune 21, 2022In effect
ISOO Notice 2022-02Declassification Guide Review RequirementsNARAISOO noticeMay 19, 2022In effect
ED 22-03Mitigate VMware VulnerabilitiesCISAEmergency DirectiveMay 18, 2022Retired
ISOO Notice 2022-01Digital Signatures on Standard Form (SF) 312, Classified Information Nondisclosure AgreementNARAISOO noticeMay 9, 2022In effect
SP 800-161 Rev. 1Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNISTNIST Special PublicationMay 5, 2022In effect
NSM-10Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic SystemsWhite HousePresidential directiveMay 4, 2022In effect
SP 800-40 Rev. 4Guide to Enterprise Patch Management Planning: Preventive Maintenance for TechnologyNISTNIST Special PublicationApril 6, 2022In effect
Pub. L. 117-103, Div. YCyber Incident Reporting for Critical Infrastructure Act of 2022CongressLawMarch 15, 2022In effect
SP 800-172AAssessing Enhanced Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationMarch 15, 2022Withdrawn
SP 800-218Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software VulnerabilitiesNISTNIST Special PublicationFebruary 3, 2022In effect
M-22-09Moving the U.S. Government Toward Zero Trust Cybersecurity PrinciplesOMBOMB memorandumJanuary 26, 2022In effect
SP 800-53A Rev. 5Assessing Security and Privacy Controls in Information Systems and OrganizationsNISTNIST Special PublicationJanuary 25, 2022In effect
FIPS 201-3Personal Identity Verification (PIV) of Federal Employees and ContractorsNISTFIPS standardJanuary 24, 2022In effect
NSM-8Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community SystemsWhite HousePresidential directiveJanuary 19, 2022Superseded
ED 22-02Mitigate Apache Log4j VulnerabilityCISAEmergency DirectiveDecember 17, 2021Retired
EO 14058Transforming Federal Customer Experience and Service Delivery To Rebuild Trust in GovernmentWhite HouseExecutive orderDecember 13, 2021In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.