Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 201 to 250.

Governance documents, sorted by date issued, newest first. Page 5 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 5 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
M-22-05Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumDecember 6, 2021Rescinded
SP 800-213IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity RequirementsNISTNIST Special PublicationNovember 29, 2021In effect
NoneSecuring the Information and Communications Technology and Services Supply Chain; Connected Software ApplicationsCommerceProposed ruleNovember 26, 2021Superseded
NoneFederal Government Cybersecurity Incident and Vulnerability Response PlaybooksCISACISA guidanceNovember 16, 2021In effect
NoneKnown Exploited Vulnerabilities CatalogCISACISA guidanceNovember 3, 2021In effect
BOD 22-01Reducing the Significant Risk of Known Exploited VulnerabilitiesCISABinding Operational DirectiveNovember 3, 2021Superseded
M-22-01Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and ResponseOMBOMB memorandumOctober 8, 2021In effect
IR 8397Guidelines on Minimum Standards for Developer Verification of SoftwareNISTNIST Interagency ReportOctober 6, 2021In effect
ISOO Notice 2021-03Applying to the Technology Modernization Fund (TMF) to support classification and declassification improvementsNARAISOO noticeOctober 5, 2021In effect
NoneZero Trust Maturity Model, Version 1.0CISACISA guidanceSeptember 7, 2021Superseded
M-21-31Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity IncidentsOMBOMB memorandumAugust 27, 2021Rescinded
41 CFR Part 201-1Federal Acquisition Security Council RuleFASCRegulationAugust 26, 2021In effect
M-21-30Protecting Critical Software Through Enhanced Security MeasuresOMBOMB memorandumAugust 10, 2021In effect
NoneVulnerability Disclosure Policy (VDP) PlatformCISACISA guidanceJuly 30, 2021In effect
NoneNational Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control SystemsWhite HousePresidential directiveJuly 28, 2021In effect
ISOO Notice 2021-02Partial Waiver for the Declassification Review of Certain White House, National Security Council (NSC) and Homeland Security Council (HSC) RecordsNARAISOO noticeJuly 16, 2021In effect
ED 21-04Mitigate Windows Print Spooler Service VulnerabilityCISAEmergency DirectiveJuly 13, 2021Retired
ISOO Notice 2021-01Rescinding Approval of Pre-1989 General Services Administration (GSA)-Approved ContainersNARAISOO noticeJune 29, 2021Rescinded
EO 14034Protecting Americans' Sensitive Data From Foreign AdversariesWhite HouseExecutive orderJune 9, 2021In effect
EO 14028Improving the Nation's CybersecurityWhite HouseExecutive orderMay 12, 2021In effect
ED 21-03Mitigate Pulse Connect Secure Product VulnerabilitiesCISAEmergency DirectiveApril 20, 2021Retired
ED 21-02Mitigate Microsoft Exchange On-Premises Product VulnerabilitiesCISAEmergency DirectiveMarch 3, 2021Retired
SP 800-172Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171NISTNIST Special PublicationFebruary 2, 2021Withdrawn
NoneSecuring the Information and Communications Technology and Services Supply ChainCommerceRegulationJanuary 19, 2021Superseded
EO 13984Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled ActivitiesWhite HouseExecutive orderJanuary 19, 2021In effect
EO 13981Protecting the United States From Certain Unmanned Aircraft SystemsWhite HouseExecutive orderJanuary 18, 2021In effect
EO 13971Addressing the Threat Posed by Applications and Other Software Developed or Controlled by Chinese CompaniesWhite HouseExecutive orderJanuary 5, 2021Rescinded
Pub. L. 116-283, Div. ENational Artificial Intelligence Initiative Act of 2020CongressLawJanuary 1, 2021In effect
Pub. L. 116-283, § 1752National Cyber DirectorCongressLawJanuary 1, 2021In effect
NoneHigh Value Asset Control Overlay, Version 2.0CISACISA guidanceJanuary 2021In effect
Pub. L. 116-260, Div. U, Title IAI in Government Act of 2020CongressLawDecember 27, 2020In effect
Pub. L. 116-260, Div. U, Title IXDOTGOV Act of 2020CongressLawDecember 27, 2020In effect
ED 21-01Mitigate SolarWinds Orion Code CompromiseCISAEmergency DirectiveDecember 13, 2020Retired
Pub. L. 116-207Internet of Things Cybersecurity Improvement Act of 2020CongressLawDecember 4, 2020In effect
EO 13960Promoting the Use of Trustworthy Artificial Intelligence in the Federal GovernmentWhite HouseExecutive orderDecember 3, 2020In effect
Pub. L. 116-194Information Technology Modernization Centers of Excellence Program ActCongressLawDecember 3, 2020In effect
DFARS 252.204-7019Notice of NIST SP 800-171 DoD Assessment RequirementsDoDContract clauseNovember 30, 2020In effect
DFARS 252.204-7020NIST SP 800-171 DoD Assessment RequirementsDoDContract clauseNovember 30, 2020In effect
DFARS 252.204-7021Contractor Compliance With the Cybersecurity Maturity Model Certification Level RequirementsDoDContract clauseNovember 30, 2020In effect
M-21-07Completing the Transition to Internet Protocol Version 6 (IPv6)OMBOMB memorandumNovember 19, 2020In effect
SP 800-181 Rev. 1Workforce Framework for Cybersecurity (NICE Framework)NISTNIST Special PublicationNovember 16, 2020In effect
M-21-05Extension of Data Center Optimization Initiative (DCOI)OMBOMB memorandumNovember 13, 2020Expired
M-21-04Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy ActOMBOMB memorandumNovember 12, 2020In effect
M-21-02Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumNovember 9, 2020Rescinded
SP 800-53BControl Baselines for Information Systems and OrganizationsNISTNIST Special PublicationOctober 29, 2020In effect
IR 8286Integrating Cybersecurity and Enterprise Risk Management (ERM)NISTNIST Interagency ReportOctober 13, 2020Withdrawn
CUI Notice 2020-07Using Alternate Designation Indicators (ADI) with CUINARACUI noticeOctober 2, 2020Rescinded
CUI Notice 2020-06Limited Marking Waiver Best Practices to Alert Users of CUINARACUI noticeOctober 1, 2020Rescinded
DFARS Case 2019-D041Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)DoDRegulationSeptember 29, 2020In effect
SP 800-53 Rev. 5Security and Privacy Controls for Information Systems and OrganizationsNISTNIST Special PublicationSeptember 23, 2020In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.