Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 301 to 350.

Governance documents, sorted by date issued, newest first. Page 7 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 7 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
Pub. L. 115-435Foundations for Evidence-Based Policymaking Act of 2018CongressLawJanuary 14, 2019In effect
Pub. L. 115-390Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act)CongressLawDecember 21, 2018In effect
Pub. L. 115-390, Title IIFederal Acquisition Supply Chain Security Act of 2018CongressLawDecember 21, 2018In effect
Pub. L. 115-33621st Century Integrated Digital Experience ActCongressLawDecember 20, 2018In effect
SP 800-37 Rev. 2Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and PrivacyNISTNIST Special PublicationDecember 20, 2018In effect
M-19-03Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset ProgramOMBOMB memorandumDecember 10, 2018In effect
CUI Joint Memo 2018-11-19Decontrolling CUI in response to a FOIA requestNARACUI noticeNovember 19, 2018In effect
CUI Notice 2018-04Provisional CategoriesNARACUI noticeNovember 16, 2018In effect
CUI Notice 2018-06Establishing, Eliminating or Modifying Categories of CUINARACUI noticeNovember 16, 2018In effect
CUI Notice 2018-07CUI Limited Dissemination ControlsNARACUI noticeNovember 16, 2018In effect
Pub. L. 115-278Cybersecurity and Infrastructure Security Agency Act of 2018CongressLawNovember 16, 2018In effect
M-19-02Fiscal Year 2018-2019 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumOctober 25, 2018Rescinded
CUI Notice 2018-05Implementation Guidance when CUI is commingled with CNSINARACUI noticeOctober 24, 2018In effect
CUI Memo 2018-10-16CUI Senior Agency Official/Program Manager Change FormNARACUI noticeOctober 16, 2018In effect
M-18-23Shifting From Low-Value to High-Value WorkOMBOMB memorandumAugust 27, 2018In effect
Pub. L. 115-232, § 889Prohibition on Certain Telecommunications and Video Surveillance Services or EquipmentCongressLawAugust 13, 2018In effect
FAR 52.204-23Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered EntitiesFAR CouncilContract clauseJuly 16, 2018In effect
SP 800-171AAssessing Security Requirements for Controlled Unclassified InformationNISTNIST Special PublicationJune 13, 2018Withdrawn
EO 13833Enhancing the Effectiveness of Agency Chief Information OfficersWhite HouseExecutive orderMay 15, 2018In effect
BOD 18-02Securing High Value AssetsCISABinding Operational DirectiveMay 7, 2018In effect
CSWP 6Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1NISTNIST frameworkApril 16, 2018Superseded
CUI Notice 2018-03Implementation and Compliance Reporting and DelaysNARACUI noticeMarch 13, 2018Rescinded
M-18-12Implementation of the Modernizing Government Technology ActOMBOMB memorandumFebruary 27, 2018In effect
CUI Notice 2018-01Guidance for Drafting Agreements with Non-Executive Branch Entities involving CUINARACUI noticeJanuary 24, 2018In effect
CUI Notice 2018-02Recommendations for CUI Basic TrainingNARACUI noticeJanuary 24, 2018In effect
ISOO Notice 2018-01Declassification Date or Event Markings ClarificationNARAISOO noticeJanuary 16, 2018In effect
Pub. L. 115-91, Title X, Subtitle GModernizing Government TechnologyCongressLawDecember 12, 2017In effect
Pub. L. 115-91, § 1634Prohibition on Use of Products and Services Developed or Provided by Kaspersky LabCongressLawDecember 12, 2017In effect
NoneHigh Value Asset Control Overlay, Version 1.0CISACISA guidanceNovember 2017Superseded
BOD 18-01Enhance Email and Web SecurityCISABinding Operational DirectiveOctober 16, 2017In effect
M-18-02Fiscal Year 2017-2018 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumOctober 16, 2017Rescinded
Pub. L. 115-59Social Security Number Fraud Prevention Act of 2017CongressLawSeptember 15, 2017In effect
ISOO Notice 2017-04Security Classification GuidesNARAISOO noticeSeptember 14, 2017In effect
BOD 17-01Removal of Kaspersky-branded ProductsCISABinding Operational DirectiveSeptember 13, 2017Retired
CUI Notice 2017-02Controlled Unclassified Information (CUI) and Multi-Step Destruction ProcessNARACUI noticeAugust 17, 2017Superseded
SP 800-181National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce FrameworkNISTNIST Special PublicationAugust 7, 2017Withdrawn
ISOO Notice 2017-03National Security Council (NSC) Partial Waiver for the Declassification Review of Certain White House and NSC RecordsNARAISOO noticeJuly 12, 2017Rescinded
SP 800-63-3Digital Identity GuidelinesNISTNIST Special PublicationJune 22, 2017Withdrawn
M-17-26Reducing Burden for Federal Agencies by Rescinding and Modifying OMB MemorandaOMBOMB memorandumJune 15, 2017In effect
CUI Notice 2017-01Implementation Recommendations for the CUI ProgramNARACUI noticeJune 12, 2017In effect
M-17-25Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical InfrastructureOMBOMB memorandumMay 19, 2017Rescinded
EO 13800Strengthening the Cybersecurity of Federal Networks and Critical InfrastructureWhite HouseExecutive orderMay 11, 2017In effect
EO 13794Establishment of the American Technology CouncilWhite HouseExecutive orderApril 28, 2017In effect
ISOO Notice 2017-02Clarification of Classification by CompilationNARAISOO noticeApril 17, 2017In effect
NoneFederal Incident Notification GuidelinesCISACISA guidanceApril 1, 2017In effect
FAR 52.224-3Privacy TrainingFAR CouncilContract clauseJanuary 19, 2017In effect
M-17-15Rescission of Memoranda Relating to Identity ManagementOMBOMB memorandumJanuary 19, 2017In effect
M-17-12Preparing for and Responding to a Breach of Personally Identifiable InformationOMBOMB memorandumJanuary 3, 2017In effect
NoneFedRAMP Tailored for Low-Impact Software-as-a-Service (LI-SaaS)GSA and FedRAMPFedRAMP policy2017In effect
EO 13757Taking Additional Steps to Address the National Emergency With Respect to Significant Malicious Cyber-Enabled ActivitiesWhite HouseExecutive orderDecember 28, 2016In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.