Skip to content

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

Showing 351 to 400.

Governance documents, sorted by date issued, newest first. Page 8 of 13.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 8 of 13.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
Circular A-108Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy ActOMBOMB circularDecember 23, 2016In effect
SP 800-171 Rev. 1Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsNISTNIST Special PublicationDecember 20, 2016Withdrawn
M-17-09Management of Federal High Value AssetsOMBOMB memorandumDecember 9, 2016Rescinded
CUI Handbook 2016-12-06Marking CUI Rev 1.1 (Marking Handbook)NARACUI noticeDecember 6, 2016In effect
SP 800-160 Vol. 1Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure SystemsNISTNIST Special PublicationNovember 14, 2016Withdrawn
M-17-06Policies for Federal Agency Public Websites and Digital ServicesOMBOMB memorandumNovember 8, 2016Rescinded
M-17-05Fiscal Year 2016-2017 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumNovember 4, 2016Rescinded
BOD 16-032016 Agency Cybersecurity Reporting RequirementsCISABinding Operational DirectiveOctober 17, 2016In effect
32 CFR Part 236Department of Defense (DoD) Defense Industrial Base (DIB) Cybersecurity (CS) ActivitiesDoDRegulationOctober 4, 2016In effect
BOD 16-02Threat to Network Infrastructure DevicesCISABinding Operational DirectiveSeptember 27, 2016Retired
CUI Handbook 2016-09-16Marking CUI (Marking Handbook)NARACUI noticeSeptember 16, 2016Superseded
M-16-24Role and Designation of Senior Agency Officials for PrivacyOMBOMB memorandumSeptember 15, 2016In effect
32 CFR Part 2002Controlled Unclassified Information (CUI)NARARegulationSeptember 14, 2016In effect
CUI Notice 2016-01Implementation Guidance for the Controlled Unclassified Information ProgramNARACUI noticeSeptember 14, 2016Rescinded
M-16-21Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source SoftwareOMBOMB memorandumAugust 8, 2016In effect
M-16-20Category Management Policy 16-3: Improving the Acquisition and Management of Common Information Technology: Mobile Devices and ServicesOMBOMB memorandumAugust 4, 2016In effect
M-16-19Data Center Optimization Initiative (DCOI)OMBOMB memorandumAugust 1, 2016Rescinded
Pub. L. 114-210Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act of 2016)CongressLawJuly 29, 2016In effect
Circular A-130Managing Information as a Strategic ResourceOMBOMB circularJuly 28, 2016In effect
PPD-41United States Cyber Incident CoordinationWhite HousePresidential directiveJuly 26, 2016In effect
Circular A-123Management's Responsibility for Enterprise Risk Management and Internal ControlOMBOMB circularJuly 15, 2016Superseded
M-16-15Federal Cybersecurity Workforce StrategyOMBOMB memorandumJuly 12, 2016In effect
M-16-14Category Management Policy 16-2: Providing Comprehensive Identity Protection Services, Identity Monitoring, and Data Breach ResponseOMBOMB memorandumJuly 1, 2016In effect
NoneFedRAMP High Baseline RequirementsGSA and FedRAMPFedRAMP policyJune 23, 2016Superseded
FAR 52.204-21Basic Safeguarding of Covered Contractor Information SystemsFAR CouncilContract clauseJune 15, 2016In effect
BOD 16-01Securing High Value AssetsCISABinding Operational DirectiveJune 9, 2016Superseded
M-16-12Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software LicensingOMBOMB memorandumJune 2, 2016In effect
EO 13718Commission on Enhancing National CybersecurityWhite HouseExecutive orderFebruary 9, 2016Expired
EO 13719Establishment of the Federal Privacy CouncilWhite HouseExecutive orderFebruary 9, 2016In effect
Pub. L. 114-113, Div. NCybersecurity Act of 2015CongressLawDecember 18, 2015In effect
Pub. L. 114-113, Div. N, Title II, Subtitle BFederal Cybersecurity Enhancement Act of 2015CongressLawDecember 18, 2015In effect
Pub. L. 114-113, Div. N, Title IIIFederal Cybersecurity Workforce Assessment Act of 2015CongressLawDecember 18, 2015In effect
SP 800-131A Rev. 1Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key LengthsNISTNIST Special PublicationNovember 6, 2015Withdrawn
M-16-03Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumOctober 30, 2015Rescinded
M-16-04Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian GovernmentOMBOMB memorandumOctober 30, 2015Rescinded
M-16-02Category Management Policy 15-1: Improving the Acquisition and Management of Common Information Technology: Laptops and DesktopsOMBOMB memorandumOctober 16, 2015In effect
ISOO Notice 2015-05Agencies Eligible to Receive Referrals from Automatic Declassification at 25, 50, and 75 YearsNARAISOO noticeSeptember 25, 2015Rescinded
DFARS 252.239-7010Cloud Computing ServicesDoDContract clauseAugust 26, 2015In effect
EO 13704Presidential Innovation Fellows ProgramWhite HouseExecutive orderAugust 17, 2015In effect
FIPS 202SHA-3 Standard: Permutation-Based Hash and Extendable-Output FunctionsNISTFIPS standardAugust 4, 2015In effect
ISOO Notice 2015-04Update on Recent Cyber Incidents at OPMNARAISOO noticeJuly 10, 2015Expired
SP 800-171Protecting Controlled Unclassified Information in Nonfederal Information Systems and OrganizationsNISTNIST Special PublicationJune 18, 2015Withdrawn
ISOO Notice 2015-02Message from OPM to Security Clearance HoldersNARAISOO noticeJune 16, 2015Expired
M-15-14Management and Oversight of Federal Information TechnologyOMBOMB memorandumJune 10, 2015In effect
M-15-13Policy to Require Secure Connections across Federal Websites and Web ServicesOMBOMB memorandumJune 8, 2015In effect
ISOO Notice 2015-01Withholding Authorities for Mandatory Declassification ReviewNARAISOO noticeJune 5, 2015In effect
BOD 15-01Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies' Internet-Accessible SystemsCISABinding Operational DirectiveMay 21, 2015Superseded
NoneControlled Unclassified InformationNARAProposed ruleMay 8, 2015Superseded
SP 800-161Supply Chain Risk Management Practices for Federal Information Systems and OrganizationsNISTNIST Special PublicationApril 8, 2015Withdrawn
EO 13694Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled ActivitiesWhite HouseExecutive orderApril 1, 2015In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.