Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by email What the statuses mean Names on this page

Found in the last 7 days

Nothing new in the last 7 days.

Filters

61 documents match these filters

Filters: Security programs and FISMA reporting.

Showing 1 to 50.

Governance documents, sorted by date issued, newest first. Page 1 of 2.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 1 of 2.
Number, sort A to Z	Title, sort A to Z	Issuer, sort A to Z	Type	Issued, sort oldest first	Status, sort A to Z
None	FY 2026 & FY 2027 CIO FISMA Metrics	CISA	CISA guidance	August 3, 2026	In effect
Circular A-123	Management's Responsibility for Internal Control	OMB	OMB circular	March 10, 2026	In effect
M-25-04	Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	January 15, 2025	In effect
SP 800-55 Vol. 1	Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures	NIST	NIST Special Publication	December 4, 2024	In effect
SP 800-55 Vol. 2	Measurement Guide for Information Security: Volume 2 — Developing an Information Security Measurement Program	NIST	NIST Special Publication	December 4, 2024	In effect
M-24-14	Administration Cybersecurity Priorities for the FY 2026 Budget	OMB	OMB memorandum	July 10, 2024	In effect
M-24-04	Fiscal Year 2024 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	December 4, 2023	Rescinded
FAR Case 2021-019	Federal Acquisition Regulation: Standardizing Cybersecurity Requirements for Unclassified Federal Information Systems	FAR Council	Proposed rule	October 3, 2023	Proposed
M-23-18	Administration Cybersecurity Priorities for the FY 2025 Budget	OMB	OMB memorandum	June 27, 2023	Superseded
M-23-03	Fiscal Year 2023 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	December 2, 2022	Rescinded
BOD 23-01	Improving Asset Visibility and Vulnerability Detection on Federal Networks	CISA	Binding Operational Directive	October 3, 2022	In effect
M-22-16	Administration Cybersecurity Priorities for the FY 2024 Budget	OMB	OMB memorandum	July 22, 2022	Superseded
M-22-05	Fiscal Year 2021-2022 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	December 6, 2021	Rescinded
Pub. L. 116-283, § 1752	National Cyber Director	Congress	Law	January 1, 2021	In effect
M-21-02	Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 9, 2020	Rescinded
IR 8170	Approaches for Federal Agencies to Use the Cybersecurity Framework	NIST	NIST Interagency Report	March 19, 2020	In effect
M-20-04	Fiscal Year 2019-2020 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 19, 2019	Rescinded
M-19-02	Fiscal Year 2018-2019 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 25, 2018	Rescinded
M-18-23	Shifting From Low-Value to High-Value Work	OMB	OMB memorandum	August 27, 2018	In effect
M-18-02	Fiscal Year 2017-2018 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 16, 2017	Rescinded
M-17-26	Reducing Burden for Federal Agencies by Rescinding and Modifying OMB Memoranda	OMB	OMB memorandum	June 15, 2017	In effect
M-17-25	Reporting Guidance for Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure	OMB	OMB memorandum	May 19, 2017	Rescinded
None	Federal Incident Notification Guidelines	CISA	CISA guidance	April 1, 2017	In effect
M-17-05	Fiscal Year 2016-2017 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	November 4, 2016	Rescinded
BOD 16-03	2016 Agency Cybersecurity Reporting Requirements	CISA	Binding Operational Directive	October 17, 2016	In effect
Pub. L. 114-113, Div. N, Title II, Subtitle B	Federal Cybersecurity Enhancement Act of 2015	Congress	Law	December 18, 2015	In effect
M-16-03	Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements	OMB	OMB memorandum	October 30, 2015	Rescinded
M-16-04	Cybersecurity Strategy and Implementation Plan (CSIP) for the Federal Civilian Government	OMB	OMB memorandum	October 30, 2015	Rescinded
Pub. L. 113-283	Federal Information Security Modernization Act of 2014	Congress	Law	December 18, 2014	In effect
M-15-01	Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices	OMB	OMB memorandum	October 3, 2014	Rescinded
M-14-03	Enhancing the Security of Federal Information and Information Systems	OMB	OMB memorandum	November 18, 2013	Rescinded
M-14-04	Fiscal Year 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	November 18, 2013	Superseded
M-12-20	FY 2012 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 27, 2012	Superseded
SP 800-137	Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations	NIST	NIST Special Publication	September 30, 2011	In effect
M-11-33	FY 2011 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	September 14, 2011	Superseded
M-11-27	Implementing the Telework Enhancement Act of 2010: Security Guidelines	OMB	OMB memorandum	July 15, 2011	In effect
M-10-28	Clarifying Cybersecurity Responsibilities and Activities of the Executive Office of the President and the Department of Homeland Security (DHS)	OMB	OMB memorandum	July 6, 2010	Rescinded
M-10-15	FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	April 21, 2010	Rescinded
M-09-29	FY 2009 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	August 20, 2009	Rescinded
SP 800-55 Rev. 1	Performance Measurement Guide for Information Security	NIST	NIST Special Publication	July 16, 2008	Withdrawn
M-08-21	FY 2008 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 14, 2008	Rescinded
M-07-19	FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 25, 2007	Rescinded
M-06-20	FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	July 17, 2006	Rescinded
FIPS 200	Minimum Security Requirements for Federal Information and Information Systems	NIST	FIPS standard	March 2006	In effect
M-05-15	FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management	OMB	OMB memorandum	June 13, 2005	Rescinded
M-04-26	Personal Use Policies and "File Sharing" Technology	OMB	OMB memorandum	September 8, 2004	Rescinded
M-04-25	FY 2004 Reporting Instructions for the Federal Information Security Management Act	OMB	OMB memorandum	August 23, 2004	Rescinded
5 CFR 930.301	Information Security Responsibilities for Employees who Manage or Use Federal Information Systems	OPM	Regulation	June 14, 2004	In effect
FIPS 199	Standards for Security Categorization of Federal Information and Information Systems	NIST	FIPS standard	February 2004	In effect
None	Employees Responsible for the Management or Use of Federal Computer Systems	OPM	Proposed rule	September 4, 2003	Superseded

What the statuses mean

In effect: Still in force, possibly with amendments.
Proposed: A proposed rule or draft. It may change before it takes effect.
Superseded: Replaced by a newer document or edition.
Rescinded: Cancelled by its issuer.
Withdrawn: Withdrawn by its issuer (NIST's term).
Retired: Closed by its issuer (CISA's term for a directive that has done its job).
Expired: Lapsed on its own terms.

Names on this page

AI: Artificial intelligence
BOD: Binding Operational Directive, issued by CISA
CISA: Cybersecurity and Infrastructure Security Agency
CUI: Controlled Unclassified Information
DFARS: Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD: Department of Defense
ED: Emergency Directive, issued by CISA
EO: Executive order
FAR: Federal Acquisition Regulation, the rules for federal contracts
FASC: Federal Acquisition Security Council
FedRAMP: Federal Risk and Authorization Management Program, run by GSA
FIPS: Federal Information Processing Standard, published by NIST
FISMA: Federal Information Security Modernization Act
GSA: General Services Administration
ISOO: Information Security Oversight Office, part of NARA
IT: Information technology
MFA: Multifactor authentication
NARA: National Archives and Records Administration
NIST: National Institute of Standards and Technology
OMB: Office of Management and Budget
OPM: Office of Personnel Management
PIV: Personal Identity Verification, the federal employee ID card
SBOM: Software bill of materials: a list of the parts in a piece of software

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Federal cybersecurity, privacy, and technology governance

Found in the last 7 days

Filters

Results

What the statuses mean

Names on this page

Get new governance by email