Skip to content
FedXchange
Menu

Governance tracker

Federal cybersecurity, privacy, and technology governance

Every federal cybersecurity, privacy, and information technology (IT) governance document from the Privacy Act of 1974 to today: laws, executive orders, memoranda, directives, standards, and contract rules.

FedXchange's watch checks the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), the National Archives (NARA), and the Federal Register every day, and the National Institute of Standards and Technology (NIST) every week. New finds appear here the day they are found. The tracker lists public documents only.

Get new governance by emailWhat the statuses meanNames on this page

Found in the last 7 days

Nothing new in the last 7 days.

Skip to the results

Filters

Results

68 documents match these filters

Filters: Privacy.

Showing 1 to 50.

Governance documents, sorted by date issued, newest first. Page 1 of 2.

The table scrolls sideways. Each title opens the document's page.

Governance documents, sorted by date issued, newest first. Page 1 of 2.
Number, sort A to ZTitle, sort A to ZIssuer, sort A to ZTypeIssued, sort oldest firstStatus, sort A to Z
EO 14432Streamlining Access to Government Services Through America.govWhite HouseExecutive orderSeptember 29, 2026In effect
SP 800-18 Rev. 2Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for SystemsNISTNIST Special PublicationJune 30, 2026In effect
M-25-32Preventing Improper Payments and Protecting Privacy Through Do Not PayOMBOMB memorandumAugust 20, 2025In effect
EO 14243Stopping Waste, Fraud, and Abuse by Eliminating Information SilosWhite HouseExecutive orderMarch 20, 2025In effect
SP 800-50 Rev. 1Building a Cybersecurity and Privacy Learning ProgramNISTNIST Special PublicationSeptember 12, 2024In effect
Pub. L. 118-50, Div. IProtecting Americans' Data from Foreign Adversaries Act of 2024CongressLawApril 24, 2024In effect
EO 14117Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of ConcernWhite HouseExecutive orderFebruary 28, 2024In effect
EO 14083Ensuring Robust Consideration of Evolving National Security Risks by the Committee on Foreign Investment in the United StatesWhite HouseExecutive orderSeptember 15, 2022In effect
SP 800-53A Rev. 5Assessing Security and Privacy Controls in Information Systems and OrganizationsNISTNIST Special PublicationJanuary 25, 2022In effect
EO 14034Protecting Americans' Sensitive Data From Foreign AdversariesWhite HouseExecutive orderJune 9, 2021In effect
EO 13971Addressing the Threat Posed by Applications and Other Software Developed or Controlled by Chinese CompaniesWhite HouseExecutive orderJanuary 5, 2021Rescinded
M-21-04Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy ActOMBOMB memorandumNovember 12, 2020In effect
SP 800-53BControl Baselines for Information Systems and OrganizationsNISTNIST Special PublicationOctober 29, 2020In effect
SP 800-53 Rev. 5Security and Privacy Controls for Information Systems and OrganizationsNISTNIST Special PublicationSeptember 23, 2020In effect
EO 13942Addressing the Threat Posed by TikTok, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply ChainWhite HouseExecutive orderAugust 6, 2020Rescinded
EO 13943Addressing the Threat Posed by WeChat, and Taking Additional Steps To Address the National Emergency With Respect to the Information and Communications Technology and Services Supply ChainWhite HouseExecutive orderAugust 6, 2020Rescinded
CSWP 10NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0NISTNIST frameworkJanuary 16, 2020In effect
Pub. L. 115-435Foundations for Evidence-Based Policymaking Act of 2018CongressLawJanuary 14, 2019In effect
SP 800-37 Rev. 2Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and PrivacyNISTNIST Special PublicationDecember 20, 2018In effect
Pub. L. 115-59Social Security Number Fraud Prevention Act of 2017CongressLawSeptember 15, 2017In effect
FAR 52.224-3Privacy TrainingFAR CouncilContract clauseJanuary 19, 2017In effect
M-17-12Preparing for and Responding to a Breach of Personally Identifiable InformationOMBOMB memorandumJanuary 3, 2017In effect
Circular A-108Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy ActOMBOMB circularDecember 23, 2016In effect
M-16-24Role and Designation of Senior Agency Officials for PrivacyOMBOMB memorandumSeptember 15, 2016In effect
Circular A-130Managing Information as a Strategic ResourceOMBOMB circularJuly 28, 2016In effect
M-16-14Category Management Policy 16-2: Providing Comprehensive Identity Protection Services, Identity Monitoring, and Data Breach ResponseOMBOMB memorandumJuly 1, 2016In effect
EO 13719Establishment of the Federal Privacy CouncilWhite HouseExecutive orderFebruary 9, 2016In effect
M-16-03Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management RequirementsOMBOMB memorandumOctober 30, 2015Rescinded
SP 800-53A Rev. 4Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment PlansNISTNIST Special PublicationDecember 11, 2014Withdrawn
M-14-04Fiscal Year 2013 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumNovember 18, 2013Superseded
M-13-20Protecting Privacy while Reducing Improper Payments with the Do Not Pay InitiativeOMBOMB memorandumAugust 16, 2013In effect
SP 800-53 Rev. 4Security and Privacy Controls for Federal Information Systems and OrganizationsNISTNIST Special PublicationApril 30, 2013Withdrawn
M-12-20FY 2012 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumSeptember 27, 2012Superseded
M-11-33FY 2011 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumSeptember 14, 2011Superseded
M-11-02Sharing Data While Protecting PrivacyOMBOMB memorandumNovember 3, 2010In effect
M-10-22Guidance for Online Use of Web Measurement and Customization TechnologiesOMBOMB memorandumJune 25, 2010In effect
M-10-23Guidance for Agency Use of Third-Party Websites and ApplicationsOMBOMB memorandumJune 25, 2010In effect
M-10-15FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumApril 21, 2010Rescinded
SP 800-122Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)NISTNIST Special PublicationApril 6, 2010In effect
M-09-29FY 2009 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumAugust 20, 2009Rescinded
EO 13478Amendments to Executive Order 9397 Relating to Federal Agency Use of Social Security NumbersWhite HouseExecutive orderNovember 18, 2008In effect
M-08-21FY 2008 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumJuly 14, 2008Rescinded
M-07-19FY 2007 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumJuly 25, 2007Rescinded
M-07-16Safeguarding Against and Responding to the Breach of Personally Identifiable InformationOMBOMB memorandumMay 22, 2007Rescinded
NoneRecommendations for Identity Theft Related Data Breach NotificationOMBOMB memorandumSeptember 20, 2006Rescinded
M-06-20FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy ManagementOMBOMB memorandumJuly 17, 2006Rescinded
M-06-19Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology InvestmentsOMBOMB memorandumJuly 12, 2006Rescinded
M-06-16Protection of Sensitive Agency InformationOMBOMB memorandumJune 23, 2006Rescinded
M-06-15Safeguarding Personally Identifiable InformationOMBOMB memorandumMay 22, 2006Rescinded
EO 13402Strengthening Federal Efforts To Protect Against Identity TheftWhite HouseExecutive orderMay 10, 2006In effect

What the statuses mean

In effect
Still in force, possibly with amendments.
Proposed
A proposed rule or draft. It may change before it takes effect.
Superseded
Replaced by a newer document or edition.
Rescinded
Cancelled by its issuer.
Withdrawn
Withdrawn by its issuer (NIST's term).
Retired
Closed by its issuer (CISA's term for a directive that has done its job).
Expired
Lapsed on its own terms.

Names on this page

AI
Artificial intelligence
BOD
Binding Operational Directive, issued by CISA
CISA
Cybersecurity and Infrastructure Security Agency
CUI
Controlled Unclassified Information
DFARS
Defense Federal Acquisition Regulation Supplement, the Department of Defense's additions to the FAR
DoD
Department of Defense
ED
Emergency Directive, issued by CISA
EO
Executive order
FAR
Federal Acquisition Regulation, the rules for federal contracts
FASC
Federal Acquisition Security Council
FedRAMP
Federal Risk and Authorization Management Program, run by GSA
FIPS
Federal Information Processing Standard, published by NIST
FISMA
Federal Information Security Modernization Act
GSA
General Services Administration
ISOO
Information Security Oversight Office, part of NARA
IT
Information technology
MFA
Multifactor authentication
NARA
National Archives and Records Administration
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
OPM
Office of Personnel Management
PIV
Personal Identity Verification, the federal employee ID card
SBOM
Software bill of materials: a list of the parts in a piece of software

Get new governance by email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.

Send me

We use your address only to send what you choose, and every email has a one-click unsubscribe. Read the privacy notice.