The HTTPS-Only Standard for federal domains (M-15-13), and helpful implementation guidance. - View it on GitHub