The CISA attestation instructions said software needed a self-attestation if it was developed after 14 September 2022, was older but received a major version change after that date, or was delivered with continuous changes, as SaaS is. Four categories were out of scope. All of this came from M-22-18, which OMB has since rescinded.
The three triggers
Per the form instructions, software required attestation if any one of these held:
- It was developed after 14 September 2022.
- It was developed earlier but modified by a major version change after that date. The instructions give 2.5 moving to 3.0 as an example.
- The producer delivers continuous changes to the code, "as is the case for software-as-a-service products or other products using continuous delivery/continuous deployment."
That third trigger is why SaaS vendors were pulled in even when no version number ever changed.
The four exclusions
The instructions list categories not in scope:
| Excluded category | Plain meaning |
|---|---|
| Software developed by federal agencies | The government's own code |
| Open source freely and directly obtained by an agency | An agency downloads it itself |
| Third party open source and proprietary components inside the end product | The components, not the product |
| Software that is freely obtained and publicly available | Free public software |
A point people miss
Excluding third party components from the form does not mean a producer could ignore them. The instructions say producers who use third party components attest that they took specific steps to reduce the risk of relying on them. The form's Section I adds that the producer attests to the practices "for code developed by the producer." So the scope is your code, plus a duty to manage what you pull in.
Company-wide or per product
The form had a "Type of Attestation" choice: company-wide, individual product, or multiple products or specific versions. A footnote says an attestation stays binding for future versions of the named product unless the producer tells agencies its practices no longer conform.
Is any of this still live?
M-26-05 rescinded M-22-18 and M-23-16 on 23 January 2026. Agencies may still use the form if they choose, so these scope rules matter only if a contract or an agency request still points to them. Read the clause, not the memo. For the sequence, see the attestation timeline, and for the practices themselves see the four practice areas.
Quick check
Was SaaS in scope?
Under the instructions, yes whenever the producer delivers continuous changes, which describes most SaaS.
Did open source projects have to file?
Open source freely and directly obtained by an agency was excluded. A company shipping open source inside a product it sells was still the producer of that product.
Safeguard provides SBOM and dependency scanning that lists third party components, which helps answer a buyer's question about what is inside a product. You can try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
