Not automatically. M-23-16 said software developed under a federal contract is agency developed only if the agency can ensure secure development practices across the whole lifecycle. It also said an application that needs an attestation stays in scope even when a contractor deploys, configures or modifies it for the agency.
The two rules in the memo
M-22-18 left agency developed software out of scope. M-23-16 then addressed contractors. Whether software developed under a federal contract is agency developed "depends on whether the contracting agency is able to ensure that secure software development practices are followed throughout the entire software development lifecycle (i.e., requirements, design, development, testing, deployment, and maintenance)."
The memo made agency CIOs the decision makers: "agency CIOs are required to make that determination on behalf of the agency," because they can judge whether the agency's "specification and supervision of contract performance meet the standard."
On the second rule, the memo is direct: if an agency must obtain an attestation before using an application, "then that application will remain subject to the attestation requirement even if it is deployed, configured, or modified by a Federal contractor on behalf of an agency."
Three examples
| Scenario | Likely reading |
|---|---|
| A contractor builds a custom system under tight agency direction at every lifecycle stage | May be treated as agency developed, but the CIO decides |
| A contractor builds a custom tool with little agency oversight | Harder to call agency developed |
| A contractor installs and configures a commercial product for the agency | The product still has its own producer and its own attestation question |
What integrators should do
If you are the contractor, there are two separate duties to keep straight:
- Your own build work. If you write code, ask the agency early whether it treats the work as agency developed. Get the answer in writing.
- The products you bring in. If you deploy a commercial product, the product's producer is the one who would attest. Ask the vendor for their attestation or evidence and keep it with your delivery records.
Many integrators have no process for collecting vendor attestations, because the buyer used to do it. A simple intake sheet helps: product, version, producer, attestation date, scope, location of the file.
Where this stands now
M-26-05 rescinded M-22-18 and M-23-16 on January 23, 2026. It left decisions on assurance with each agency head and says agencies must keep an inventory of software and hardware. That means a contractor may now see different requests from different agencies. The reasoning in M-23-16 is still a sensible way to explain who is responsible for what, but your contract is what binds you.
A short checklist for integrators
- Which components in the solution are commercial products, and who produced each?
- Has the agency said how it treats custom code in this contract?
- Where are vendor attestations or substitute evidence stored?
- Who tells the agency if a component changes materially?
Quick check
Who decides if contractor code is agency developed?
M-23-16 said the agency CIO makes that determination.
Does configuring a product make us the producer?
The memo says the application remains subject to the attestation requirement even if a contractor configures it. Producer status depends on who developed the software.
Sources
Last reviewed: 19 October 2026.
