US secure software attestation ran from Executive Order 14028 in May 2021, through OMB memos M-22-18 and M-23-16 and a CISA form, to OMB M-26-05 in January 2026, which rescinded the two memos. Here is the dated sequence so you can place any document you meet.
2021 to 2022: the foundation
12 May 2021. Executive Order 14028 directs NIST to produce guidance on secure development practices and OMB to require agencies to follow it. It lists SBOMs and attestation as practices.
February 2022. NIST publishes SP 800-218, the Secure Software Development Framework version 1.1.
14 September 2022. OMB issues M-22-18. Agencies must obtain a self-attestation from the producer before using covered software. The memo set deadlines: 270 days for critical software and 365 days for all software, counted from the memo date.
2023 to 2024: the form and the reset
9 June 2023. OMB issues M-23-16, which controls where it conflicts with M-22-18. It moves the deadlines so they run from OMB's Paperwork Reduction Act approval of the CISA common form: three months for critical software and six months for all other software. It also clarifies scope and changes how POA&Ms work.
2024. CISA's common attestation form is in use. The form page shows a revision date of 14 May 2024, and the form itself is marked version 1.0 with OMB control number 1670-0052. I did not confirm the exact date OMB approved it.
2025: new orders, no new attestation text
6 June 2025. Executive Order 14306 amends EO 14144 and EO 13694. It sets NIST tasks, including a preliminary SSDF update due 1 December 2025. The text I read does not mention attestations and does not amend EO 14028.
22 August 2025. CISA publishes a draft update of the SBOM minimum elements for public comment. Comments closed 3 October 2025.
17 December 2025. NIST publishes an initial public draft of SP 800-218 Revision 1, called SSDF version 1.2. Comments closed 30 January 2026. I could not confirm a final version.
2026: the memo that rescinds the earlier two
23 January 2026. OMB issues M-26-05, which rescinds M-22-18 and M-23-16. Agencies keep inventory duties and may still use the form or require an SBOM, as their own risk decisions dictate.
29 July 2026. CISA and international partners publish the 2026 SBOM minimum elements, which replace the NTIA 2021 list.
How to use this list
When a questionnaire or contract cites one of these documents, find its date on this list first. Anything citing M-22-18 or M-23-16 as a live government-wide duty is out of date. It may still be a contract term in your own agreement, so read the clause itself.
For a field by field look at the form, see the four practice areas on the CISA attestation form.
Quick check
Which memo set the 365 day deadline?
M-22-18 set it. M-23-16 later tied the deadlines to the approval of the common form instead.
Sources
- EO 14028, Federal Register
- EO 14306, Federal Register
- OMB M-22-18
- OMB M-23-16
- OMB M-26-05
- CISA attestation form page
- CISA attestation common form PDF
- CISA 2026 Minimum Elements for an SBOM
- CISA 2025 minimum elements draft
- NIST SP 800-218 Rev. 1 initial public draft
Last reviewed: 19 October 2026.
