Keep a signed attestation on file, check whether your contracts still cite it, and update it if your practices change. M-26-05 rescinded the memos behind the form, but the form itself says you must notify agencies if you stop following the attested practices, and your contract may repeat that.
What the form itself promises
The CISA form includes this sentence above the signature block: the producer "will notify any agency to which it has submitted this form if and when the producer ceases to make consistent use of the practices identified above."
A footnote adds that attestations are binding for future versions of the named product unless the producer notifies the agencies that its practices no longer conform. The form also warns that willfully giving false or misleading information may violate 18 U.S.C. section 1001.
Those lines are in the document you signed. Nothing in M-26-05 withdraws them from your signed copy. The memo rescinds the OMB policy that told agencies to collect the form. It does not say your past attestations are void.
Decision guide
Keep the attestation if a contract, task order or questionnaire still references it, or the agency has not told you otherwise. Keep the evidence behind it too.
Revise it if the scope changed, such as a new product line, a new hosting model or a practice you no longer follow. A revised attestation or a written notice to the agency is the honest route.
Retire it only after checking the contract language. If an agency tells you in writing that it no longer needs the form, record that message with your copy.
Three checks before you decide
- Search your contracts for "M-22-18," "attestation" and "secure software development." Note each clause.
- Compare the four practice areas to what you actually do today. If a practice lapsed, treat it as a notice trigger.
- Ask each agency customer or prime what it wants now. M-26-05 lets each agency decide, so the answers may differ.
Do not overcorrect
Dropping the controls because the mandate went away would be the wrong lesson. The memo says agencies should still validate provider security "utilizing secure development principles." A supplier who stops doing the work will have a harder answer to give at the next risk review.
Who to ask
This is a contract and compliance question. Your counsel or contracts team should decide the formal steps. For background on the memo, see what changed for suppliers, and for the form's contents see its four practice areas.
Quick check
Did M-26-05 cancel my signed attestation?
The memo rescinds OMB policy for agencies. It does not say prior attestations are void, so check your contract and the form's own notice terms.
Should I stop collecting evidence?
No. Agencies may still ask for assurance, and the evidence answers many other buyer questions too.
Sources
Last reviewed: 19 October 2026.
