EO 14028 (May 2021) started the federal secure software push. OMB M-22-18 asked producers to attest to secure development practices, and M-23-16 clarified its scope and allowed plans of action and milestones (POA&Ms). OMB rescinded both on January 23, 2026 in M-26-05. Today the question is agency and contract specific.
What did EO 14028 do?
Issued May 12, 2021, section 4 told NIST to identify standards, tools and best practices for software supply chain security, covering criteria for evaluating software security and developers' practices. NIST published guidance through 2022, including the Secure Software Development Framework, SP 800-218, which groups practices into prepare the organization, protect the software, produce well-secured software and respond to vulnerabilities.
What did M-23-16 clarify?
Based on secondary reporting of the June 2023 memo, since we could not retrieve the original text:
Scope. Attestations come from the producer of the end product, not from producers of third-party components, open source or proprietary. Open source freely and directly obtained by agencies, and no-cost publicly available proprietary software, were out of scope. Agency-developed software was out of scope, with agency CIOs deciding how to treat contractor-built software.
POA&Ms. A producer unable to attest to every practice could identify the gaps, document mitigations and submit a POA&M. The agency could continue use only if it found the documentation satisfactory and sought an extension from OMB with the POA&M attached. Otherwise it had to stop using the software.
Deadlines. They were tied to approval of the CISA common form: three months for critical software and six months for all other software.
What replaced it?
M-26-05, dated January 23, 2026, states that M-22-18 and M-23-16 are rescinded. It tells agencies to keep a complete inventory of software and hardware and to build assurance policies that match their risk determinations. Agencies may choose to use the attestation form and may choose contract terms that require an SBOM on request, and for cloud platforms the memo says the SBOM should cover the runtime production environment.
CISA's page on the form now says it is optional for agencies. Law firm reporting disagrees on some effects, for example whether the inventory duty continues unchanged, so read the memo itself.
Does the POA&M idea survive?
As a federal mechanism tied to M-23-16, no. As a practice, yes. If a buyer asks about a secure development practice you do not meet, a written plan with owners and dates is still the honest answer, and many contracts will accept it.
A constructed example
A vendor signed a 2023 contract with a clause citing M-22-18. In 2026 the agency amends it to a risk-based assurance paragraph and asks for an SBOM on request. The vendor keeps its old POA&M for a missing practice, updates it with new dates and sends it with the SBOM. The contracting officer accepts it. The vendor checked the amended clause first.
How to check or apply this
- Read your contract and any amendments for references to M-22-18, M-23-16 or the common form.
- Ask the contracting officer what the agency now requires.
- Keep your SSDF mapping current, since agencies may still ask for it.
- Maintain a written gap plan with owners and dates.
- Be ready to deliver an SBOM on request, for cloud services covering the runtime environment.
- Never state that attestation or SBOMs are required for all federal work.
Safeguard can generate SBOMs and help organize evidence for secure development practices. It does not mean any federal requirement is met.
Why does the history still matter?
Older contracts and flow-down clauses may still cite M-22-18 or M-23-16 even though OMB rescinded them. A subcontractor can receive terms written under the old regime from a prime that has not updated its templates. Knowing the old scope rules helps you read those clauses, ask what the agency now expects and avoid promising more than the contract needs.
Quick check
Is M-23-16 still in force?
No. M-26-05 rescinded M-22-18 and M-23-16 on January 23, 2026. Check your own contract for any clause that still cites them.
Do I still need a POA&M?
Not under a federal rule tied to M-23-16. A written plan is still useful if a buyer asks about gaps.
Sources
- OMB M-26-05 (PDF)
- CISA, Secure Software Development Attestation Form
- NIST, Executive Order 14028
- NIST, Secure Software Development Framework
- Industrial Cyber, report on M-23-16
Last reviewed: 18 October 2026.
