OMB memo M-26-05, dated 23 January 2026, rescinded M-22-18 and M-23-16. Agencies no longer have a government-wide duty to collect a secure development attestation. They may still ask for one, or for an SBOM, based on their own risk assessment, so suppliers now meet agency by agency requirements.
What the memo says, in its own words
The memo is titled "Adopting a Risk-based Approach to Software and Hardware Security." It says each agency head is responsible for the security of software and hardware on the agency network, and that there is no "universal, one-size-fits-all method." Each agency should validate provider security "utilizing secure development principles and based on a comprehensive risk assessment."
It states that M-22-18 "imposed unproven and burdensome software accounting processes that prioritized compliance over genuine security investments," and then rescinds M-22-18 and its companion M-23-16.
What stays
Three things carry over.
- Agencies "shall continue to maintain a complete inventory of software and hardware" and develop assurance policies that match their risk and mission.
- Agencies "may choose" to use the resources built under M-22-18, such as the Secure Software Development Attestation Form.
- Agencies "may also choose" to adopt contract terms requiring a producer to provide a current SBOM on request. For a cloud platform, the memo's footnote says such a term should ask for an SBOM of the runtime production environment.
The memo points agencies to NIST SP 800-218, the CISA minimum elements for SBOMs, and the CISA hardware bill of materials framework for further options.
What it means for a supplier
The change moves the question from "did you file the form" to "what does this agency want for this purchase."
- Do not assume the form is dead. Agencies may keep using it, and your existing contracts may still reference it.
- Do not assume no one will ask about SBOMs. The memo names an SBOM on request as an available contract term.
- Expect differences between agencies. One may ask for the common form, another for an SBOM, another for neither.
- Read each solicitation and contract clause. The memo is policy for agencies. Your obligation is whatever your agreement says.
For the sequence of earlier memos, see the federal software attestation timeline. For the contract clause in particular, see the SBOM on request clause after M-26-05.
What the memo does not settle
The memo does not define a replacement form. It does not state a deadline for new agency policies. Commentators have noted it leaves the scope of the word software open, which was broad in M-22-18. If a customer asks you to read the memo for them, say so plainly and suggest they confirm with their agency counsel.
Keeping the work you already did
Practices behind the attestation, such as separated build environments, multi-factor authentication, provenance and vulnerability checks, are good engineering regardless of which memo applies. Keep the evidence. It will answer a future agency request faster than writing it fresh.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how one body of evidence maps to different buyer requirements, which is the position suppliers are in now.
Quick check
Is a secure software attestation still required for federal sales?
Not by a government-wide OMB mandate after M-26-05. An individual agency may still ask for one in a solicitation or contract.
Is an SBOM now required?
The memo says agencies may adopt SBOM on request terms. It does not make an SBOM universally required.
Sources
- OMB M-26-05, 23 January 2026
- Mayer Brown, OMB rescinds Biden-era software security memoranda
- CISA, Secure Software Development Attestation Form
Last reviewed: 19 October 2026.
