On 23 January 2026 the White House Office of Management and Budget issued memorandum M-26-05, "Adopting a Risk-based Approach to Software and Hardware Security." It rescinds M-22-18 and M-23-16, the memos that required federal agencies to collect a secure software development attestation from vendors. The memo does not ban SBOMs. It tells agencies to decide for themselves, based on risk.
If you sell to US agencies or to companies that copy federal procurement language, the SBOM request in your next contract is now a negotiated term, not a mandated form.
What's affected
Any software or SaaS vendor that has answered a federal-style questionnaire since 2022. Three things changed in the memo text:
- The government-wide requirement to collect attestations is gone. Agencies "may choose to use" the Secure Software Development Attestation Form.
- Agencies "may also choose to adopt contractual terms that require a software producer to provide a current software bill of materials (SBOM) upon request."
- For a cloud platform, the memo says such a term should specify "an SBOM of the runtime production environment upon request."
The memo points agencies to NIST SP 800-218 (the SSDF) and to CISA's 2025 Minimum Elements for a Software Bill of Materials, which it describes as published in draft form on 22 August 2025.
What to do now
- Read the SBOM clause in each open contract for three details: whether it says "on request" or "each release," which format it names, and whether it says "runtime production environment."
- If you run a SaaS product, decide what you can honestly produce for the runtime environment: application dependencies, base image contents, or both. Say which in your reply.
- Offer CycloneDX or SPDX and point to the CISA draft as the field list you follow. Do not promise fields you cannot generate.
- Keep your old attestation answers. The form is still allowed, and some agencies and prime contractors will keep asking for it.
- Write down who can approve a corrected SBOM when you find an error.
Why it matters
A rescinded memo does not mean fewer questions. It means each buyer writes their own. Expect more variation in wording, and answer the actual clause in front of you rather than a standard form. A clear, repeatable SBOM process makes every variation cheap to answer.
Quick check
Did M-26-05 remove SBOMs from federal procurement?
No. It rescinded the attestation memos M-22-18 and M-23-16, but it says agencies may adopt contract terms requiring a current SBOM on request.
