A self-attestation is a signed statement about your practices. A third-party assessment is an independent check against the same baseline. An SBOM is data about what is in a product. They answer different questions, and M-22-18 treated them as three separate levels of assurance rather than substitutes.
What M-22-18 said about each
Self-attestation was "the minimum level required." The memo said agencies might make risk-based determinations that a third-party assessment is required for critical products or services.
Third-party assessment by a FedRAMP certified third party assessor organization, or one approved by the agency, was acceptable in place of a self-attestation, provided it used the NIST guidance as the baseline. The memo said this applied to open source software or products incorporating it.
Artifacts such as an SBOM could be required "as needed" and based on criticality. M-22-18 also mentioned other artifacts, such as outputs of automated tools that check source code integrity and known vulnerabilities, and evidence of a vulnerability disclosure program.
What each tells a buyer
- Self-attestation. A signed statement of practices. It answers whether you follow the practices. It cannot show whether the statement is true.
- Third-party assessment. An independent evaluation. It answers whether someone checked that you do. It does not describe product contents.
- SBOM. An inventory of components. It answers what is inside the product. It does not show how the product was built.
The three complement each other. An SBOM does not show process discipline. An attestation does not list components. An assessment is the strongest on process but adds cost and time.
Where things stand
OMB M-26-05 rescinded M-22-18 and M-23-16. Agencies may still use the attestation form and may adopt an SBOM on request term, based on their own risk assessment. It tells agencies to validate provider security using secure development principles and a comprehensive risk assessment, without picking one of the three.
Choosing as a buyer
- Low criticality, many suppliers: ask for a signed statement and a sample SBOM.
- High criticality or handling sensitive data: add a third-party assessment or a review of artifacts.
- Fast moving cloud service: ask for a runtime SBOM or a snapshot API, plus a statement of practices.
Choosing as a supplier
Prepare all three in light form: a practices statement with evidence, a recent assessment or report you can share under NDA, and a current SBOM. Having them ready shortens most reviews. Whatever you share, make sure each claim is true and current.
For how signatures and provenance fit in, see signature, provenance and SBOM attestation compared.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how evidence attaches to controls, which is the idea behind an assessment.
Quick check
Can an SBOM replace an attestation?
No. An SBOM describes contents. An attestation describes practices. M-22-18 treated them as separate items.
Is a third-party assessment ever required?
M-22-18 said agencies could decide it was required for critical products. After M-26-05, each agency sets its own terms.
Sources
Last reviewed: 19 October 2026.
