Four things changed in 2026. US federal policy moved from one common attestation form to agency-by-agency risk decisions. CISA and partners revised the SBOM baseline. EU deadlines under the Cyber Resilience Act and AI Act started to bite. Package hijacks in March showed why all of it matters.
What changed in US federal policy?
On January 23, 2026, OMB issued M-26-05, "Adopting a Risk-based Approach to Software and Hardware Security." The memo rescinds M-22-18 and M-23-16, the pair that created the government-wide secure software attestation process. It says each agency should validate provider security based on its own risk assessment.
The memo keeps some pieces. Agencies still maintain a complete inventory of software and hardware. They may choose to use the Secure Software Development Attestation Form, and they may choose contract terms that require a current SBOM on request.
So the form did not vanish. It became a tool an agency can pick up or leave. If you sell to government, the question is no longer "did we file the form" but "what does this agency and this contract ask for."
What changed with SBOMs?
CISA's SBOM page now lists a 2026 update to the minimum elements for an SBOM, alongside the 2025 draft that was open for public comment until October 3, 2025. The 2021 NTIA baseline is the starting point these documents build on. Read the current CISA document for the exact list of fields, because secondary summaries disagree on how many were added.
The practical direction is clear. Buyers want machine-readable inventories that tools can compare, not PDFs.
Which EU dates matter now?
Under the Cyber Resilience Act, reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and the main obligations apply from 11 December 2027. The Commission published implementation guidance on 27 July 2026.
The EU AI Act reached general application on 2 August 2026, with high-risk system deadlines for Annex III pushed to 2 December 2027 by the AI Omnibus. If you ship software with digital elements into the EU, your vulnerability handling process is now a legal matter, not just good hygiene.
What did the March incidents teach?
On March 24, 2026, malicious LiteLLM releases 1.82.7 and 1.82.8 reached PyPI. Reporting links the access to a compromised security scanner in the project's CI pipeline. A week later, on March 31, malicious axios 1.14.1 and 0.30.4 were published through a compromised maintainer account.
Different mechanics, same lesson. A trusted publisher account or a trusted pipeline tool is itself part of your supply chain. Our posts on LiteLLM and axios walk through each one.
A constructed example
A mid-size SaaS vendor sells to a US agency and to a bank in Germany. In 2025 it kept one attestation form on file. In 2026 the agency's new contract asks for an SBOM on request and nothing else. The German customer asks how the vendor handles exploited vulnerabilities, citing CRA reporting. Same product, two different questions, and the form answers neither.
What to do
- Keep a current, machine-readable SBOM per release, generated in the build, not by hand.
- Check each government contract and agency policy for what it actually asks. Do not assume the old form is required or banned.
- Write down your vulnerability intake and reporting steps, including who can make an exploited-vulnerability report to EU authorities and how fast.
- Pin dependencies and lock files, and delay adopting brand-new releases by a short, fixed window.
- Reduce publish credentials. Use short-lived tokens and publish provenance where your registry supports it.
- Rehearse the "bad release landed in CI" drill: what do you rotate, in what order.
Safeguard can generate SBOMs, scan dependencies, run reachability analysis to show which findings your code can actually hit, and enforce policies and gates in pull requests. Fix pull requests from autonomous remediation are off by default.
Quick check
Is the CISA attestation form still required for federal software?
Not as a government-wide rule. M-26-05 rescinded the memos that created that process. Agencies may still choose to use the form or ask for an SBOM, so check the agency policy and your contract.
Are SBOMs required in 2026?
There is no blanket requirement. Some contracts ask for them, some agencies choose to, and CISA describes its minimum elements as guidance on what producers can supply and buyers can request. Check your contract.
Sources
- OMB M-26-05, Adopting a Risk-based Approach to Software and Hardware Security (PDF)
- CISA, Secure Software Development Attestation Form
- CISA, Software Bill of Materials
- European Commission, Cyber Resilience Act
- European Commission, AI Act
- GitHub advisory GHSA-fw8c-xr5c-95f9, Malware in axios
- PureAI, PyPI removes compromised LiteLLM releases
Last reviewed: 18 October 2026.
