Under M-22-18 as amended by M-23-16, a producer needed to attest for software developed after 14 September 2022, older software with a major version change after that date, and products with continuous updates such as SaaS. Agency-developed software, freely obtained open source, and third-party components were out of scope.
In scope
The CISA form lists three triggers. Software needed an attestation if any applied:
- It was developed after 14 September 2022.
- It was developed earlier but modified by a major version change after that date, for example 2.5 to 3.0 under Major.Minor.Patch.
- The producer delivers continuous changes, as with SaaS or continuous delivery.
The memo defined software broadly, to include firmware, operating systems, applications, cloud application services, and products containing software.
Out of scope
The form lists four exclusions:
- Software developed by federal agencies.
- Open source software that an agency obtains freely and directly.
- Third-party open source and proprietary components incorporated into the end product the agency uses.
- Software that is freely obtained and publicly available.
M-23-16 explained the reasoning. The producer of the end product is best placed to ensure its security, so agencies need not collect attestations from the makers of components inside it. Free public software, such as web browsers, was excluded because users cannot negotiate with the producer. Agencies still had to assess the risk of using it.
Edge cases the memo addressed
Trials and pilots. Software that is otherwise paid, offered for free as a demo or pilot, stayed in scope.
Contractor developed software. Whether it counts as agency developed depends on whether the agency can ensure secure practices across the whole lifecycle. Agency CIOs decide that.
Contractor deployed software. If an application needs an attestation, it keeps that need even when a contractor deploys or configures it for the agency.
Components and the end producer. A producer using third-party components still attests to steps that minimize the risk of relying on them.
Why this matters now
OMB M-26-05 rescinded both memos, so this scope is history for most purposes. It still helps in two ways. Older contracts may reference the form and its scope. And the logic about who is best placed to vouch for a component is a useful rule for your own supplier reviews.
For the replacement picture, read OMB M-26-05: what changed for software suppliers.
A scoping habit worth keeping
When a customer asks about a product, record in one line which products, versions and deployment modes the answer covers. The form had a "company-wide," "individual product," or "multiple products" choice, and its footnote said attestations bind future versions until the producer notifies agencies otherwise. A tidy scope line prevents surprises.
Quick check
Was open source covered?
Open source freely obtained by an agency was out of scope. Open source inside a commercial product was covered by that product's producer attesting to steps for third-party components.
Was SaaS covered?
Yes, when the producer delivers continuous changes. M-23-16 also named hosted services that deploy continuous updates.
Sources
Last reviewed: 19 October 2026.
