OMB M-26-05 says agencies "shall continue to maintain a complete inventory of software and hardware" and build assurance policies that match their risk and mission. For a supplier, that means agencies need accurate product, version and component data. Make it easy to give, and keep it current.
What the memo says
The memo, dated 23 January 2026, rescinds M-22-18 and M-23-16. It then keeps the inventory duty, says agencies may use resources such as the attestation form, may add a contract term for a current SBOM on request, and lists NIST SP 800-218, CISA's SBOM minimum elements and CISA's hardware bill of materials framework as references.
Why the inventory matters to a supplier
An agency cannot assess what it cannot list. When a new vulnerability appears, the first question is which products and versions it runs. A supplier who answers fast makes the agency's inventory more useful.
What data to be ready to give
| Agency need | What you supply |
|---|---|
| Know the product and version | Exact product name, version, release date, support end date |
| Know what is inside | SBOM for that version in a common machine-readable format |
| Know whether a new CVE matters | A statement of whether the product is affected, and a fix plan if so |
| Know who to call | A security contact and disclosure policy link |
| Know hardware parts | A hardware bill of materials if the product includes hardware |
Habits that make this easy
- Give every release a stable identifier and keep a public release list.
- Store the SBOM with each release, not in a person's inbox.
- Keep a template for "are you affected" answers.
- Date everything. An undated inventory entry is hard to trust.
What not to assume
The memo does not say every agency will ask for these items, and it does not set a format. Some will ask for the CISA form, some for an SBOM and some for neither. Read each request. See the SBOM on request clause and which minimum elements to follow.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a new issue is matched to the software you run. That matching is the use an inventory serves.
Quick check
Does the memo say suppliers must give agencies an SBOM?
No. It says agencies may choose a contract term requiring a current SBOM on request.
Does it cover hardware too?
Yes. The inventory duty names software and hardware, and the memo points to CISA's hardware bill of materials framework.
Safeguard provides asset discovery, SBOM and dependency scanning and zero-day discovery, which help a team keep its own inventory and respond to new issues. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
