It depends on the agency and the contract. In January 2026 OMB memo M-26-05 rescinded M-22-18 and M-23-16, the memos that created the government-wide attestation requirement, but says agencies may still choose to use the CISA form. Check your current contract before you assume either way.
How did we get here?
Executive Order 14028, issued 12 May 2021, directed NIST and other agencies to strengthen software supply chain security. NIST describes its Section 4 work as developing criteria and guidelines to evaluate software security and the practices of developers and suppliers. OMB memos M-22-18 and later M-23-16 turned that into a process in which software producers self-attested to secure development practices on a common form.
What did M-26-05 change?
The memo, dated 23 January 2026, states that M-22-18 and M-23-16 are rescinded. It tells agencies to keep a complete inventory of software and hardware and to build assurance policies that match their risk determinations and mission needs. It adds that agencies may choose to use resources developed under M-22-18, such as the Secure Software Development Attestation Form, and may adopt contract terms requiring a current SBOM on request.
The CISA form page repeats this: agencies may choose to use the form. It also says the form is based on NIST SP 800-218, the Secure Software Development Framework, and shows a revision date of 14 May 2024.
So the form still exists and still has a use. It is no longer a single blanket rule across government.
What does this mean for a software vendor?
Your obligation now sits in two places: the agency that buys from you, and your contract. One agency may ask for the form, another for an SBOM, another for neither and instead for its own questionnaire. Contract language written in earlier years may still reference the form or the old memos, and a contract does not change because a memo was rescinded.
Do not tell customers that you are "not required" to do anything, and do not tell them you are "required" either. Ask the contracting officer or read the clause.
How should a team prepare?
The common core has not changed: be able to show secure development practices. The SSDF is still the reference both CISA and OMB cite. A team that can produce evidence of how it builds, tests and fixes software will answer any of the formats.
Constructed example: a vendor gets three requests in one quarter. Agency A asks for the CISA form. Agency B wants an SBOM of its production runtime. Agency C sends its own twenty question risk questionnaire. Because the vendor keeps one evidence folder mapped to the SSDF practices, with build records, SBOMs and a vulnerability policy, all three take a day each and not three weeks.
What should you avoid saying to customers?
Two statements cause trouble. The first is "the form is cancelled." It is not, because agencies may still choose it and contracts may still name it. The second is "we comply with federal requirements." That phrase has no fixed meaning now and invites a question you cannot answer in one line.
Say what is true and specific: which practices you follow, which framework you map them to, and what documents you can provide. If an agency asks you to attest, read each statement on the form, confirm it with the engineers who own the practice, and keep the supporting records. An attestation signed without that check creates more risk than not having one.
What to do
- List every federal and other contract that mentions attestation, M-22-18 or M-23-16.
- Ask each contracting officer whether the term still applies.
- Map your practices to the SSDF and keep the evidence current.
- Keep SBOMs per release ready to deliver.
- Have a named person who signs and answers for any attestation.
- Do not claim compliance with any requirement you have not been asked to meet and cannot show.
Safeguard's compliance automation and SBOM scanning can help keep evidence organized. Safeguard makes no claim that it meets any federal requirement on your behalf.
Quick check
Can we throw away the form?
Not safely. If a contract or agency still asks for it, you still need it. Keep it ready.
Does a rescinded memo cancel contract terms?
No. A contract stays binding on its terms. Ask the agency whether it will modify them.
Sources
- OMB M-26-05 (23 January 2026)
- CISA, Secure Software Development Attestation Form
- NIST, Executive Order 14028 responsibilities
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 18 October 2026.
