Federal software security guidance still gives agencies a shared way to assess how suppliers develop software, but the former government-wide attestation requirements are no longer in force. On January 23, 2026, OMB Memorandum M-26-05 rescinded M-22-18 and M-23-16. Agencies may choose to use resources created under the earlier policy, including its attestation form; whether a supplier must provide one for a particular purchase depends on the agency’s current policy and procurement documents.
What the federal software security guidance covers
NIST’s guidance under Section 4(e) of Executive Order 14028 is written for federal purchasers evaluating software and products that contain software. Examples include firmware, operating systems, applications, and application services such as cloud-hosted software. It does not cover software developed by federal agencies or open-source software obtained freely and directly by an agency. Open-source components bundled into, integrated with, or otherwise used in purchased software are within scope. NIST’s purpose-and-scope guidance quotes the Executive Order’s rationale: “the security of software used by the Federal Government is vital to the Federal Government’s ability to perform its critical functions.”
The guidance aims to help agencies obtain useful information from producers and make risk-based procurement decisions. Its technical reference is NIST’s Secure Software Development Framework (SSDF), which organizes practices for securing software throughout its lifecycle. Relevant areas include secure development environments, trusted source-code supply chains, vulnerability identification and remediation, component provenance, software bills of materials (SBOMs), vulnerability disclosure, and producer attestation. NIST’s producer-and-user overview explains the broader software supply-chain context.
What changed: the 2026 policy update
OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security”, is dated January 23, 2026. It states that OMB M-22-18 and M-23-16 “are hereby rescinded.” It also says agencies may choose to use government-wide resources developed under M-22-18, including the Secure Software Development Attestation Form. The prior memoranda should therefore be treated as historical policy, not as current government-wide attestation mandates.
#1 Best Overall
That rescission does not erase NIST’s technical guidance or determine every agency’s contract terms. For a specific purchase, consult the current solicitation, contract, and applicable agency policy to find out whether an attestation, supporting evidence, or another security assessment is required.
How the earlier attestation policy worked
Under the former M-22-18 policy, agencies were instructed to collect attestations for covered software used by the agency. If a producer could not attest to one or more practices, the earlier memorandum described a plan-of-action-and-milestones process. M-23-16 later updated timelines and scope. These details explain the program’s history; they do not reinstate requirements rescinded by M-26-05. The original M-22-18 memorandum is available for historical reference.
Rank #2
What an attestation says—and what it does not prove
An attestation is a producer’s statement about its secure-development practices. It is not, by itself, an independent audit or certification. Supporting artifacts are evidence behind the statement. A supplier’s self-attestation is first-party; a purchaser’s own assessment or an independent third-party assessment adds another validator. NIST recommends using SSDF terminology so purchasers and producers can communicate consistently about the practices being asserted. NIST’s attestation guidance recommends that statements cover processes and procedures across the software lifecycle, rather than only a single release snapshot.
For the former M-22-18 form, NIST described minimum elements as the producer’s name, the product or products covered, and a statement that the producer follows secure development practices prescribed by NIST guidance. NIST’s FAQ also described identifying a contact able to provide supporting artifacts upon request. Those are descriptions of the former form, not a current universal checklist. NIST’s attestation FAQ addresses the former policy’s questions for agencies and software producers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How much evidence should agencies request?
NIST generally favors high-level artifacts: summaries of secure-development practices that can be traced to detailed evidence the producer maintains. It does not recommend routinely demanding low-level artifacts for a specific release to satisfy Executive Order 14028. Such material can be expensive to analyze and may expose proprietary information or details that could help attackers. More extensive evidence may still be appropriate for higher-risk software or under separate agency requirements. NIST’s terminology guidance helps distinguish assurance methods and evidence types.
The choice of validation and evidence should reflect the software’s criticality and the agency’s assurance needs. A practical comparison is:
Rank #4
| Approach | Who validates | Typical evidence focus | When it may fit |
|---|---|---|---|
| Producer self-attestation | The software producer | High-level process summaries traceable to maintained evidence | When the agency’s risk assessment finds a producer statement sufficient |
| Purchaser assessment | The acquiring agency | Requested summaries or additional artifacts selected for the purchase | When the agency needs to evaluate the statement against its requirements |
| Independent assessment | A second- or third-party assessor | Evidence and review depth set to the assurance need | When the product’s criticality or other risk factors justify stronger validation |
The table describes assurance options, not a binding sequence or a government-wide requirement. NIST’s recommendation is to scale method and rigor to risk, and M-26-05 now directs agencies toward a risk-based approach.
Quick Recap
What software producers and federal buyers should do now
For software producers
- Map existing secure-development practices to the SSDF so agency discussions use a common vocabulary.
- Be precise about which product or products a statement covers and which lifecycle practices it represents.
- Maintain detailed supporting evidence internally, while preparing concise summaries that can be shared when requested.
- Check each solicitation, contract, and agency policy for current requirements; do not assume the former M-22-18 form is either mandatory or universally accepted.
For agency acquisition and technology teams
- Identify the current agency and contract requirements that apply to the purchase.
- Use SSDF-aligned questions to understand the producer’s practices across the lifecycle.
- Set the assurance level according to software criticality and procurement risk, choosing among self-attestation, purchaser review, and independent assessment as appropriate.
- Request evidence proportionately. Consider whether a high-level summary is enough before seeking sensitive, release-specific artifacts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
