Issues federal software- and hardware-security policy and oversees agency implementation of security-assurance requirements; M-26-05 reshaped the software self-attestation regime.
OMB Memorandum M-26-05 (January 23, 2026) rescinded the government-wide mandate for software producers to submit a secure-software-development self-attestation (terminating M-22-18 and M-23-16), shifting responsibility to individual agencies to set risk-based assurance policies. Agencies may still use the CISA attestation form or request runtime-environment SBOMs at their discretion. Confirm at whitehouse.gov/omb.
Re-check each contracting agency’s post-M-26-05 attestation/SBOM expectations rather than assuming the prior government-wide mandate applies.
M-26-05 changes whether members selling software to the government must attest or provide SBOMs — now an agency-by-agency question rather than a single mandate.
Sets whether/how agencies require software self-attestation and SBOMs.
Directs agency security practices via M-series memos.
Monitors agency implementation and budgeting.
Software vendors, compliance, and contracts teams.
Attestation/SBOM process depends on the specific agency.
Agency-specific assurance requirements.
Contract terms for software security assurance.
We focus on the roles whose decisions reach members, and why each one matters — not biographical trivia. Names are intentionally withheld until verified against an official source.
Why it mattersSets management policy including software-assurance memoranda.
Review recommendedThis profile is a sample interface. Leadership names, dates, regulatory status, and figures must be confirmed against current official sources before any member distribution.
