Loading story…
The White House Office of Management and Budget (OMB) rescinded the 2022 memo M-22-18, which required federal agencies to use a standardized Secure Software Development Attestation Form to obtain cybersecurity assurances from software vendors before procurement. OMB Director Russell (Russ) Vought argued the approach relied on “unproven and burdensome” processes and that “there is no universal, one-size-fits-all method” for validating provider security; agencies are now directed to apply secure development principles based on comprehensive risk assessments tailored to mission needs.
The rescinded policy was a key implementation of Executive Order 14028, issued in response to the SolarWinds supply-chain intrusion, and was intended to use federal purchasing power to drive secure software development practices across the market. Reporting notes concerns from former Biden cyber officials that removing the government-wide attestation requirement represents a cybersecurity policy rollback and could weaken incentives for vendors to meet consistent baseline practices. OMB’s updated guidance still encourages agencies to maintain complete software and hardware inventories and allows continued optional use of the prior attestation form, while also pointing to alternatives such as contractual requirements for vendors to provide a software bill of materials (SBOM) upon request.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Following the Jan. 23 memo and its public reporting on Jan. 26-29, former Biden officials and other experts warned the rollback could weaken procurement-driven software security and create fragmented agency requirements, while supporters said it would enable more tailored, evidence-based decisions. Commentators broadly agreed implementation by individual agencies would determine the practical impact.
The new OMB memo directed agencies to validate software and hardware security using secure development principles, mission needs, and comprehensive risk assessments instead of a one-size-fits-all form. Agencies were still told to maintain complete software and hardware inventories and could continue using the attestation form or require SBOMs by contract on request.
On 2026-01-23, OMB Director Russell Vought signed memorandum M-26-05 rescinding M-22-18 and M-23-16. The new memo ended the governmentwide mandate for standardized vendor self-attestations and SBOM-related procurement expectations, arguing the prior approach was burdensome and unproven.
In June 2024, the polyfill.io incident further demonstrated the importance of knowing where third-party code is used across environments. It was later cited as an example of why agencies need actionable inventory data rather than only compliance attestations.
In March 2024, the xz/liblzma backdoor incident underscored the need for rapid, machine-readable visibility into where software components are deployed and what systems they affect. Later commentary cited it as evidence that paperwork alone is insufficient for supply-chain defense.
In 2022, OMB issued memorandum M-22-18 requiring federal agencies to obtain cybersecurity assurances from software suppliers through a standardized governmentwide self-attestation form tied to secure software development practices. The policy was intended to improve federal software supply-chain security.
In May 2021, President Joe Biden signed Executive Order 14028 to strengthen federal cybersecurity, including software supply-chain security measures prompted by the SolarWinds campaign. This order became the policy basis for later OMB software assurance requirements.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has suspended **CMMC Phase II** requirements as part of a broader acquisition reform effort, delaying the planned expansion of mandatory third-party cybersecurity assessments for many defense contractors. The pause does **not** remove existing obligations: contractors still face **NIST SP 800-171 Rev. 2** self-assessments, **DFARS `252.204-7012`** requirements, and annual executive affirmations submitted through **SPRS**, while prime-contractor scrutiny, possible government spot audits, and persistent nation-state threats continue to drive cyber risk. At the same time, industry reporting warns that those executive affirmations have become a growing legal and governance exposure because **controlled unclassified information (CUI)** often spreads beyond initially scoped systems into contracts, resumes, email, collaboration platforms, schedules, and supplier environments without clear labeling or tracking. Under **32 CFR Part 170**, inaccurate visibility into where CUI resides can make signed CMMC attestations unreliable and increase potential **False Claims Act** exposure, especially when subcontractors handle CUI unknowingly, leaving contractors under pressure to build defensible processes to identify, monitor, document, and validate CUI handling even as the framework is revised.
Jul 28, 2026
The Department of Defense has suspended the planned transition to **CMMC Phase 2**, pausing third-party compliance-attestation requirements while it reviews the Cybersecurity Maturity Model Certification program. The department received more than 1,100 responses totaling over 10,000 pages of feedback, with many commenters—particularly small and mid-sized defense contractors—describing the requirements as disproportionately burdensome. During the review, contractors are expected to demonstrate compliance with **NIST SP 800-171 Rev. 2** through self-assessments and selected government-led assessments; DoD has also halted CMMC waivers for 60 days. DoD CIO Kirsten Davies said the redesigned program should emphasize continuous cybersecurity and resilience, including protections for manufacturers' operational technology, rather than point-in-time compliance checks. Industry feedback also highlighted inconsistent government handling and marking of controlled unclassified information as a supply-chain challenge. Legal commentators warned that suspending requirements through memoranda may be vulnerable because the underlying CMMC and DFARS rules remain in force, and that restoring self-attestation removes independent validation intended to counter inaccurate contractor reporting amid continued state-sponsored espionage against the defense industrial base.
Sep 10, 2026
CISA and partner agencies in the United States and 13 allied countries released updated guidance for the minimum elements of a Software Bill of Materials, replacing the 2021 NTIA baseline with broader requirements intended to improve software transparency and supply chain risk management. The revised framework preserves the original core principles but adds fields for component hash information, license data, author or digital signature, SBOM version, data format details, generation context, and tool metadata, while removing elements such as Access Control and SWID Tags. Officials said the changes were shaped by software supply chain security developments and feedback gathered during a 2025 public comment period. The update is designed to make SBOMs more useful for automated vulnerability management and procurement decisions, and it explicitly notes that some software categories need additional treatment beyond the general baseline. In parallel, the G7 Cybersecurity Working Group published guidance on the minimum elements for an AI-focused SBOM, providing actionable recommendations for public- and private-sector stakeholders to improve transparency across the AI supply chain. The combined guidance signals a broader international push to standardize software component disclosure for both conventional software and AI systems, with future work expected on SaaS, AI-specific components, SBOM trustworthiness, and links to formats such as **VEX** and **CSAF**.
Jul 31, 2026