OMB Rescinds Secure Software Development Mandate In Favor Of A Risk-Based Approach

On January 23, 2026, the Office of Management and Budget (OMB) reversed some relatively new requirements for secure software development that had been imposed on federal contractors. This move is notable because the attestation previously required had created some uncertainty. OMB issued a new memorandum adopting a risk-based approach to software and hardware security that rescinds the Biden Administration memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices, and the companion memorandum M-23-16. Memorandum M-22-18 had imposed a requirement that federal agencies get a self-attestation from software producers stating that the producer complies with certain secure development practices identified in National Institute of Science and Technology (NIST) Special Publication 800-218: Secure Software Development Framework before the agency could use their software. M-22-18 also instructed the Cybersecurity and