The Office of Management and Budget has issued a memorandum directing federal agencies to adopt a risk-based approach to software and hardware security by implementing secure development principles and comprehensive risk assessments.
As federal guidance on software and hardware security continues to evolve, stakeholders across government and industry are closely watching how these changes may shape future priorities. To connect with peers and stay engaged in broader cybersecurity discussions, register now for the Potomac Officers Club’s 2026 Cyber Summit on May 21.
Why Did OMB Rescind the Previous Software Security Policies?
In a memo published Friday, OMB Director Russell Vought ordered the rescission of two prior OMB policies, stating that they prioritized compliance over security and imposed burdensome software accounting requirements.
OMB Memorandum M-22-18, introduced by the previous administration in September 2022, sought to strengthen the software supply chain through secure software development practices. However, Vought said the policy “diverted agencies from developing tailored assurance requirements for software and neglected to account for threats posed by insecure hardware.”
OMB also rescinded a companion policy, Memorandum M-23-16, issued in June 2023. That memo reaffirmed secure software development practices and extended deadlines for agencies to collect security attestations from software providers.
What Software & Hardware Security Actions Does the OMB Memo Require?
According to the latest OMB guidance, agencies should continue to maintain complete inventories of their software and hardware and develop assurance policies and processes that align with their risk determinations and mission needs.
Agencies may choose to use the Secure Software Development Attestation Form and other governmentwide resources established under M-22-18.
The memo also allows agencies to incorporate contractual terms requiring software producers to provide a current software bill of materials upon request.
