M-26-05, Adopting a Risk-based Approach to Software and Hardware Security

Summary

Rescinds the software attestation requirements of M-22-18 and M-23-16 and requires agencies to set their own risk-based software and hardware security policies, with attestation forms and SBOMs as optional tools.

Read it on www.whitehouse.gov

Topics

• Software security and SBOMs
• Supply chain

Replaces

• M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (rescinded)
• M-23-16, Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (rescinded)

What FedXchange has recorded

No changes recorded. The watch records a new document and any change in its status.