The text of the Software and Hardware Assurance Policy
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, and after any Federal Acquisition Supply Chain Security Act (FASCSA) order, information and communications technology and services (ICTS) determination, or change to Office of Management and Budget (OMB) M-26-05.
Mandate. OMB issued M-26-05, Adopting a Risk-based Approach to Software and Hardware Security, on January 23, 2026. It requires each agency to keep a complete inventory of its software and hardware. It also requires assurance policies and processes for software and hardware that match the agency’s risk determinations and mission needs. M-26-05 rescinded M-22-18 and M-23-16; the producer self-attestation forms those rescinded memoranda required are no longer a blanket procurement gate. Instead, the risk of the product and its use decides the assurance evidence. The evidence draws on National Institute of Standards and Technology (NIST) SP 800-218 (Secure Software Development Framework) and the Cybersecurity and Infrastructure Security Agency (CISA) 2026 software bill of materials (SBOM) Minimum Elements. It also draws on Executive Order (EO) 14028 §4 and on NIST SP 800-161 for supply chain risk management. The policy also meets NIST SP 800-53 SA-1 and SR-1 for product assurance.
1. Policy Statement #
If a product is missing from the inventory, the Organization cannot assess it, patch it, or remove it when a supply chain order names it. The Organization therefore keeps a complete inventory of software and hardware in use, records an assurance determination for each entry, and asks producers for assurance evidence in proportion to risk. The CISO owns this policy; System Owners own the entries for their systems; contracting officers carry the requirements into contracts.
2. Inventory #
The software and hardware inventory is the Continuous Diagnostics and Mitigation (CDM) hardware and software asset inventory, supplemented for cloud services by the service inventory in The governance, risk, and compliance (GRC) system. Each entry shows the product, version, producer, the systems that use it, the exposure of the asset, and its assurance determination. Software bill of materials data, where obtained, is attached to the entry so that components and their dependencies are traceable to the products that contain them. The CISO measures inventory coverage against the inventory-visibility element of the Agency Logging Plan and reports it with that plan.
Technology supporting the inventory:
(No technology inventory entries for this family.)
3. Risk-Based Assurance Determination #
For each product, the System Owner and the CISO’s supply chain risk management lead decide what assurance evidence the risk of the product and its use requires. They record the determination with the inventory entry:
| Risk tier | Typical products | Assurance evidence expected of the producer |
|---|---|---|
| High | Software that handles authentication, runs with administrative privilege, sits at the boundary, or processes data in a High Value Asset; hardware in the boundary or in High Value Assets (HVAs) | Secure development evidence aligned to NIST SP 800-218 practices. A software bill of materials that meets the CISA 2026 minimum elements, or for cloud platforms, an SBOM of the runtime production environment. Vulnerability disclosure and patch commitments. Hardware provenance. |
| Moderate | Business applications and infrastructure software without privileged reach; standard hardware | Secure development summary; SBOM on request; support and patch commitments |
| Low | Commodity utilities and peripherals with no access to sensitive data | Producer support status and end-of-support date |
The Organization does not ask for a blanket attestation form at any tier. It asks only for the evidence that the tier names.
4. Acquisition and Contract Requirements #
- Solicitations for products in the high and moderate tiers state the assurance evidence the producer must furnish and the organization’s right to request an SBOM during performance.
- The Organization must not buy a product under a statutory or regulatory prohibition. System Owners remove one already in use by the date its rule sets. The prohibitions are:
- FASCSA exclusion and removal orders (Federal Acquisition Regulation (FAR) 52.204-30).
- Covered telecommunications and video surveillance equipment (Section 889; FAR 52.204-25).
- Kaspersky Lab products (FAR 52.204-23).
- Applications that ByteDance develops, provides, or controls (FAR 52.204-27). The TikTok app run by the TikTok U.S. Data Security Joint Venture is no longer covered.
- DeepSeek products and services, and third-party products and services built using DeepSeek implementations (FASCSA Exclusion and Removal Order 2026-01). System Owners remove any in use at once.
- Products and services that Acronis AG or its affiliates supply, directly or indirectly (FASCSA Exclusion and Removal Order 2026-02). System Owners remove any in use within 180 calendar days of the order’s issuance, unless the Organization gets an exception. The supply-chain risk management lead checks the SAM.gov FASCSA order list at least quarterly and reconciles it against the inventory.
- A FASCSA order or an ICTS determination (under EO 13873 and 15 CFR Part 791) that names a product in the inventory is a supply chain risk event. The supply chain risk management lead identifies the affected entries within 3 business days. The System Owner records a removal plan within 10 business days. A vendor concern with no order or determination behind it is a Chief Information Officer (CIO) risk decision under NIST SP 800-161, not an exclusion.
- Contracting officers and representatives carry these terms into new awards, options, and renewals; the CISO reviews solicitations for high-tier products before release.
5. Vulnerability and End-of-Support Handling #
The supply chain risk management lead tracks producers’ vulnerability disclosures and end-of-support notices against the inventory. Remediation follows the Vulnerability Management Policy (POL-VM-001); products approaching end of support follow the End-of-Support Edge Device Plan (PLAN-EOS-001) where they are boundary devices and the configuration management policy otherwise.
6. Roles and Responsibilities #
| Role | Responsibility |
|---|---|
| CISO | Owns this policy; approves the risk tiers; reviews high-tier solicitations |
| Supply-chain risk management lead | Maintains assurance determinations; monitors FASCSA, ICTS, and National Defense Authorization Act (NDAA) prohibitions; runs the quarterly SAM.gov check |
| System Owners and Information System Security Officers (ISSOs) | Keep their systems’ inventory entries complete and current; obtain assurance evidence for their products |
| Contracting officers and representatives | Include the assurance and prohibition terms in contracts; enforce delivery of evidence |
| CIO | Decides risk acceptances for products that cannot meet their tier’s evidence |
7. References #
These are the sources this document cites, with a link to each official text.
- 15 CFR Part 791: Securing the Information and Communications Technology and Services Supply Chain, July 18, 2024.
- Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
- Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
- Executive Order 13873: Securing the Information and Communications Technology and Services Supply Chain, May 15, 2019.
- FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
- FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
- FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
- NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
- NIST SP 800-218: Secure Software Development Framework (SSDF), February 2022.