How will OMB’s M-26-05 rescission of the “Common Form” secure software attestation change software procurement requirements for federal contractors? 2026
OMB M-26-05 (Feb 19, 2026) rescinds the single “Common Form” attestation; agencies now require risk-based, agency-specific attestations or CISA form completion. Small vendors should budget $25K-$150K and prepare agency-specific evidence or risk award ineligibility.
Gov Contract Finder
•7 min readWhat Is the OMB M-26-05 Rescission and Who Does It Affect?
What is the OMB M-26-05 rescission of the Common Form?
GSAOMBCISA
According to GSA guidance and OMB M-26-05, the rescission removes the single, government-wide secure software attestation and directs agencies to adopt risk-based, agency-specific attestations or use CISA’s Secure Software Development Attestation Form. The change took effect Feb 19, 2026 and shifts enforcement to agency procurement officials.