OMB Memo M-22-18: What It Requires
OMB Memorandum M-22-18 (September 2022) directed federal agencies to require software producers to provide a self-attestation confirming that they have implemented secure software development practices as described in NIST SP 800-218 (the Secure Software Development Framework). For software critical to national security or critical infrastructure functions, third-party assessments are required. The memo set a 90-day window for agencies to begin collecting attestations from producers of critical software, and a 270-day window for all software.
The Secure Software Development Framework (SSDF)
The NIST SSDF (SP 800-218) provides the framework of secure development practices that attestations cover. Its four practice groups are: Prepare the Organization (establishing security policies and roles), Protect the Software (securing the build environment and source code), Produce Well-Secured Software (implementing security in the development process), and Respond to Vulnerabilities (having processes for receiving and responding to vulnerability reports). SBOMs are explicitly referenced as part of the "Produce Well-Secured Software" group — specifically, maintaining an SBOM for all produced software.
Self-Attestation vs. Third-Party Assessment
Most software producers can self-attest — certifying that they comply with the SSDF practices without an independent third-party audit. Third-party assessment is required only for "critical software" as defined by CISA. The self-attestation process requires the CEO or other designated senior official to sign the attestation — creating personal accountability for the accuracy of the statement and giving the security requirement executive visibility it often lacked previously.
Practical Implementation Steps for Federal Contractors
Federal contractors should: implement SPDX or CycloneDX SBOM generation in all CI/CD pipelines for products sold to federal agencies; conduct a gap analysis against all SSDF practices; document secure development processes for the attestation; establish a vulnerability disclosure and response process; and identify which products qualify as "critical software" requiring third-party assessment. Starting with an automated SBOM generation program addresses both the SBOM requirement directly and contributes evidence for several SSDF practices simultaneously.
Federal SBOM Compliance Made Systematic with Fossity
Fossity — Fossity provides the SBOM generation, component inventory, and audit documentation that federal contractors need for EO 14028, OMB M-22-18, and SSDF compliance. Generate compliant SBOMs, maintain continuous vulnerability monitoring, and produce the evidence package your attestation requires.
Visit Fossity.com →