White House Nixes Biden-Era Software Security Rules

Cybersecurity analysts say the White House’s rollback of Biden-era software attestation rules reflect broad frustration with compliance-driven security requirements – but warn the move could leave federal agencies with fewer consistent safeguards if the rules are not replaced.

See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions

The Office of Management and Budget rescinded two directives requiring agencies to obtain software security attestations from vendors before deploying their products, reversing a pillar of the previous administration’s secure-software supply chain strategy. The move withdrew OMB Memorandum 22-18 and its companion policy M-23-16, which directed agencies to require software producers to self-attest compliance with secure development practices aligned with National Institute of Standards and Technology guidance under a 2021 cybersecurity executive order.

In a new memo, OMB Director Russell Vought said the policies imposed “unproven and burdensome” software accounting requirements that emphasized compliance artifacts over meaningful risk reduction.

“This policy diverted agencies from developing tailored assurance requirements for software and neglected to account for threats posed by insecure hardware,” Vought wrote, instructing agencies to instead adopt a more risk-based approach to software and hardware security.

Analysts told Information Security Media Group the original requirements were designed to operationalize federal cybersecurity guidance following the SolarWinds supply chain breach, pushing agencies to demand secure software development attestations and – in many cases – software bills of materials before deploying commercial products. Software producers were required to attest that their development processes aligned with NIST’s Secure Software Development Framework, a set of controls that aim to improve security outcomes through practices like threat modeling and vulnerability remediation.

The rollback has drawn mixed reactions from industry experts, with some arguing the attestation regime had devolved into a paperwork exercise with limited security value. But many said that removing baseline requirements risks fragmenting assurance expectations across the federal enterprise.

Kevin Greene, chief cybersecurity technologist for public sector at BeyondTrust, described the new memorandum as “a knee-jerk reaction to place a liability target squarely on software producers” without first establishing proven and repeatable practices that are known to produce better quality and security in software.

“In the long run, this does more harm than good,” he added, saying the move “turns software security into an arbitrary, moving target for suppliers.”

OMB’s new guidance does not prohibit agencies from continuing to use attestations, SBOMs or related artifacts but it removes the universal mandate. It directs feds to maintain inventories of software and hardware – and to develop new assurance requirements that reflect their own risk determinations.

Tim Mackey, head of software supply chain risk strategy at Black Duck, said rescinding the guidance effectively strips out key software assurance elements tied to the previous administration’s executive order, leaving zero trust architectures and SBOMs as the only remaining pillars of the order’s software security posture.

Self-attestations have limitations, Mackey said, but alignment with the Secure Software Development Framework has been an expectation in the industry for years – “and any associated burden reflects the need to improve cybersecurity practices.”

Other experts welcomed the shift toward risk-based decision-making. David Brumley, chief AI and science officer at Bugcrowd, said blanket requirements often resulted in “compliance-by-paperwork” rather than real validation, and that active security testing provides more meaningful assurance.