Comment A little background (Score 0, Troll) 56
Analysis of OMB Memoranda M-22-18 and M-23-16
Who's criticizing these memoranda?
Industry and vendor concerns (from the implementation period):
Suppliers and vendors faced variations in conformity assessment expectations from agency to agency, with each agency potentially taking different approaches to the self-attestations. The attestation requirements had to be obtained for every major version change, creating ongoing compliance burdens.
Officers of companies signing the attestation form faced potential criminal liability under 18 U.S.C. 1001 for willfully providing false or misleading information, which created significant legal exposure for vendors.
The Trump administration (January 2026):
OMB's January 2026 memorandum noted that M-22-18 imposed unproven and burdensome software accounting processes that prioritized compliance over genuine security investments and diverted agencies from developing tailored assurance requirements. This was the stated reason for rescinding the policy.
Implementation examples:
Successes:
Challenges:
Hardware security keys cost $20-$50 per user plus licensing fees, creating budget challenges especially for small and medium-sized businesses, along with logistical challenges distributing keys to remote workforces.
Current status:
Important: Both M-22-18 and M-23-16 were rescinded in January 2026 through memorandum M-26-05, which adopted a risk-based approach instead of the universal attestation requirement. Agencies can now choose whether to use CISA's Common Form or develop their own approaches.
Conclusion:
These were technically sound policies with real security merit, but execution had legitimate friction - vendor burden, legal liability concerns, timeline slippage, and agency-by-agency variation. The rescission suggests the new administration viewed the compliance costs as outweighing benefits, though software supply chain security remains a stated priority.