Biden-era software security requirements junked by OMB

Nextgov/FCW reports that the U.S. Office of Management and Budget has reversed a Biden-era order requiring federal government contractors to fulfill a standardized self-attestation form vouching for the security of their systems in the wake of the sweeping SolarWinds hack.

Rescinding the policy has been necessary as it prevented federal agencies from establishing tailored software assurance requirements and considering hardware threats, said OMB Director Russell Vought in a new memo, which still compels agencies to ensure a complete software and hardware inventory, while developing appropriate assurance policies.

While agencies could still leverage the attestation form, they could also mandate software bill of materials from software manufacturers, according to the memo. Such a move has been supported by Wiz Global Head of Public Affairs Mitch Herckis.

"By encouraging a modern approach that recommends SBOMs on demand, the White House is aligning with the fact that software is dynamic and always changing. This is a smart approach to tackling security in the modern software era," said Herckis.