OMB Reverses Federal Contractor Cybersecurity Requirements, Creating Policy Fragmentation Across Agencies

Russ Vought, director of the Office of Management and Budget, issued Memorandum M-26-05 on January 23, 2026, reversing parts of the United States Cyber Strategy for federal contractors. AI CERTs News reports that Vought described the prior process as burdensome and unproven, scrapping mandatory Cybersecurity and Infrastructure Security Agency self-attestations and shifting risk ranking back to agency teams. This change allows agencies to waive documentation for low-risk software while still requiring inventories, creating flexibility but also policy fragmentation across government programs. The move affects software suppliers on federal schedules, eliminating a uniform due date for attestations and forcing vendors to track unique disclosure rules in solicitations. Larger contractors welcome the adaptability for complex portfolios, though compliance officers call it the year's biggest planning surprise. Meanwhile, the Department of Defense sticks to its Cybersecurity Maturity Model Certification program, with rules effective since December 2024 demanding third-party reviews for higher levels, leading to estimated annual costs of four to four point two three billion dollars according to the Government Accountability Office. Vought's decision highlights tensions in federal cybersecurity enforcement. The Justice Department continues pursuing contractors for fraud under the Civil Cyber-Fraud Initiative, recovering over fifty million dollars in cyber settlements last fiscal year. Axios notes Vought recently raised separate spending concerns directly to the White House, signaling his push for fiscal discipline amid ongoing policy shifts. Contractors now face diverging requirements by agency, with upcoming milestones like Department of Defense clauses in April 2026 and federal guidance throughout the year. Vought's memo eases some burdens but underscores the need for tailored compliance strategies. Thank you for tuning in, listeners, and please subscribe for more updates. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.