Skip to content
TrackPodcasts
governmentMar 15, 20262:16

OMB Reverses Federal Contractor Cybersecurity Requirements, Creating Policy Fragmentation Across Agencies

About this episode

Russ Vought, director of the Office of Management and Budget, issued Memorandum M-26-05 on January 23, 2026, reversing parts of the United States Cyber Strategy for federal contractors. AI CERTs News reports that Vought described the prior process as burdensome and unproven, scrapping mandatory Cybersecurity and Infrastructure Security Agency self-attestations and shifting risk ranking back to agency teams. This change allows agencies to waive documentation for low-risk software while still requiring inventories, creating flexibility but also policy fragmentation across government programs.

The move affects software suppliers on federal schedules, eliminating a uniform due date for attestations and forcing vendors to track unique disclosure rules in solicitations. Larger contractors welcome the adaptability for complex portfolios, though compliance officers call it the year's biggest planning surprise. Meanwhile, the Department of Defense sticks to its Cybersecurity Maturity Model Certification program, with rules effective since December 2024 demanding third-party reviews for higher levels, leading to estimated annual costs of four to four point two three billion dollars according to the Government Accountability Office.

Vought's decision highlights tensions in federal cybersecurity enforcement. The Justice Department continues pursuing contractors for fraud under the Civil Cyber-Fraud Initiative, recovering over fifty million dollars in cyber settlements last fiscal year. Axios notes Vought recently raised separate spending concerns directly to the White House, signaling his push for fiscal discipline amid ongoing policy shifts.

Contractors now face diverging requirements by agency, with upcoming milestones like Department of Defense clauses in April 2026 and federal guidance throughout the year. Vought's memo eases some burdens but underscores the need for tailored compliance strategies.

Thank you for tuning in, listeners, and please subscribe for more updates. This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI

Get every episode summarized

Each time Director of the Office of Management and Budget - 101 publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.

Email me new episodes

Free for 3 shows. No card needed.

Hosts & guests

Transcript ready

24 searchable segments. Every word is indexed and playable.

OMB Reverses Federal Contractor Cybersecurity Requirements, Creating Policy Fragmentation Across Agencies

Director of the Office of Management and Budget - 101

0:00
2:16

Full transcript

Director of the Office of Management and Budget - 101OMB Reverses Federal Contractor Cybersecurity Requirements, Creating Policy Fragmentation Across Agencies. Machine-transcribed; use the interactive transcript above to jump the player to any line.

RESTVALT, Director of the Office of Management and Budget, issued Memorandum M26-05 on January 23, 2026, reversing part of the United States Cyber Strategy for Federal Contractors. ICEIRTS News reports that VALT described the prior process as burdensome and unproven, scrapping mandatory cybersecurity and infrastructure security agency, self-attestations, and shifting risk ranking back to agency teams. This change allows agencies to waive documentation for low-risk software while still requiring inventories, creating flexibility, but also policy fragmentation across government programs. The move affects software suppliers on federal schedules, eliminating a uniform due date for attestations, and forcing vendors to track unique disclosure rules in solicitations. Larger contractors welcome the adaptability for complex portfolios, though compliance officers call it the year's biggest planning surprise.

Meanwhile, the Department of Defense sticks to its cybersecurity maturity model certification program, with rules effective since December 2024 demanding third-party reviews for higher levels, leading to estimated annual costs of $4.23 billion, according to the government Accountability Office. VALT's decision highlights tensions in federal cybersecurity enforcement. The Justice Department continues pursuing contractors for fraud under the Civil Cyber Fraud Initiative, recovering over $50 million in cyber settlements last fiscal year. Axios notes VALT recently raised separate spending concerns directly to the White House, signaling his push for fiscal discipline amid ongoing policy shifts. Contractors now face diverging requirements by agency, with upcoming milestones like Department of Defense clauses in April 2026, and federal guidance throughout the year. VALT's memo eases some burdens but underscores the need for tailored compliance strategies.

Thank you for tuning in listeners, and please subscribe for more updates. This has been a Quiet Please production. For more, check out QuietPlease.AI.

More episodes

More from Director of the Office of Management and Budget - 101

View all episodes →