Will SBOM consumption be mandated by any new US federal procurement rule taking effect in 2026?

About

Resolves YES if a new FAR or DFARS rule with effective date in 2026 explicitly requires that contractors deliver SBOMs (CycloneDX or SPDX) for software products supplied to the US Government.

Resolution criteria

Final rule published in the Federal Register with a 2026 effective date and an SBOM-delivery clause.

Source

Federal Register regulations.gov; FAR / DFARS update notices.

Ambiguity

AMBIGUOUS if the rule says "where applicable" or "as requested" rather than a categorical mandate.

Discussion

Loading comments…