CISA SSDAF

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-03-31 in 142 days Expiration date of the form's current OMB approval (OMB control number 1670-0052)
2. 2026-01-23 OMB M-26-05 rescinds M-22-18 and M-23-16; agencies may still use the attestation form but are not required to
3. 2024-03-18 CISA's Repository for Software Attestation and Artifacts opens for online submission of attestation forms
4. 2024-03-11 Final attestation form released by CISA and OMB
5. 2023-06-09 OMB M-23-16 updates M-22-18 on software attestation (rescinded January 2026)

1. 2024-03-11
   Secure Software Development Attestation Form (Version 1.0) Major versionCurrent

   Final common form released by CISA and OMB after stakeholder engagement. source

   More

   • The producer's CEO or a designee attests that the software is built in secure environments, that the producer maintains trusted source code supply chains and provenance, and that it checks for security vulnerabilities on an ongoing basis.
2. 2023-11-16
   Common form, second request for comment Draft

   Revised draft of the common form published in the Federal Register for public comment. source

3. 2023-04-27
   Common form, first request for comment Draft

   First draft of the common form published in the Federal Register for public comment. source

M-26-05 rescinded M-22-18 and M-23-16 on 23 January 2026; agencies may still choose to use the form.

In scope

Under M-22-18 as amended, attestation covered software developed after 14 September 2022, older software with a major version change after that date, and continuously delivered software such as SaaS. source

Out of scope

Out of scope were agency-built software, open source obtained directly by an agency, third-party components inside a product, and freely available software. source

Rescinded

M-26-05 rescinded M-22-18 and M-23-16 on 23 January 2026. source

Where it still matters

Agencies may still choose to use the Secure Software Development Attestation Form. source

The form is a self-attestation signed by the CEO or a designee who can bind the company.

Who signs

The form is a self-attestation signed by the CEO or a designee who can bind the company. source

Coverage

It can cover the whole company, one product or several versions, and stays binding for future versions until the producer says its practices no longer conform. source

Third-party assessment

Instead of signing, a producer may attach a third-party assessment by a FedRAMP-certified or agency-approved 3PAO. source

Gaps

A producer that cannot attest to some practices may submit a plan of action and milestones (POA&M). source

Submission

Forms can be submitted online through CISA's repository. source

If a producer does not provide the requested information, the agency may stop using the software.

Missing information

If a producer does not provide the requested information, the agency may stop using the software. source

False statements

Wilfully false or misleading statements may violate 18 U.S.C. § 1001, a criminal statute. source

Since M-26-05

Since M-26-05, each agency chooses whether to use the form, with assurance policies that match its own risk determinations. source

1. Template Secure Software Development Attestation Form with instructions (PDF)
2. Guidance CISA resource page for the attestation form (with Spanish translation)
3. Guidance Repository for Software Attestations and Artifacts (RSAA) User Guide
4. Law text OMB M-26-05 – Adopting a Risk-based Approach to Software and Hardware Security

1. NIST SSDF

   NIST SP 800-218 (the SSDF) is the full practice framework; the form attests to a selected subset of it.

2. EO 14028

   Executive Order 14028 started the federal secure software effort that led to M-22-18 and this form.

3. FedRAMP

   FedRAMP authorizes cloud services for federal use; a FedRAMP-certified 3PAO assessment is one alternative to signing the attestation.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CISA SSDAF (RSS)