Build a one-page index with a row for each statement a buyer may ask about, a link to a dated artifact, an owner, and a review date. The CISA attestation form came with a table tying each statement to SSDF tasks, which gives you a ready set of rows even though agencies now choose their own questions.
Why an index beats a binder
Questionnaires change by agency, but the underlying facts do not. An index lets you answer a new form by pointing at existing artifacts instead of writing fresh prose. It also shows where you have nothing to point at.
The rows, taken from the form's own mapping
The CISA form's appendix maps its four attestation areas to SSDF tasks. Use those as row headings.
| Statement area | SSDF tasks CISA listed | Artifact to link |
|---|---|---|
| Separate and protect each build environment | PO.5.1 | Environment diagram, access lists |
| Log and audit trust relationships | PO.5.1 | Log configuration, review records |
| MFA and conditional access in build systems | PO.5.1, PO.5.2 | Identity provider policy export |
| Encrypt sensitive data such as credentials | PO.5.2 | Secrets manager configuration |
| Trusted source code supply chain | PO.1.1, PO.3.1, PO.3.2, PS.1.1, PW.4.1, PW.4.4, RV.1.1 and others | Scan configuration, dependency policy |
| Provenance of internal and third party code | PS.3.1, PS.3.2, PW.4.1, PW.4.4, RV.1.1, RV.1.2 and others | SBOM per release, signing records |
| Automated vulnerability checks, before releases | PW.7.1, PW.8.2, RV.1.1 and others | CI pipeline run history |
| Vulnerability disclosure program | RV.1.3 and others | Policy URL, handled case log |
The appendix lists more tasks than the table shows for some rows, and the four parts of the vulnerability check item share one combined mapping, so open the form if you need the full list.
Columns that make it useful
- Owner. One named role per row.
- Date last verified. A date, not "ongoing."
- Where it lives. A link to the system of record.
- Gap note. Plain words if the practice is partial.
Rules for keeping it honest
- Link to the source system, not a screenshot, when you can.
- Never describe a practice you only plan to adopt as present.
- Review the index when a product, build system or identity provider changes.
For naming and structure of the files behind it, see evidence folder naming and structure.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a single control links to several pieces of evidence. Your index does the same job on paper.
Quick check
Is the index a legal document?
No. It is an internal working tool. Anything you send to a customer should still be reviewed for accuracy.
Does it replace an attestation?
No. It supports whatever the buyer asks for, including a signed statement where an agency still uses one.
Safeguard provides compliance and evidence automation that collects and maps evidence, plus SBOM and dependency scanning. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
