Yes, under the CISA form. A producer may attach a third party assessment instead of signing, if the assessor is a FedRAMP certified 3PAO or one approved in writing by an appropriate agency official, and the assessment baseline covers every element in the form. The form does not make this assessment a certification.
What the form says
The instructions state that a producer "may choose to demonstrate conformance with the minimum requirements by submitting a third-party assessment documenting that conformance." Two conditions follow:
- The assessment "must be performed by a Third Party Assessor Organization (3PAO) that has either been FedRAMP certified or approved in writing by an appropriate agency official."
- The 3PAO "must use relevant NIST Guidance that includes all elements outlined in this form as part of the assessment baseline."
To use this route the producer checks a box in Section III and attaches the assessment. In that case, "the producer need not sign the form." The agency is also told to ensure the assessment is not posted publicly, by the vendor or the agency.
M-22-18 had the same idea: a qualifying 3PAO assessment was "acceptable in lieu of a software producer's self-attestation, including in the case of open source software or products incorporating open source software." It also said self-attestation was the minimum, and agencies could decide that a third party assessment was needed given how critical a product was.
Self-attestation versus assessment
| Question | Self-attestation | 3PAO assessment attached |
|---|---|---|
| Who vouches for it? | The producer, through a CEO or designee | An independent assessor |
| What does the form need? | Signature, date, name, title | A checked box and the attached report |
| Baseline | The practices in Section III | NIST guidance covering all form elements |
| Cost and time | Internal effort | External engagement with an assessor |
| Public posting | Allowed if the producer posts and links it | Not to be posted |
When the assessment route fits
- An agency asked for independent assurance for a high impact product.
- The producer is already working with an assessor for another program, and the scope can be extended to cover the form's elements.
- The CEO would rather rely on an outside review than a purely internal confirmation.
Limits to keep in mind
An assessment is evidence of conformance with the baseline at the time and scope assessed. It is not a certification, and nothing in the form turns it into one. Do not describe it as "certified" in marketing. Say what was assessed, by whom, and when.
Also check the assessor's standing. The form accepts a FedRAMP certified 3PAO, or another one approved in writing by an appropriate agency official. Get that written approval before the work starts, not after.
Where things stand
M-26-05, issued January 23, 2026, rescinded M-22-18 and M-23-16, and says agencies may choose to use the form. If an agency still points you to the form, ask whether it will accept an assessment in place of a signature, and get the answer in writing. Your contracts team can confirm anything beyond that.
Quick check
Does a 3PAO assessment make the product certified?
No. The form treats it as documentation of conformance to the form's elements, not as a certification.
Can any security assessor do the assessment?
The form names FedRAMP certified 3PAOs or others approved in writing by an appropriate agency official.
Sources
Last reviewed: 19 October 2026.
