Per the CISA form instructions, a producer completes every field, has the CEO or a designee sign, then submits through the online form at softwaresecurity.cisa.gov or emails a PDF to the agency. A PDF follows a naming pattern of producer, product, version and attestation date. Keep the signed copy and evidence together.
Two submission routes
The instructions give two options. The online route says: select the URL https://softwaresecurity.cisa.gov. The PDF route says: "If a software producer is unable to submit via the online form, they may email a pdf version of the form to the respective agency," and "Individual agencies will provide their respective email addresses."
Because M-26-05 changed agency policy in January 2026, confirm with each agency which route it wants now. Some may take the form, some may ask for something else.
The naming pattern
The instructions give a pattern for saving the PDF: Software Producer, Product name, Version, Attestation date, joined with underscores. Their example is Acme_SecuritySuite_4.6.2.1_20230124.
| Part | What to enter | Example |
|---|---|---|
| Software producer | Name of the producer that manufactured or compiled the software | Acme |
| Product name | Complete product name | SecuritySuite |
| Version | Version number | 4.6.2.1 |
| Attestation date | Date attested, in YYYYMMDD | 20230124 |
Step by step
- Get the current form from the CISA page and note its version and expiration date.
- Decide scope. Pick company-wide, individual product or multiple products, and list product names, versions and release dates if needed.
- Mark the attestation type. New, following an extension or waiver, or revised.
- Fill Sections I and II fully. The instructions say incomplete forms will not be accepted. Provide a primary contact, which may be a role or an alias.
- Confirm the practices internally. Collect a written confirmation per Section III item from each owner.
- Sign or attach an assessment. The CEO or an employee designee with authority to bind signs, or you check the 3PAO box and attach the report.
- Save with the naming pattern. Use the date of signing.
- Submit by the agency's route. Online form or emailed PDF.
- Store the record. Keep the signed file, the date sent, the recipient and the evidence behind each item.
What to keep afterward
- The signed form and any addendum.
- The submission proof: confirmation page or sent email.
- The evidence folder, organized by form item.
- A calendar entry to re-confirm the practices, since the form says you will notify agencies if you stop making consistent use of them.
- A list of agencies that received the form, so you know whom to notify about changes.
Addenda
The instructions allow agency specific requirements to be included "as an addendum." If an agency asks for more, attach it separately and label it, rather than editing the common form text.
A caution on dates
The form is a snapshot as of the signature date. If your build process changes materially, review whether the statement is still accurate. Your contracts team can advise on the notice steps.
Quick check
Do we need a different form for each agency?
The form is a common form meant for multiple agencies. Agencies may add specific requirements as an addendum.
What if we cannot complete the online form?
The instructions say you may email a PDF version to the respective agency, using the address the agency provides.
Sources
Last reviewed: 19 October 2026.
