Tick New Attestation for a first submission, Revised Attestation when something you attested to has changed, and Attestation Following Extension or Waiver when an agency used an extension or waiver while you worked toward attesting. The form does not define the boxes further, so confirm any edge case with the agency.
What the form shows
The top of Section I has three checkboxes: "New Attestation," "Attestation Following Extension or Waiver," and "Revised Attestation." A footnote on the form adds that attestations are binding for future versions of the named product "unless and until the software producer notifies the agencies to which it previously submitted the form that its development practices no longer conform to the required elements."
When each box fits
| Box | Typical case | Example |
|---|---|---|
| New Attestation | First time you submit for a product or company scope | You finish your practices review and sign for the first time |
| Attestation Following Extension or Waiver | An agency kept using your product under an extension or waiver while you worked on a POA&M, and you can now attest | The POA&M items are closed and you sign |
| Revised Attestation | You already attested and something changed | You add a product line, change scope or fix a lapsed practice |
How extensions and waivers come into it
Under M-22-18 and M-23-16, an agency could keep using software when a producer could not attest to every practice, if the producer identified the practices it could not attest to, documented mitigations and delivered a POA&M. M-23-16 added that the agency "must concurrently seek an extension of the deadline for attestation from OMB" and include the POA&M in the request. The extension and waiver steps belong to the agency. Your part was the POA&M and, later, the attestation.
The middle box records that history: this attestation follows a period of extension or waiver. M-26-05 has since rescinded both memos, so you are less likely to meet that path now, but you may still see it on forms signed earlier.
Revised attestation, in practice
Revised fits more cases than people expect:
- Scope change. A new product or version line joins a previously narrower attestation.
- Practice change. A practice lapsed and has been restored, or the way you meet it changed in a material way.
- Correction. The first submission described scope or products inaccurately.
If a practice has lapsed and not yet been restored, the form says you will notify agencies when you cease to make consistent use of the practices. Ask counsel how to handle notice and revision together.
A simple decision flow
- Have we submitted this scope to this agency before? If no, New.
- Was the agency using our product under an extension or waiver until now? If yes, Following Extension or Waiver.
- Otherwise, is this updating an existing submission? If yes, Revised.
Keep the earlier version on file. A short change note explaining what changed and why is useful for the next reader.
Quick check
Do we need to revise for every minor release?
The footnote says attestations are binding for future versions unless you notify agencies that practices no longer conform. Revise when scope or practices change, not for every release.
Who requests the extension or waiver?
The agency does, to OMB, under the old memos. The producer supplies the POA&M.
Sources
Last reviewed: 19 October 2026.
