Prove it with inspectable evidence for each of the six actions the CISA attestation form listed: separated environments, audited trust relationships, MFA with conditional access, minimized risky software, encrypted credentials, and monitored defenses. Exports and logs beat descriptions. The form itself no longer binds agencies, but the six items remain a sensible baseline.
The six items and what to show
The form said environments for developing and building software are secured by these actions "at a minimum."
| Form item | Plain meaning | Evidence a reviewer can inspect |
|---|---|---|
| Separate and protect each environment | Dev, build and release do not share access freely | Network and account diagram; separate project or account listing |
| Log, monitor and audit trust relationships | You know which identities and systems can reach build systems and each other | Access reports, service account inventory, log retention setting, a dated review record |
| MFA and conditional access | Strong sign-in everywhere relevant to building software | Identity provider policy export covering source control, CI and artifact stores |
| Document and minimize risky software in these environments | You track tools in the build environment and drop those that create undue risk | Tool inventory with owner and reason, removal tickets |
| Encrypt sensitive data such as credentials | Secrets are stored encrypted, to the extent practicable and based on risk | Secrets manager configuration, secret scanning results |
| Defensive practices incl. continuous monitoring | Alerts are watched and incidents are handled | Alert routing rules, an incident runbook, a recent exercise record |
The form's own hedges, "to the extent practicable" and "consistent and reasonable steps," show it expected judgment based on risk. That is not an excuse to leave a row empty.
SSDF tasks behind it
CISA's appendix mapped these items mainly to SSDF tasks PO.5.1 and PO.5.2, with PO.3.2 and PO.3.3 for the monitoring item. If a buyer cites those task numbers, this is the area they mean.
A one day exercise
- Pick your most important product's pipeline.
- Walk the six rows and collect one artifact per row.
- Write a one line gap note where you have none.
- Assign owners and a review date.
The result doubles as the first draft of an evidence index.
Common weak spots
- Service accounts and tokens that never expire.
- CI runners shared across trust levels.
- MFA enforced for staff but not for bots with broad rights.
- Logs kept for a short time or in the same place an attacker could erase.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a failed check blocks a merge. Enforced rules in the pipeline are better evidence than a written intention.
Quick check
Is the form still in force?
OMB rescinded the memos behind it, but CISA's page notes agencies may still choose to use it. Check your own contracts.
Do all six apply to a small team?
The wording allows risk-based judgment, so scale the method. Keep evidence for each row.
Safeguard provides policies, gates and guardrails, asset discovery and compliance and evidence automation, which can collect some of this evidence. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
