The signature line says the producer, "to the best of my knowledge," "presently makes consistent use" of the listed practices. In plain terms: the statement is about today, it covers practices you actually run on a regular basis, and it rests on what the signer has reason to know. It is not a promise of perfection.
Phrase one: to the best of my knowledge
This qualifier ties the statement to the signer's knowledge. It does not excuse a lack of inquiry, so the sensible reading is that the signer should have asked the right people and kept their answers. The form also warns that willfully providing false or misleading information may violate 18 U.S.C. section 1001, so a documented basis matters. For what that means in your case, ask counsel. This is not legal advice.
Phrase two: presently
"Presently" anchors the statement in time. It describes the state on the signing date, which is why the form has a date field in YYYY-MM-DD format. A practice you plan to adopt next quarter is not a practice you presently follow, and the form does not offer a place to claim it.
Two other lines on the form handle change over time. The producer also attests that it "will notify any agency to which it has submitted this form if and when the producer ceases to make consistent use of the practices." A footnote says attestations are binding for future versions of the named product until the producer gives notice that practices no longer conform.
Phrase three: consistent use
The form does not define "consistent." A workable reading is that the practice is the normal way work happens, not an exception. Compare these:
| Statement | Reads as consistent use? |
|---|---|
| Every release build runs the vulnerability scan in CI | Yes |
| The scan runs when someone remembers | No |
| MFA is enforced on the source host for all engineers | Yes |
| MFA is on for most engineers, with some exemptions that were never reviewed | Not without qualification |
| Disclosure reports go to a monitored mailbox with a triage owner | Yes |
| A security email address exists but nobody watches it | No |
Turn the phrases into a signing routine
- For each Section III practice, name an owner who confirms it in writing.
- Attach one piece of evidence per practice, such as a settings export or a pipeline definition.
- Note exceptions openly. If a practice has a gap, either fix it first or consider the alternative route in the memos: identifying the practice you cannot attest to and sharing a POA&M with the agency.
- Re-confirm on a schedule, because "presently" ages quickly. A quarterly check is a reasonable cadence for most teams.
- Keep the notice duty in mind. If a practice lapses, someone must know to tell the agencies.
Where wording goes wrong
Teams often copy the form's sentences into a sales document and drop the qualifiers. Then "to the best of my knowledge, presently makes consistent use" becomes "we follow all NIST practices." The second sentence says more than the form does. Keep the original phrasing, or describe the practice concretely instead.
Quick check
Does consistent use mean zero exceptions?
The form does not say that. It does require that the practice be part of how you normally work, and that you tell agencies if you stop making consistent use of it.
Is the statement a certification?
No. It is a producer's own attestation unless a qualifying third party assessment is attached instead.
Sources
Last reviewed: 19 October 2026.
