The CISA form's fine print covers four things: an OMB control number with an expiration date, an estimated burden of 3 hours and 20 minutes per response, a Privacy Act statement that is specific to DHS, and a warning that willfully false or misleading information may violate 18 U.S.C. section 1001.
OMB control number and expiration
Each page of the form header shows "OMB Control #: 1670-0052" and "Expiration Date: 03/31/2027." These come from the Paperwork Reduction Act process. The burden statement explains the rule behind them: an agency may not conduct or sponsor a collection of information, and a person is not required to respond, unless it displays a currently valid OMB control number and expiration date.
If you keep a copy of the form for your records, note which version and date it carries. The CISA page lists a revision date of May 14, 2024, so check that page for the current file before you fill in a new one.
Burden estimate
The form estimates the "public reporting burden" at "3 hours and 20 minutes per response, including time for reviewing instructions, searching data sources, gathering, and maintaining the data needed, and completing and reviewing the collection of information."
That figure is the government's average for completing the paperwork. It does not include building the practices themselves. Teams that start from scratch will need much longer to put the controls and evidence in place, so do not read it as a project estimate.
Comments on the burden go to the CISA supply chain risk management mailbox listed on the form.
Privacy Act statement
The statement lists the authorities for the collection, including 44 U.S.C. section 3554, EO 14028 and OMB memos M-22-18 and M-23-16. Its stated purpose is "to provide the Federal Government assurances that software used by agencies is securely developed."
A note in the statement says it is unique to DHS and that each agency using the common form will provide its own Privacy Act statement. The form collects contact information from the vendor employees who make the attestation. So the person you name as signer and primary contact should know their details go to the agency.
Consequences of missing information
The statement warns: "Failure to provide any of the information requested may result in the agency no longer utilizing the software at issue." The instructions also say all fields are required and "incomplete forms will not be accepted."
False statements warning
The statement says willfully providing false or misleading information may constitute a violation of 18 U.S.C. section 1001, a criminal statute. This is a reason to have a documented basis for each answer and to have counsel review. It is not legal advice here.
A short pre-signing checklist
- Download the current form from the CISA page and note its version.
- Fill every field. Use a role based email alias for the contact if you want continuity.
- Tell the signer and contact that their information is collected.
- Keep the signed copy and the evidence folder together.
Quick check
Does the expiration date mean my signed attestation expires?
No. The date belongs to the government's approval of the form as a collection. Your attestation has its own date and notice terms.
Is the 3 hours and 20 minutes a project estimate?
No. It is the burden estimate for completing the paperwork, not for building the practices.
Sources
Last reviewed: 19 October 2026.
