The CISA form says it must be signed by the software producer's CEO or a designee. The designee must be an employee of the producer and have the authority to bind the corporation. A contractor, an outside consultant or a team lead without that authority does not meet the instruction.
What the instructions say
The form instructions state that the form "must be signed by the Chief Executive Officer (CEO) of the software producer or their designee, who must be an employee of the software producer and have the authority to bind the corporation." By signing, that person attests that the software is developed in conformity with the practices listed in the form.
The signature block also adds a qualifier. The attestation is made "to the best of my knowledge" and says the producer "presently makes consistent use" of the listed practices. So the signer is relying on what engineering and security teams tell them. That is why preparation matters more than the signature itself.
Who can and cannot sign
| Person | Meets the instruction? | Why |
|---|---|---|
| CEO | Yes | Named directly on the form |
| Employee designated by the CEO with authority to bind | Yes | Matches the designee wording |
| CISO or VP Engineering with no authority to bind | Not on that basis alone | Needs to be a designee with binding authority |
| Outside consultant or contractor | No | The designee must be an employee |
| Third party assessor | Different route | A 3PAO assessment can be attached instead, and the producer need not sign |
Section II of the form also asks for a primary contact. That field "may be an individual, role, or group" and the email may be an alias. The contact does not have to be the signer, which lets a security or compliance team own follow-up questions.
What to prepare before the signer sees it
- List the product names, versions and release dates the attestation will cover.
- Ask engineering leads to confirm each practice in Section III, one by one, in writing.
- Collect the evidence behind each confirmation, such as access settings, scan configuration and your vulnerability disclosure page.
- Have your contracts or legal team review the final text. The form warns that willfully providing false or misleading information may violate 18 U.S.C. section 1001. This post is not legal advice.
- Record who confirmed what and when, so the signer can see the basis for the statement.
Does the form still matter?
OMB M-26-05, issued January 23, 2026, rescinded M-22-18 and M-23-16, the memos that told agencies to collect the form. It also says agencies may still choose to use the government-wide resources, including this form. So you may still be asked for it by an agency, a prime contractor or a contract clause. Ask the requester rather than assuming either way.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how one piece of evidence can be mapped to several framework requirements, which is the same habit that makes a signer's job easier.
Quick check
Can our CISO sign if the CEO is unavailable?
Only if the CISO is an employee and has been designated with authority to bind the corporation. The form's wording is about authority, not job title.
Does a third party assessment still need a signature?
The instructions say the producer need not sign the form when a qualifying 3PAO assessment is attached. The 3PAO must be FedRAMP certified or approved in writing by an appropriate agency official.
Sources
Last reviewed: 19 October 2026.
