View Information Collection Request (ICR) Package

OMB Control No: 1670-0052	ICR Reference No: 202404-3084-001CF
Status: Active	Previous ICR Reference No:
Agency/Subagency: FTC	Agency Tracking No:
Title: Secure Software Self-Attestation Common Form
Type of Information Collection: RCF New	Common Form ICR:
Type of Review Request:
OIRA Conclusion Action: Approved without change	Conclusion Date: 04/24/2024
	Date Received in OIRA: 04/22/2024
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2027
Responses	167	0	0
Time Burden (Hours)	405	0	0
Cost Burden (Dollars)	0	0	0

Authorizing Statute(s): EO: EO 14028 Name/Subject of EO: Improving the Nation’s Cybersecurity

Citations for New Statutory Requirements: EO: EO 14028 Name/Subject of EO: Improving the Nation's Cybersecurity

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:

Federal Register Notices & Comments
Did the Agency receive public comments on this ICR?

Number of Information Collection (IC) in this ICR: 1

IC Title	Form No.	Form Name
Secure Software Development Attestation Form	N/A

ICR Summary of Burden

	Total Approved	Change Due to New Statute
Annual Number of Responses	167	167
Annual Time Burden (Hours)	405	405
Annual Cost Burden (Dollars)	0	0

Burden increases because of Program Change due to Agency Discretion: No

Burden Increase Due to:

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: Executive Order 14028, “Improving the Nation’s Cybersecurity” (E.O. 14028), requires that the Director of OMB take appropriate steps to ensure that Federal agencies comply with Guidance from the National Institute of Standards and Technology (NIST) within the Department of Commerce. To that end, OMB issued Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-22-18), on September 14, 2022. That memorandum was updated on June 9, 2023, through OMB Memorandum M-23-16, “Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices” (M-23-16). M-22-18, as amended by M-23-16, provides that a Federal agency may use software subject to M-22-18’s requirements only if the producer of that software has first attested to compliance with Federal Government-specified secure software development practices drawn from the SSDF. This self-attestation form identifies the minimum secure software development requirements a software producer must meet, and attest to meeting, before software subject to the requirements of M-22-18 and M-23-16 may be used by Federal agencies. This form is used by software producers to attest that the software they produce is developed in conformity with specified secure software development practices.

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods?

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? Uncollected

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? Uncollected

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? Uncollected

Is this ICR related to the Pandemic Response? Uncollected

Agency Contact: Jacalyn Johnson 202 326-2218

View ICR - OIRA Conclusion