View Information Collection Request (ICR) Package

OMB Control No: 1670-0052	ICR Reference No: 202404-3235-003CF
Status: Active	Previous ICR Reference No:
Agency/Subagency: SEC	Agency Tracking No:
Title: Secure Software Development Attestation Form
Type of Information Collection: RCF New	Common Form ICR:
Type of Review Request:
OIRA Conclusion Action: Approved without change	Conclusion Date: 04/17/2024
	Date Received in OIRA: 04/17/2024
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2027
Responses	592	0	0
Time Burden (Hours)	1,434	0	0
Cost Burden (Dollars)	0	0	0

Authorizing Statute(s): EO: EO 14028 Name/Subject of EO: Executive Order on Improving the Nations Cybersecurity

Citations for New Statutory Requirements: None

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:

Federal Register Notices & Comments
Did the Agency receive public comments on this ICR?

Number of Information Collection (IC) in this ICR: 1

IC Title	Form No.	Form Name
Secure Software Development Attestation Form	N/A

ICR Summary of Burden

	Total Approved	Change Due to New Statute
Annual Number of Responses	592	592
Annual Time Burden (Hours)	1,434	1,434
Annual Cost Burden (Dollars)	0	0

Burden increases because of Program Change due to Agency Discretion: No

Burden Increase Due to:

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: MB M-22-18 and M-23-16 require vendors to do self-attestations for supply chain risk management. The Federal CIO and Federal CISO/Deputy National Cyber Director strongly encourage all agencies to use CISA’s common form for that, as doing so will enable increased information sharing across the Federal ecosystem and will reduce the need for redundant attestations for software used by multiple agencies. Accordingly, attached is the SEC’s minor variation of CISA’s common form, for which the SEC is asking for expedited approval through the common form clearance process, so that the form can be shared with vendors for completion. The OMB Control No. for the CISA Common Software Attestation Form is 1670-0052. A list of agencies already approved to use the common form is located here.

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods?

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? Uncollected

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? Uncollected

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? Uncollected

Is this ICR related to the Pandemic Response? Uncollected

Agency Contact: Illeana Ciobanu 202 551-6123

View ICR - OIRA Conclusion