View Information Collection Request (ICR) Package

OMB Control No: 1670-0052	ICR Reference No: 202405-3133-001CF
Status: Active	Previous ICR Reference No:
Agency/Subagency: NCUA	Agency Tracking No:
Title: Secure Software Development Attestation Form
Type of Information Collection: RCF New	Common Form ICR:
Type of Review Request:
OIRA Conclusion Action: Approved without change	Conclusion Date: 05/07/2024
	Date Received in OIRA: 05/01/2024
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2027
Responses	30	0	0
Time Burden (Hours)	73	0	0
Cost Burden (Dollars)	0	0	0

Authorizing Statute(s): EO: EO 14028 Name/Subject of EO: Improving the Nation’s Cybersecurity

Citations for New Statutory Requirements: None

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:

Federal Register Notices & Comments
Did the Agency receive public comments on this ICR?

Number of Information Collection (IC) in this ICR: 1

IC Title	Form No.	Form Name
Secure Software Development Attestation Form	N/A

ICR Summary of Burden

	Total Approved	Change Due to Agency Discretion
Annual Number of Responses	30	30
Annual Time Burden (Hours)	73	73
Annual Cost Burden (Dollars)	0	0

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: Executive Order 14028, “Improving the Nation’s Cybersecurity” (E.O. 14028), emphasizes the importance of securing software used by the Federal Government to perform its critical functions. To further this objective, E.O. 14028 required NIST to issue guidance “identifying practices that enhance the security of the software supply chain.” The NIST Secure Software Development Framework (SSDF) (SP 800-218), and the NIST Software Supply Chain Security Guidance (these two documents, taken together, are hereinafter referred to as “NIST Guidance”) include a set of practices that create the foundation for developing secure software. This self-attestation form identifies the minimum secure software development requirements a software producer must meet, and attest to meeting, before certain software may be used by Federal agencies. This form is used by software producers to attest that the software they produce is developed in conformity with specified secure software development practices.

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods?

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? Uncollected

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? Uncollected

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? Uncollected

Is this ICR related to the Pandemic Response? Uncollected

Agency Contact: Dacia Rogers 202 402-3374 dacia.a.rogers@hud.gov

View ICR - OIRA Conclusion