View Information Collection Request (ICR) Package

OMB Control No: 1670-0052	ICR Reference No: 202405-3220-001CF
Status: Active	Previous ICR Reference No:
Agency/Subagency: RRB	Agency Tracking No:
Title: Secure Software Development Attestation Form
Type of Information Collection: RCF New	Common Form ICR:
Type of Review Request:
OIRA Conclusion Action: Approved without change	Conclusion Date: 05/06/2024
	Date Received in OIRA: 05/03/2024
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	03/31/2027
Responses	18,576	0	0
Time Burden (Hours)	45,012	0	0
Cost Burden (Dollars)	0	0	0

Authorizing Statute(s): None

Citations for New Statutory Requirements: None

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:

Federal Register Notices & Comments
Did the Agency receive public comments on this ICR?

Number of Information Collection (IC) in this ICR: 1

IC Title	Form No.	Form Name
Secure Software Development Attestation Form	N/A

ICR Summary of Burden

	Total Approved	Change Due to Agency Discretion
Annual Number of Responses	18,576	18,576
Annual Time Burden (Hours)	45,012	45,012
Annual Cost Burden (Dollars)	0	0

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Miscellaneous Actions

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: Executive Order 14028 and the OMB M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices, and OMB M-23-16, Update to Memorandum M-22-18, required development of an attestation form in which software producers serving the federal government will be required to confirm implementation of specific security practices. To ensure a safe and secure digital ecosystem for all Americans, CISA released the Secure Software Development Attestation Form on March 11, 2024, taking a major step in the implementation of its requirement that producers of software used by the Federal Government attest to the adoption of secure development practices. Due to CISA guidance, the RRB will be reaching out to about 10,000 software vendors to collect information related to an Information Technology Modernization Project.

Annual Cost to Federal Government:

Does this IC contain surveys, censuses, or employ statistical methods?

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? Uncollected

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? Uncollected

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? Uncollected

Is this ICR related to the Pandemic Response? Uncollected

Agency Contact: Brian Foster 312 751-4826 brian.foster@rrb.gov

View ICR - OIRA Conclusion