US Government Provides Guidance on Software Security Guarantee Requirements

Per M-23-16, attestation for critical software should be obtained no later than three months after the CISA's M-22-18 attestation common form is approved by OMB under the Paperwork Reduction Act (PRA).