Memo for Department of State Contractors - Software Attestation Submissions

The Office of Management and Budget (OMB) has directed all federal agencies to collect attestation forms for software in use by their respective agencies that fall within the scope of OMB Memoranda M-22-18 and M-23-16 (located at: https://www.whitehouse.gov/omb/information-for-agencies/memoranda/).

To enhance the security of the federal government’s software supply chains and comply with NIST guidance, the State Department requires a completed attestation form by all existing software providers for software within the scope of M-22-18 and M-23-16, by August 30, 2024. The Office of Management and Budget (OMB) has directed all federal agencies to collect attestation forms for software in use by their respective agencies that fall within the scope of OMB Memoranda M-22-18 and M-23-16 (located at: https://www.whitehouse.gov/omb/information-for-agencies/memoranda/).

To enhance the security of the federal government’s software supply chains and comply with NIST guidance, the State Department requires a completed attestation form by all existing software providers for software within the scope of M-22-18 and M-23-16, by August 30, 2024. This requirement applies to all suppliers/vendors thatare currently providing software to the Department of State and requires immediate attention and action.

Please follow the instructions in the attached form titled “State Department Secure Software Attestation Form” and submit the form at the Repository for Software Attestations and Artifacts (RSAA). If you have already submitted another agency’s attestation form to RSAA, your firm does not need to submit an attestation form to the Department of State.

In the event your firm cannot provide an attestation form by August 30, 2024, a plan of actions and milestones (POA&M) must be submitted showing when your firm will become compliant, and it must be received no later than August 1, 2024. Questions or inquiries regarding the Department of State’s Attestation form should be sent to (SoftwareAttestations@state.gov). Thank you for the collaboration and partnership in this effort.